This is the result of that script
?
Collected config? --- 2020-12-15-16:39 -----------
Hostname: server1
DNS Domain: example.com
FQDN: server1.example.com
ipaddress: 172.16.0.1 X.X.X.X 10.8.0.1
-----------
Kerberos SRV _kerberos._tcp.example.com record verified ok, sample output:
Server:?? ??? ?127.0.0.1
Address:?? ?127.0.0.1#53
Non-authoritative answer:
*** Can't find _kerberos._tcp.example.com: No answer
Authoritative answers can be found from:
example.com
?? ?origin = sbx8.hosting.reg.ru
?? ?mail addr = root.sbx8.hosting.reg.ru
?? ?serial = 2016052254
?? ?refresh = 10800
?? ?retry = 3600
?? ?expire = 604800
?? ?minimum = 86400
Samba is running as an AD DC
-----------
?????? Checking file: /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
-----------
This computer is running Debian 8.5 x86_64
-----------
running command : ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
default
??? link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
??? inet 127.0.0.1/8 scope host lo
??? inet6 ::1/128 scope host
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
??? link/ether
??? inet 172.16.0.1/24 brd 172.16.0.255 scope global eth0
??? inet6
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
??? link/ether
??? inet X.X.X.X/30 brd X.X.X.X scope global eth1
??? inet6
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UNKNOWN group default qlen 100
??? link/none
??? inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
-----------
?????? Checking file: /etc/hosts
127.0.0.1?? ?localhost
127.0.1.1?? ?server0
172.16.0.1?? ?server1.example.com
172.16.0.1?? ?fileserver1.server1.example.com
172.16.0.1?? ?server1.server1.example.com
# The following lines are desirable for IPv6 capable hosts
::1???? localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
-----------
?????? Checking file: /etc/resolv.conf
# Generated by NetworkManager
domain server1.example.com
search server1.example.com
nameserver 127.0.0.1
-----------
?????? Checking file: /etc/krb5.conf
[libdefaults]
?? ?default_realm = SERVER1.EXAMPLE.COM
# The following krb5.conf variables are only for MIT Kerberos.
?? ?krb4_config = /etc/krb.conf
?? ?krb4_realms = /etc/krb.realms
?? ?kdc_timesync = 1
?? ?ccache_type = 4
?? ?forwardable = true
?? ?proxiable = true
??? dns_lookup_realm = false
??? dns_lookup_kdc = true
# The following encryption type specification will be used by MIT Kerberos
# if uncommented.? In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
#?? ?default_tgs_enctypes = des3-hmac-sha1
#?? ?default_tkt_enctypes = des3-hmac-sha1
#?? ?permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
?? ?v4_instance_resolve = false
?? ?v4_name_convert = {
?? ??? ?host = {
?? ??? ??? ?rcmd = host
?? ??? ??? ?ftp = ftp
?? ??? ?}
?? ??? ?plain = {
?? ??? ??? ?something = something-else
?? ??? ?}
?? ?}
?? ?fcc-mit-ticketflags = true
[realms]
?? ?SERVER1.EXAMPLE.COM = {
?? ??? ?kdc = server1.example.com
?? ??? ?admin_server = server1.example.com
?? ?}
?? ?ATHENA.MIT.EDU = {
?? ??? ?kdc = kerberos.mit.edu:88
?? ??? ?kdc = kerberos-1.mit.edu:88
?? ??? ?kdc = kerberos-2.mit.edu:88
?? ??? ?admin_server = kerberos.mit.edu
?? ??? ?default_domain = mit.edu
?? ?}
?? ?MEDIA-LAB.MIT.EDU = {
?? ??? ?kdc = kerberos.media.mit.edu
?? ??? ?admin_server = kerberos.media.mit.edu
?? ?}
?? ?ZONE.MIT.EDU = {
?? ??? ?kdc = casio.mit.edu
?? ??? ?kdc = seiko.mit.edu
?? ??? ?admin_server = casio.mit.edu
?? ?}
?? ?MOOF.MIT.EDU = {
?? ??? ?kdc = three-headed-dogcow.mit.edu:88
?? ??? ?kdc = three-headed-dogcow-1.mit.edu:88
?? ??? ?admin_server = three-headed-dogcow.mit.edu
?? ?}
?? ?CSAIL.MIT.EDU = {
?? ??? ?kdc = kerberos-1.csail.mit.edu
?? ??? ?kdc = kerberos-2.csail.mit.edu
?? ??? ?admin_server = kerberos.csail.mit.edu
?? ??? ?default_domain = csail.mit.edu
?? ??? ?krb524_server = krb524.csail.mit.edu
?? ?}
?? ?IHTFP.ORG = {
?? ??? ?kdc = kerberos.ihtfp.org
?? ??? ?admin_server = kerberos.ihtfp.org
?? ?}
?? ?GNU.ORG = {
?? ??? ?kdc = kerberos.gnu.org
?? ??? ?kdc = kerberos-2.gnu.org
?? ??? ?kdc = kerberos-3.gnu.org
?? ??? ?admin_server = kerberos.gnu.org
?? ?}
?? ?1TS.ORG = {
?? ??? ?kdc = kerberos.1ts.org
?? ??? ?admin_server = kerberos.1ts.org
?? ?}
?? ?GRATUITOUS.ORG = {
?? ??? ?kdc = kerberos.gratuitous.org
?? ??? ?admin_server = kerberos.gratuitous.org
?? ?}
?? ?DOOMCOM.ORG = {
?? ??? ?kdc = kerberos.doomcom.org
?? ??? ?admin_server = kerberos.doomcom.org
?? ?}
?? ?ANDREW.CMU.EDU = {
?? ??? ?kdc = kerberos.andrew.cmu.edu
?? ??? ?kdc = kerberos2.andrew.cmu.edu
?? ??? ?kdc = kerberos3.andrew.cmu.edu
?? ??? ?admin_server = kerberos.andrew.cmu.edu
?? ??? ?default_domain = andrew.cmu.edu
?? ?}
?? ?CS.CMU.EDU = {
?? ??? ?kdc = kerberos.cs.cmu.edu
?? ??? ?kdc = kerberos-2.srv.cs.cmu.edu
?? ??? ?admin_server = kerberos.cs.cmu.edu
?? ?}
?? ?DEMENTIA.ORG = {
?? ??? ?kdc = kerberos.dementix.org
?? ??? ?kdc = kerberos2.dementix.org
?? ??? ?admin_server = kerberos.dementix.org
?? ?}
?? ?stanford.edu = {
?? ??? ?kdc = krb5auth1.stanford.edu
?? ??? ?kdc = krb5auth2.stanford.edu
?? ??? ?kdc = krb5auth3.stanford.edu
?? ??? ?master_kdc = krb5auth1.stanford.edu
?? ??? ?admin_server = krb5-admin.stanford.edu
?? ??? ?default_domain = stanford.edu
?? ?}
??????? UTORONTO.CA = {
??????????????? kdc = kerberos1.utoronto.ca
??????????????? kdc = kerberos2.utoronto.ca
??????????????? kdc = kerberos3.utoronto.ca
??????????????? admin_server = kerberos1.utoronto.ca
??????????????? default_domain = utoronto.ca
?? ?}
[domain_realm]
?? ?.mit.edu = ATHENA.MIT.EDU
?? ?mit.edu = ATHENA.MIT.EDU
?? ?.media.mit.edu = MEDIA-LAB.MIT.EDU
?? ?media.mit.edu = MEDIA-LAB.MIT.EDU
?? ?.csail.mit.edu = CSAIL.MIT.EDU
?? ?csail.mit.edu = CSAIL.MIT.EDU
?? ?.whoi.edu = ATHENA.MIT.EDU
?? ?whoi.edu = ATHENA.MIT.EDU
?? ?.stanford.edu = stanford.edu
?? ?.slac.stanford.edu = SLAC.STANFORD.EDU
??????? .toronto.edu = UTORONTO.CA
??????? .utoronto.ca = UTORONTO.CA
[login]
?? ?krb4_convert = true
?? ?krb4_get_tickets = false
-----------
?????? Checking file: /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed,
try:
# `info libc "Name Service Switch"' for information about this
file.
passwd:???????? compat winbind
group:????????? compat winbind
shadow:???????? compat
gshadow:??????? files
hosts:????????? files myhostname dns
networks:?????? files
protocols:????? db files
services:?????? db files
ethers:???????? db files
rpc:??????????? db files
netgroup:?????? nis
-----------
?????? Checking file: /etc/samba/smb.conf
# Global parameters
[global]
?? ?workgroup = FILESERVER1
?? ?realm = SERVER1.EXAMPLE.COM
?? ?netbios name = SERVER1
?? ?server role = active directory domain controller
?? ?dns forwarder = 87.249.16.250
?? ?idmap_ldb:use rfc2307 = yes
#??????? bind interfaces only = yes
#?? ?interfaces = eth0,lo
?? ?hosts allow = 127.0.0.1 172.16.0.0/24 10.8.0.0/24
?? ?hosts deny = 0.0.0.0/0
?? ?log level = 3 passdb:5 auth:5
#?? ?log level = 4
??????? winbind enum users = yes
??????? winbind enum groups = yes
??????? winbind use default domain = yes
[netlogon]
?? ?path = /var/lib/samba/sysvol/server1.example.com/scripts
?? ?read only = No
[sysvol]
?? ?path = /var/lib/samba/sysvol
?? ?read only = No
[TestData]
??? comment =? TestData
??? browseable = yes
??? writable = yes
??? path = /test_data
??? public = yes
-----------
BIND_DLZ not detected in smb.conf
-----------
Installed packages:
ii? acl?????????????????????????????????? 2.2.52-2????????????????????????????
amd64??????? Access control list utilities
ii? attr????????????????????????????????? 1:2.4.47-2??????????????????????????
amd64??????? Utilities for manipulating filesystem extended attributes
ii? krb5-config?????????????????????????? 2.3?????????????????????????????????
all????????? Configuration files for Kerberos Version 5
ii? krb5-locales????????????????????????? 1.12.1+dfsg-19+deb8u2???????????????
all????????? Internationalization support for MIT Kerberos
ii? krb5-user???????????????????????????? 1.12.1+dfsg-19+deb8u5???????????????
amd64??????? Basic programs to authenticate using MIT Kerberos
ii? libacl1:amd64???????????????????????? 2.2.52-2????????????????????????????
amd64??????? Access control list shared library
ii? libattr1:amd64??????????????????????? 1:2.4.47-2??????????????????????????
amd64??????? Extended attribute shared library
ii? libgssapi-krb5-2:amd64??????????????? 1.12.1+dfsg-19+deb8u5???????????????
amd64??????? MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
ii? libkrb5-26-heimdal:amd64????????????? 1.6~rc2+dfsg-9+deb8u1???????????????
amd64??????? Heimdal Kerberos - libraries
ii? libkrb5-3:amd64?????????????????????? 1.12.1+dfsg-19+deb8u5???????????????
amd64??????? MIT Kerberos runtime libraries
ii? libkrb5support0:amd64???????????????? 1.12.1+dfsg-19+deb8u5???????????????
amd64??????? MIT Kerberos runtime libraries - Support library
ii? libnss-winbind:amd64????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba nameservice integration plugins
ii? libpam-winbind:amd64????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Windows domain authentication integration plugin
ii? libsmbclient:amd64??????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? shared library for communication with SMB/CIFS servers
ii? libwbclient0:amd64??????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba winbind client library
ii? oracle-java8-jdk????????????????????? 8u101???????????????????????????????
amd64??????? Java? Platform, Standard Edition 8 Development Kit
ii? python-samba????????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Python bindings for Samba
ii? samba???????????????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? SMB/CIFS file, print, and login server for Unix
ii? samba-common????????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
all????????? common files used by both the Samba server and client
ii? samba-common-bin????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba common files used by both the server and the client
ii? samba-dsdb-modules??????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba Directory Services Database
ii? samba-libs:amd64????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba core libraries
ii? samba-vfs-modules???????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? Samba Virtual FileSystem plugins
ii? spice-client-glib-usb-acl-helper????? 0.25-1+b1???????????????????????????
amd64??????? Spice client glib usb acl helper
ii? winbind?????????????????????????????? 2:4.2.14+dfsg-0+deb8u13?????????????
amd64??????? service to resolve user and group information from Windows NT
servers
-----------
?
?
--
Best regards, Alex Orlov