Samba4 & Active Directory Kerberos [Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Question

Yesterday I configured an Active Directory Server using Arch Linux and Samba 4 following this guide.

I even added a client to the domain and was able to log in successfuly on my client. After a restart it no longer works, I can't use Microsoft RSAT anymore and I tracked down this problem to the kinit [email protected] instruction which returns:

Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Trying to solve my problem I tried googling around and found this:

kinit(v5): Cannot contact any KDC for requested realm while getting initial credentials

The application cannot find the kerberos server. Check firewall, DNS and /etc/hosts.

But, as pointed by the Arch Linux Tutorial posted adobe I tried some commands to test connection:

# host -t SRV _ldap._tcp.internal.corp.com.
# host -t SRV _kerberos._udp.internal.corp.com.
# host -t A core.internal.corp.com.  #core is my server hostname

Which returned:

_ldap._tcp.internal.corp.com has SRV record 0 100 389 core.internal.corp.com.
_kerberos._udp.internal.corp.com has SRV record 0 100 88 core.internal.corp.com.
core.internal.corp.com has address 192.168.0.75

As you can see on my second command it seems that I actually can reach the kerberos service.

Here are some of my config files:

/etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf as pointed on the tutorial )

[libdefaults]
    default_realm = INTERNAL.CORP.COM
    dns_lookup_realm = false
    dns_lookup_kdc = true

/etc/resolv.conf

# Generated by resolvconf
nameserver 192.168.0.75
nameserver 8.8.8.8
search internal.corp
namserver 127.0.0.1

My server hostname is CORE. My NetBIOS Domain is CORP. My DNS Domain is internal.corp.com

I'm out of ideas, any help would be appreciated.

Solution

Searching a little bit more I found a solution to my problem. As posted here, all I needed to do was changing my samba configuration:

/etc/samba/smb.conf Where I added this line into the [global] section.

server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc, dnsupdate, dns, s3fs

Comments

[Paul Paku]

Saved my day :)

[Paul Paku]

Saved on 4.12.0 but had to remove the line on 4.13.2 ...