I'm trying to join an Ubuntu 16.04 server to a Windows 2003 R2 domain by following the Ubuntu SSSD and Active Directory Guide. My admin says that from the controller side, it is part of the domain. But SSSD can't seem to start and
net ads join fails.
krb5.conf was modified by the installer and now has this:
kyle@Server21:~$ cat /etc/krb5.conf [libdefaults] default_realm = COMAPNYNAME.LOCAL
On a previous install I thought there was something else in
[realms] that was asked for during the install but I can't remember what and it wasn't asked for this time around.
[global] ## Browsing/Identification ### # Change this to the workgroup/NT-domain name your Samba server will part of workgroup = COMPANYNAME client signing = yes client use spnego = yes kerberos method = secrets and keytab realm = COMPANYNAME.LOCAL security = ads
kyle@Server21:~$ sudo cat /etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = COMPANYNAME.LOCAL [domain/COMPANYNAME.LOCAL] id_provider = ad access_provider = ad override_homedir = /home/%d/%u
Though the SSSD service can't seem to start:
kyle@Server21:~$ systemctl status sssd.service ● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2016-06-22 09:57:57 EDT; 37min ago Process: 16027 ExecStart=/usr/sbin/sssd -D -f (code=exited, status=1/FAILURE) Jun 22 09:57:55 Server21 sssd: Starting up Jun 22 09:57:55 Server21 sssd: Starting up Jun 22 09:57:55 Server21 sssd: Starting up Jun 22 09:57:56 Server21 sssd[be: Starting up Jun 22 09:57:57 Server21 sssd[be: Failed to read keytab [default]: No such file or directory Jun 22 09:57:57 Server21 sssd: Exiting the SSSD. Could not restart critical service [COMPANYNAME.LOCAL]. Jun 22 09:57:57 Server21 systemd: sssd.service: Control process exited, code=exited status=1 Jun 22 09:57:57 Server21 systemd: Failed to start System Security Services Daemon. Jun 22 09:57:57 Server21 systemd: sssd.service: Unit entered failed state. Jun 22 09:57:57 Server21 systemd: sssd.service: Failed with result 'exit-code'.
And since the guide says that ownership and permissions are important:
kyle@Server21:~$ sudo ls -la /etc/sssd total 12 drwx--x--x 2 sssd sssd 4096 Jun 21 14:34 . drwxr-xr-x 103 root root 4096 Jun 22 10:21 .. -rw------- 1 root root 172 Jun 21 14:22 sssd.conf
kyle@Server21:~$ cat /etc/nsswitch.conf # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat sss group: compat sss shadow: compat sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: files sss
kyle@Server21:~$ cat /etc/hosts 127.0.0.1 localhost 127.0.1.1 Server21.COMPANYNAME.LOCAL Server21 192.168.11.11 Server21.COMPANYNAME.LOCAL Server21 # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters
Here is where the trouble starts. Using
sudo to run
kinit results in the following:
kyle@Server21:~$ sudo kinit adminstrator kinit: Client 'adminstrator@COMPANYNAME.LOCAL' not found in Kerberos database while getting initial credentials
It will authenticate if I drop the
kyle@Server21:~$ kinit -V administrator Using default cache: /tmp/krb5cc_1000 Using principal: administrator@COMPANYNAME.LOCAL Password for administrator@COMPANYNAME.LOCAL: Authenticated to Kerberos v5
And I can verify the ticket:
kyle@Server21:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: administrator@COMPANYNAME.LOCAL Valid starting Expires Service principal 06/23/2016 13:41:55 06/23/2016 23:41:55 krbtgt/COMPANYNAME.LOCAL@COMPANYNAME.LOCAL renew until 06/24/2016 13:41:48
But when I try to join the domain:
kyle@Server21:~$ sudo net ads join -k Failed to join domain: failed to lookup DC info for domain 'COMPANYNAME.LOCAL' over rpc: An internal error occurred.
I had previously received the
NT_STATUS_UNSUCCESSFUL message mentioned in the guide but was able to solve that by modifying my
The guide talks about verifying that the computer account was created in the Active Directory. And my admin says that he can see the machine just fine so I believe that is okay. The second verification option does not tell me what I'm supposed to get back from that command but I don't receive anything so I suppose it isn't working.
So where am I going wrong here?
I'm not sure what I did, but SSSD is now running.