Есть 2 одинаковых сервера Samba, введенные в AD с помощью sssd:
root@srv-nas samba# cat /etc/centos-release
CentOS Linux release 7.6.1810 (Core)
root@srv-nas samba# uname -a
Linux srv-nas.april-group.ru 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
root@srv-nas samba# smbd -V
Version 4.8.3
root@srv-nas samba# sssd --version
1.16.2
root@srv-nas samba# realm list
april-group.ru
type: kerberos
realm-name: APRIL-GROUP.RU
domain-name: april-group.ru
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U
login-policy: allow-realm-logins
Монитруем ресурс:
root@srv-backup nas# mount -t cifs -o credentials=/root/cred,iocharset=utf8,file_mode=007,dir_mode=0777,vers=2.0 //srv-nas/nas/ /mnt/nas/ -vvvdomain=april-group
mount.cifs kernel mount options: ip=192.168.0.170,unc=\\srv-nas\nas,iocharset=utf8,file_mode=007,dir_mode=0777,vers=2.0,user=robot2,domain=april-group,pass=********
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
Доступ smbclient получаем легко и непринужденно:
root@srv-backup nas# smbclient -d 5 -U robot2 -m SMB2 //srv-nas/nas
INFO: Current debug levels:
all: 5
tdb: 5
printdrivers: 5
lanman: 5
smb: 5
rpc_parse: 5
rpc_srv: 5
rpc_cli: 5
passdb: 5
sam: 5
auth: 5
winbind: 5
vfs: 5
idmap: 5
quota: 5
acls: 5
locking: 5
msdfs: 5
dmapi: 5
registry: 5
scavenger: 5
dns: 5
ldb: 5
tevent: 5
auth_audit: 5
auth_json_audit: 5
kerberos: 5
drs_repl: 5
smb2: 5
smb2_credits: 5
lp_load_ex: refreshing parameters
Initialising global parameters
INFO: Current debug levels:
all: 5
tdb: 5
printdrivers: 5
lanman: 5
smb: 5
rpc_parse: 5
rpc_srv: 5
rpc_cli: 5
passdb: 5
sam: 5
auth: 5
winbind: 5
vfs: 5
idmap: 5
quota: 5
acls: 5
locking: 5
msdfs: 5
dmapi: 5
registry: 5
scavenger: 5
dns: 5
ldb: 5
tevent: 5
auth_audit: 5
auth_json_audit: 5
kerberos: 5
drs_repl: 5
smb2: 5
smb2_credits: 5
Processing section "[global]"
doing parameter workgroup = APRIL-GROUP
doing parameter security = ads
doing parameter kerberos method = system keytab
doing parameter realm = april-group.ru
doing parameter passdb backend = tdbsam
doing parameter domain master = no
doing parameter local master = no
doing parameter preferred master = no
doing parameter map acl inherit = yes
doing parameter log file = /var/log/samba/log.%m
doing parameter load printers = no
doing parameter cups options = raw
pm_process() returned Yes
added interface bond0 ip=192.168.0.21 bcast=192.168.255.255 netmask=255.255.0.0
Netbios name list:-
my_netbios_names 0 ="SRV-BACKUP"
Client started (version 4.8.3).
Opening cache file at /var/lib/samba/gencache.tdb
Opening cache file at /var/lib/samba/lock/gencache_notrans.tdb
sitename_fetch: Returning sitename for realm 'APRIL-GROUP.RU': "Default-First-Site-Name"
name srv-nas#20 found.
Connecting to 192.168.0.170 at port 445
Socket options:
SO_KEEPALIVE = 0
SO_REUSEADDR = 0
SO_BROADCAST = 0
TCP_NODELAY = 1
TCP_KEEPCNT = 9
TCP_KEEPIDLE = 7200
TCP_KEEPINTVL = 75
IPTOS_LOWDELAY = 0
IPTOS_THROUGHPUT = 0
SO_REUSEPORT = 0
SO_SNDBUF = 332800
SO_RCVBUF = 238128
SO_SNDLOWAT = 1
SO_RCVLOWAT = 1
SO_SNDTIMEO = 0
SO_RCVTIMEO = 0
TCP_QUICKACK = 1
TCP_DEFER_ACCEPT = 0
session request ok
negotiated dialect[SMB2_10] against server[srv-nas]
got OID=1.2.840.48018.1.2.2
Enter APRIL-GROUP\robot2's password:
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
session setup ok
signed SMB2 message
signed SMB2 message
signed SMB2 message
signed SMB2 message
tconx ok
Try "help" to get a list of possible commands.
smb: \>
Различные варианты sec= и vers= в mount.cifs не дают результат
