1

We are actually in preparation of taking down one of our three domain controller (Win2k3). They are all serving the same domain.

Actually we still see connections incoming from Debian (5/6/7) Servers using winbindd for domain authentication to the server we want to take down.

/etc/krb5.conf on the debian hosts looks like this:

[libdefaults]
        default_realm = DOMAIN.COM
[realms]
        local.domain.com = {
                kdc = dc1.domain.com
                kdc = dc2.domain.com
                admin_server = dc1.domain.com
                default_domain = domain.com
        }
[domain_realm]
        .domain.com = DOMAIN.COM
        domain.com = DOMAIN.COM

[login]
        krb4_convert = true
        krb4_get_tickets = false

So how does winbindd determine the available domain-controller(dc)? Is it done by Broadcasts, even if there are dc entries in krb5.conf?

0

Kerberos apps also look for DNS srv records to find the KDC's for a given realm.

See

http://technet.microsoft.com/en-us/library/cc961719.aspx

My guess is that winbindd is using LDAP as well as kerberos.

  • Thanks for your answer. If found the "special" DNS-Entries in the DNS-Server. They look like: _kerberos._tcp.domain.com It seems to be very easy to resolv and ask them. – Andi Feb 6 '14 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.