ONTAPをActive Directoryに参加させようとしたら「Reason: SecD Error: no server available.」でエラーになった。
ontap91::> vserver cifs create -cifs-server newsvm0 -domain adosakana.local -ou CN=Computers
In order to create an Active Directory machine account for the CIFS server, you
must supply the name and password of a Windows account with sufficient
privileges to add computers to the "CN=Computers" container within the
"ADOSAKANA.LOCAL" domain.
Enter the user name: administrator
Enter the password:
Error: Machine account creation procedure failed
[ 91] Loaded the preliminary configuration.
[ 213] Created a machine account in the domain
[ 214] Successfully connected to ip 172.17.44.49, port 445 using
TCP
[ 249] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 250] Cluster and Domain Controller times differ by more than
the configured clock skew (KRB5KRB_AP_ERR_SKEW)
[ 250] Kerberos authentication failed with result: 7537.
[ 258] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 259] Cluster and Domain Controller times differ by more than
the configured clock skew (KRB5KRB_AP_ERR_SKEW)
[ 259] Kerberos authentication failed with result: 7537.
[ 259] Unable to connect to LSA service on
adserver.adosakana.local (Error:
RESULT_ERROR_KERBEROS_SKEW)
[ 260] No servers available for MS_LSA, vserver: 2, domain:
adosakana.local.
**[ 260] FAILURE: Unable to make a connection (LSA:ADOSAKANA.LOCAL),
** result: 6940
[ 260] Could not find Windows SID
'S-1-5-21-937304154-1581684492-536532533-512'
[ 284] Deleted existing account
'CN=NEWSVM0,CN=Computers,DC=adosakana,DC=local'
Error: command failed: Failed to create the Active Directory machine account
"NEWSVM0". Reason: SecD Error: no server available.
ontap91::>
netapp9101::> vserver cifs show -ins
Vserver: svm0
CIFS Server NetBIOS Name: SVM0
NetBIOS Domain/Workgroup Name: ADOSAKANA
Fully Qualified Domain Name: ADOSAKANA.LOCAL
Organizational Unit: CN=Computers
Default Site Used by LIFs Without Site Membership:
Workgroup Name: -
Authentication Style: domain
CIFS Server Administrative Status: up
CIFS Server Description:
List of NetBIOS Aliases: -
netapp9101::>
netapp9101::> vserver cifs add-netbios-aliases -netbios-aliases WINSERVER -vserver svm0
netapp9101::> vserver cifs show -ins
Vserver: svm0
CIFS Server NetBIOS Name: SVM0
NetBIOS Domain/Workgroup Name: ADOSAKANA
Fully Qualified Domain Name: ADOSAKANA.LOCAL
Organizational Unit: CN=Computers
Default Site Used by LIFs Without Site Membership:
Workgroup Name: -
Authentication Style: domain
CIFS Server Administrative Status: up
CIFS Server Description:
List of NetBIOS Aliases: WINSERVER
netapp9101::>
PS C:\Users\Administrator> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (C:\Users\Administrator/.ssh/id_rsa):
Created directory 'C:\Users\Administrator/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\Administrator/.ssh/id_rsa.
Your public key has been saved in C:\Users\Administrator/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Eomw4OJ5tGv2Nx0HkGCeaRT5PxBU3krAixd96aCIkJU administrator@WindowsServer
The key's randomart image is:
+---[RSA 2048]----+
|. +..=*o+. . |
|.+ E+ooBoo.o |
|..o.o=* *o+. |
|o o.oo B.... |
| o o o S.. |
| . . . + . |
| + . + |
| o . o . |
| .. . |
+----[SHA256]-----+
PS C:\Users\Administrator>
netapp::> security login create -user admin -application ssh -authentication-method publickey -role admin
Warning: To use public-key authentication, you must create a public key for user "admin".
netapp::>
上記で警告が出ていますが、これは現状該当するユーザ用の公開鍵が登録されていないためのものです。
再度「security login show -vserver クラスタ名」を実行すると、publickeyの登録が増えていることが確認出来ます。
netapp::> security login show -vserver netapp
Vserver: netapp
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
admin console password admin no none
admin http password admin no none
admin ontapi password admin no none
admin service-processor
password admin no none
admin ssh password admin no none
admin ssh publickey admin - none
autosupport console password autosupport no none
7 entries were displayed.
netapp::>
PS C:\Users\Administrator> ssh admin@172.17.44.55 "system node show"
The authenticity of host '172.17.44.55 (172.17.44.55)' can't be established.
ECDSA key fingerprint is SHA256:Hx4oFf3c4GUnc/HxpK4X1U6Um7M2a+hG4JdUAtFi4Hc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.17.44.55' (ECDSA) to the list of known hosts.
Last login time: 12/13/2022 18:31:20
Node Health Eligibility Uptime Model Owner Location
--------- ------ ----------- ------------- ----------- -------- ---------------
netapp-01 true true 1 days 07:30 SIMBOX
PS C:\Users\Administrator> ssh admin@172.17.44.55 "system node show"
Last login time: 12/13/2022 18:55:35
Node Health Eligibility Uptime Model Owner Location
--------- ------ ----------- ------------- ----------- -------- ---------------
netapp-01 true true 1 days 07:30 SIMBOX
PS C:\Users\Administrator>
@echo off
ssh admin@172.17.44.55 "date" >> c:\tmp\command.txt
これをタスクスケジューラに登録してログアウト。
指定時間経過後にファイルを確認してみます。
PS C:\Users\Administrator> type C:\tmp\command.txt
Last login time: 12/13/2022 19:00:13
Node Date Time zone
--------- ------------------------ -------------------------
netapp-01
Tue Dec 13 19:05:11 2022 Japan
PS C:\Users\Administrator>
