Daniel Lopes de Carvalho
2020-Apr-07 14:59 UTC
[Samba] Join new DC to domain - advice to upgrade Samba 4.
Hi Rowland, I'll consider the update. But I need to backup this host (adc02) before, because it the only and the main DC on my network... =( Find attached below the output of the script: Config collected --- 2020-04-07-15:30 ----------- Hostname: dcs01 DNS Domain: test.example.domain.br Realm: TEST.EXAMPLE.DOMAIN.BR FQDN: dcs01.test.example.domain.br ipaddress: 177.X.X.3 ----------- Kerberos SRV _kerberos._tcp.test.example.domain.br record(s) verified ok, sample output: Server: 177.X.X.69 Address: 177.X.X.69#53 _kerberos._tcp.test.example.domain.br service = 0 100 88 adc02.test.example.domain.br. ----------- 'kinit Administrator' checked successfully. ----------- This computer is running Debian 9.12 x86_64 ----------- running command : ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:aa:cc:e2 brd ff:ff:ff:ff:ff:ff inet 177.X.X.3/25 brd 177.X.X.127 scope global ens192 inet6 fe80::20c:29ff:feaa:cce2/64 scope link ----------- Checking file: /etc/hosts 127.0.0.1 localhost 177.X.X.3 dcs01.test.example.domain.br dcs01 # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters ----------- Checking file: /etc/resolv.conf search test.example.domain.br nameserver 177.X.X.69 ----------- Checking file: /etc/krb5.conf [libdefaults] default_realm = TEST.EXAMPLE.DOMAIN.BR dns_lookup_realm = false dns_lookup_kdc = true ----------- Checking file: /etc/nsswitch.conf # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat group: compat shadow: compat gshadow: files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ----------- Warning, does not exist ----------- Time on the DC with PDC Emulator role is: 2020-04-07T15:31:10 Time on this computer is: 2020-04-07T15:31:10 Time verified ok, within the allowed 300sec margin. Time offset is currently : 0 seconds ----------- Installed packages: ii attr 1:2.4.47-2+b2 amd64 Utilities for manipulating filesystem extended attributes ii krb5-config 2.6 all Configuration files for Kerberos Version 5 ii krb5-locales 1.15-1+deb9u1 all internationalization support for MIT Kerberos ii krb5-user 1.15-1+deb9u1 amd64 basic programs to authenticate using MIT Kerberos ii libacl1:amd64 2.2.52-3+b1 amd64 Access control list shared library ii libattr1:amd64 1:2.4.47-2+b2 amd64 Extended attribute shared library ii libgssapi-krb5-2:amd64 1.15-1+deb9u1 amd64 MIT Kerberos runtime libraries - krb5 GSS-API Mechanism ii libkrb5-3:amd64 1.15-1+deb9u1 amd64 MIT Kerberos runtime libraries ii libkrb5support0:amd64 1.15-1+deb9u1 amd64 MIT Kerberos runtime libraries - Support library ii libnss-winbind:amd64 2:4.5.16+dfsg-1+deb9u2 amd64 Samba nameservice integration plugins ii libpam-winbind:amd64 2:4.5.16+dfsg-1+deb9u2 amd64 Windows domain authentication integration plugin ii libwbclient0:amd64 2:4.5.16+dfsg-1+deb9u2 amd64 Samba winbind client library ii python-samba 2:4.5.16+dfsg-1+deb9u2 amd64 Python bindings for Samba ii samba 2:4.5.16+dfsg-1+deb9u2 amd64 SMB/CIFS file, print, and login server for Unix ii samba-common 2:4.5.16+dfsg-1+deb9u2 all common files used by both the Samba server and client ii samba-common-bin 2:4.5.16+dfsg-1+deb9u2 amd64 Samba common files used by both the server and the client ii samba-dsdb-modules 2:4.5.16+dfsg-1+deb9u2 amd64 Samba Directory Services Database ii samba-libs:amd64 2:4.5.16+dfsg-1+deb9u2 amd64 Samba core libraries ii samba-vfs-modules 2:4.5.16+dfsg-1+deb9u2 amd64 Samba Virtual FileSystem plugins ii winbind 2:4.5.16+dfsg-1+deb9u2 amd64 service to resolve user and group information from Windows NT servers ----------- Thanks again. On Tue, Apr 7, 2020 at 11:09 AM Rowland penny via samba < samba at lists.samba.org> wrote:> On 07/04/2020 14:51, Daniel Lopes de Carvalho wrote: > > Hi Rowland, thanks for your email. > > > > The working DC was installed around 2 years ago. It is the reason to > > stick in Stretch. But if I can upgrade the working DC to Buster and > > Samba 4.9.5 without any problem, it is OK to me. > I would upgrade Debian and once you get everything working correctly, > you can use Louis's repo: http://apt.van-belle.nl/ > > > > > > Find below the output of samba-tool join command: > > > > samba-tool domain join test.example.domain.br > > <http://test.example.domain.br> DC -U"test/administrator" -d3 > > > > Finding a writeable DC for domain 'test.example.domain.br > > <http://test.example.domain.br>' > > resolve_lmhosts: Attempting lmhosts lookup for name > > _ldap._tcp.test.example.domain.br <http://tcp.test.example.domain.br > ><0x0> > > Found DC adc02.test.example.domain.br > > <http://adc02.test.example.domain.br> > > resolve_lmhosts: Attempting lmhosts lookup for name > > adc02.test.example.domain.br <http://adc02.test.example.domain.br><0x20> > > Password for [test\administrator]: > > Cannot reach a KDC we require to contact > > ldap/adc02.test.example.domain.br@ : kinit for administrator at test > > failed (Cannot contact any KDC for requested realm) > > That looks like your problem, for some reason 'adc02.example.domain.br' > cannot be found. > > Can you run the attached script on the machine you are trying to join as > a DC and then post the output in a reply to the mailing list, do not > attach it, this mailing list strips attachments. > > Rowland > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >-- Daniel Lopes de Carvalhohttp://www.unisim.cepetro.unicamp.brdaniel at cepetro.unicamp.br 19 3521-1221
Rowland penny
2020-Apr-07 18:55 UTC
[Samba] Join new DC to domain - advice to upgrade Samba 4.
On 07/04/2020 15:59, Daniel Lopes de Carvalho wrote:> Hi Rowland, > > I'll consider the update. But I need to backup this host (adc02) > before, because it the only and the main DC on my network... =( > > Find attached below the output of the script: >Nothing wrong there, is a firewall running on either machine ? Rowland
Daniel Lopes de Carvalho
2020-Apr-07 19:12 UTC
[Samba] Join new DC to domain - advice to upgrade Samba 4.
No, there is no firewall... They are on the same network without any blocking... Let me tell you a little about my scenario... When I installed Samba4 as my main AD (2018), I had ADC01 that was my primary DC and after I joined the ADC02 without any problem. And in the beginning of 2019, I joined a Windows Server 2008 R2 as my ADC03. All of them worked well until (around a year) I had a hardware problem with ADC01 that I had to exec offline demote. After this problem, ADC03 is unable to sync with ADC02. I have uninstalled AD on ADC03 and tried to install it again but without sucess. Then I tried this new DCS01 and here I'm... On Tue, Apr 7, 2020 at 3:56 PM Rowland penny via samba < samba at lists.samba.org> wrote:> On 07/04/2020 15:59, Daniel Lopes de Carvalho wrote: > > Hi Rowland, > > > > I'll consider the update. But I need to backup this host (adc02) > > before, because it the only and the main DC on my network... =( > > > > Find attached below the output of the script: > > > Nothing wrong there, is a firewall running on either machine ? > > Rowland > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >-- Daniel Lopes de Carvalhohttp://www.unisim.cepetro.unicamp.brdaniel at cepetro.unicamp.br 19 3521-1221
L.P.H. van Belle
2020-Apr-08 07:06 UTC
[Samba] Join new DC to domain - advice to upgrade Samba 4.
All i see a missing acl package. But that had nothing todo with not being able to join. But try this. Add in resolv.conf the ip of DCS02 and DCS03 in this order. Try to join a gain. As i see now, your trying to join a server and that uses itself as resolving server, that does not work when you joining. Greetz, Louis> -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Rowland penny via samba > Verzonden: dinsdag 7 april 2020 20:56 > Aan: sambalist > Onderwerp: Re: [Samba] Join new DC to domain - advice to > upgrade Samba 4. > > On 07/04/2020 15:59, Daniel Lopes de Carvalho wrote: > > Hi Rowland, > > > > I'll consider the update. But I need to backup this host (adc02) > > before, because it the only and the main DC on my network... =( > > > > Find attached below the output of the script: > > > Nothing wrong there, is a firewall running on either machine ? > > Rowland > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba > >
Daniel Lopes de Carvalho
2020-Apr-08 11:47 UTC
[Samba] Join new DC to domain - advice to upgrade Samba 4.
Hi Louis, I installed the acl and edited resolv.conf as you suggested, but the error persist, unfortunately. This weekend I'll take a snapshot of the working DC and try to update Debian and Samba. If there is some other thing to do before the update, let me know, please. Thanks and best regards On Wed, Apr 8, 2020 at 4:09 AM L.P.H. van Belle via samba < samba at lists.samba.org> wrote:> All i see a missing acl package. > But that had nothing todo with not being able to join. > > But try this. > > Add in resolv.conf the ip of DCS02 and DCS03 in this order. > Try to join a gain. > > As i see now, your trying to join a server and that uses itself as > resolving server, that does not work when you joining. > > > Greetz, > > Louis > > > > -----Oorspronkelijk bericht----- > > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > > Rowland penny via samba > > Verzonden: dinsdag 7 april 2020 20:56 > > Aan: sambalist > > Onderwerp: Re: [Samba] Join new DC to domain - advice to > > upgrade Samba 4. > > > > On 07/04/2020 15:59, Daniel Lopes de Carvalho wrote: > > > Hi Rowland, > > > > > > I'll consider the update. But I need to backup this host (adc02) > > > before, because it the only and the main DC on my network... =( > > > > > > Find attached below the output of the script: > > > > > Nothing wrong there, is a firewall running on either machine ? > > > > Rowland > > > > > > > > -- > > To unsubscribe from this list go to the following URL and read the > > instructions: https://lists.samba.org/mailman/options/samba > > > > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >-- Daniel Lopes de Carvalhohttp://www.unisim.cepetro.unicamp.brdaniel at cepetro.unicamp.br 19 3521-1221