DC发生原因secd.ldap.noServers的多个PTR

最后更新
另存为PDF

Views:: 3

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas<a>2009455552</a>

Last Updated:

适用场景

ONTAP 9
CIFS
MS-LDAP/AD-LDAP
Kerberos

问题描述

::> event log show -event *secd.ldap.noServers* -severity *

Time Node Severity Event

------------------- ---------------- ------------- ---------------------------

3/20/2023 13:47:47  cluster-n02   EMERGENCY   secd.ldap.noServers: None of the LDAP servers configured for Vserver (svm1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).

3/20/2023 13:47:35  cluster-n01   EMERGENCY   secd.ldap.noServers: None of the LDAP servers configured for Vserver (svm1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).

GET—dc—info间歇性失败：

::> set adv

Warning: These advanced commands are potentially dangerous; use them only when directed to do so by NetApp personnel.

Do you want to continue? {y|n}: y

::*> vserver services access-check authentication get-dc-info -node cluster-n01 -vserver svm1

Error: command failed: RPC call to SecD failed. RPC: "SecD Error: no server

available". Reason: "".

MS-LDAP服务器不可用：

::*> cifs domain discovered-servers show -node cluster-n01 -vserver svm1

Node: cluster-n01

Vserver: svm1
 Domain Name    Type    Preference  DC-Name   DC-Address     Status
 --------------- -------- ----------  --------- ---------------   ---------
 naslab.local KERBEROS    favored    india10    10.xx.xx.245    undetermined
 naslab.local KERBEROS    favored    india14    10.xx.xx.241    undetermined
 naslab.local KERBEROS    favored    india33    169.21.252.203  undetermined
 naslab.local MS-LDAP    favored     india10    10.xx.xx.245    unavailable
 naslab.local MS-LDAP    favored     india14    10.xx.xx.241    unavailable
 naslab.local MS-LDAP    favored     india33    169.xx.yy.203    unavailable
 naslab.local MS-DC      favored    india10    10.xx.xx.245     undetermined
 naslab.local MS-DC      favored    india14    10.xx.xx.241     undetermined
 naslab.local MS-DC      favored    india33    169.xx.yy.203   OK

对于AD-LDAP通信、客户端会话安全性设置为签名：

::*> cifs security show -vserver svm1 -fields session-security-for-ad-ldap

vserver session-security-for-ad-ldap

------- ----------------------------

svm1 sign

SECD日志显示SASL绑定到LDAP服务器失败：

[kern_secd:info:9440] | [000.039.193]  debug:  ldap_sasl_interactive_bind_s returned -2  { in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:666 }

[kern_secd:info:9440] | [000.039.200]  ERR  :  Unable to SASL bind to LDAP server using GSSAPI: Local error { in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:670 }

[kern_secd:info:9440] | [000.039.210]  info :  Additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database) { in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:673 }

[kern_secd:info:9440] | [000.039.216]  ERR  :  RESULT_ERROR_LDAPSERVER_LOCAL_ERROR:7643 in ldapSaslBindGssapi() at src/connection_manager/secd_connection.cpp:677

[kern_secd:info:9440] | [000.039.221] ERR : ldapSaslBindGssapi: LDAP Error: (-2): 'Local error':

运行多次后、getxxbyyy gethostbyaddr会为DC IP返回不同的主机名：

::*> vserver services name-service getxxbyyy gethostbyaddr -node cluster-n01 -vserver svm1 -ipaddress 10.xx.xx.245

(vserver services name-service getxxbyyy gethostbyaddr)

IP address: 10.xx.xx.245

Host name: india10.naslab.local

Alias: NASLAB.naslab.local

Alias: gc._msdcs.naslab.local

::*> vserver services name-service getxxbyyy gethostbyaddr -node cluster-n01 -vserver svm1 -ipaddress 10.xx.xx.245

IP address: 10.xx.xx.245

Host name: NASLAB.naslab.local

Alias: india10.naslab.local

Alias: gc._msdcs.naslab.local

::*> vserver services name-service getxxbyyy gethostbyaddr -node cluster-n01 -vserver svm1 -ipaddress 10.xx.xx.245

IP address: 10.xx.xx.245

Host name: gc._msdcs.naslab.local

Alias: india10.naslab.local

Alias: NASLAB.naslab.local