I?ve corrected all my mistakes with names (at least I think so), but ANYWAY
getent doesn?t list
users and groups from AD. Below is the new result of the script. Please, help me
to fix it.
?
Collected config --- 2020-12-15-21:37 -----------
?
Hostname: server1
DNS Domain: headoffice.example.com
FQDN: server1.headoffice.example.com
ipaddress: 172.16.0.1 x.x.x.x 10.8.0.1
?
-----------
?
Kerberos SRV _kerberos._tcp.headoffice.example.com record verified ok, sample
output:
Server: 172.16.0.1
Address: 172.16.0.1#53
?
_kerberos._tcp.headoffice.example.com service = 0 100 88
server1.headoffice.example.com.
Samba is running as an AD DC
?
-----------
Checking file: /etc/os-release
?
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
?
-----------
?
?
This computer is running Debian 8.5 x86_64
?
-----------
running command : ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
link/ether 0
inet 172.16.0.1/24 brd 172.16.0.255 scope global eth0
inet6
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
link/ether
inet x.x.x.x brd x.x.x.x scope global eth1
inet6
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
?
-----------
Checking file: /etc/hosts
?
127.0.0.1 localhost
127.0.1.1 server0
172.16.0.1 server1.headoffice.example.com server1
?
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
?
-----------
?
Checking file: /etc/resolv.conf
?
search headoffice.example.com
nameserver 172.16.0.1
?
-----------
?
Checking file: /etc/krb5.conf
?
[libdefaults]
default_realm = HEADOFFICE.EXAMPLE.COM
?
# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
dns_lookup_realm = false
dns_lookup_kdc = true
?
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
?
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
?
# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
?
[realms]
HEADOFFICE.EXAMPLE.COM = {
kdc = server1
admin_server = server1
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu:88
kdc = kerberos-1.mit.edu:88
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
}
MEDIA-LAB.MIT.EDU = {
kdc = kerberos.media.mit.edu
admin_server = kerberos.media.mit.edu
}
ZONE.MIT.EDU = {
kdc = casio.mit.edu
kdc = seiko.mit.edu
admin_server = casio.mit.edu
}
MOOF.MIT.EDU = {
kdc = three-headed-dogcow.mit.edu:88
kdc = three-headed-dogcow-1.mit.edu:88
admin_server = three-headed-dogcow.mit.edu
}
CSAIL.MIT.EDU = {
kdc = kerberos-1.csail.mit.edu
kdc = kerberos-2.csail.mit.edu
admin_server = kerberos.csail.mit.edu
default_domain = csail.mit.edu
krb524_server = krb524.csail.mit.edu
}
IHTFP.ORG = {
kdc = kerberos.ihtfp.org
admin_server = kerberos.ihtfp.org
}
GNU.ORG = {
kdc = kerberos.gnu.org
kdc = kerberos-2.gnu.org
kdc = kerberos-3.gnu.org
admin_server = kerberos.gnu.org
}
1TS.ORG = {
kdc = kerberos.1ts.org
admin_server = kerberos.1ts.org
}
GRATUITOUS.ORG = {
kdc = kerberos.gratuitous.org
admin_server = kerberos.gratuitous.org
}
DOOMCOM.ORG = {
kdc = kerberos.doomcom.org
admin_server = kerberos.doomcom.org
}
ANDREW.CMU.EDU = {
kdc = kerberos.andrew.cmu.edu
kdc = kerberos2.andrew.cmu.edu
kdc = kerberos3.andrew.cmu.edu
admin_server = kerberos.andrew.cmu.edu
default_domain = andrew.cmu.edu
}
CS.CMU.EDU = {
kdc = kerberos.cs.cmu.edu
kdc = kerberos-2.srv.cs.cmu.edu
admin_server = kerberos.cs.cmu.edu
}
DEMENTIA.ORG = {
kdc = kerberos.dementix.org
kdc = kerberos2.dementix.org
admin_server = kerberos.dementix.org
}
stanford.edu = {
kdc = krb5auth1.stanford.edu
kdc = krb5auth2.stanford.edu
kdc = krb5auth3.stanford.edu
master_kdc = krb5auth1.stanford.edu
admin_server = krb5-admin.stanford.edu
default_domain = stanford.edu
}
UTORONTO.CA = {
kdc = kerberos1.utoronto.ca
kdc = kerberos2.utoronto.ca
kdc = kerberos3.utoronto.ca
admin_server = kerberos1.utoronto.ca
default_domain = utoronto.ca
}
?
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
?
[login]
krb4_convert = true
krb4_get_tickets = false
?
-----------
?
Checking file: /etc/nsswitch.conf
?
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed,
try:
# `info libc "Name Service Switch"' for information about this
file.
?
passwd: compat winbind
group: compat winbind
shadow: compat
gshadow: files
?
hosts: files myhostname dns
networks: files
?
protocols: db files
services: db files
ethers: db files
rpc: db files
?
netgroup: nis
?
-----------
?
Checking file: /etc/samba/smb.conf
?
# Global parameters
[global]
workgroup = HEADOFFICE
realm = HEADOFFICE.EXAMPLE.COM
netbios name = SERVER1
server role = active directory domain controller
dns forwarder = 87.249.16.250
idmap_ldb:use rfc2307 = yes
interfaces = eth0
bind interfaces only = yes
hosts allow = 127.0.0.1 172.16.0.0/24 10.8.0.0/24
hosts deny = 0.0.0.0/0
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
log level = 3 passdb:5 auth:5
# log level = 4
?
?
[netlogon]
path = /var/lib/samba/sysvol/headoffice.example.com/scripts
read only = No
?
[sysvol]
path = /var/lib/samba/sysvol
read only = No
?
?
-----------
?
BIND_DLZ not detected in smb.conf
?
-----------
?
Installed packages:
ii acl 2.2.52-2 amd64 Access control list utilities
ii attr 1:2.4.47-2 amd64 Utilities for manipulating filesystem extended
attributes
ii krb5-config 2.3 all Configuration files for Kerberos Version 5
ii krb5-locales 1.12.1+dfsg-19+deb8u2 all Internationalization support for MIT
Kerberos
ii krb5-user 1.12.1+dfsg-19+deb8u5 amd64 Basic programs to authenticate using
MIT Kerberos
ii libacl1:amd64 2.2.52-2 amd64 Access control list shared library
ii libattr1:amd64 1:2.4.47-2 amd64 Extended attribute shared library
ii libgssapi-krb5-2:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime
libraries - krb5 GSS-API Mechanism
ii libkrb5-26-heimdal:amd64 1.6~rc2+dfsg-9+deb8u1 amd64 Heimdal Kerberos -
libraries
ii libkrb5-3:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime libraries
ii libkrb5support0:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime
libraries - Support library
ii libnss-winbind:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba nameservice
integration plugins
ii libpam-winbind:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Windows domain
authentication integration plugin
ii libsmbclient:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 shared library for
communication with SMB/CIFS servers
ii libwbclient0:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba winbind client library
ii oracle-java8-jdk 8u101 amd64 Java? Platform, Standard Edition 8 Development
Kit
ii python-samba 2:4.2.14+dfsg-0+deb8u13 amd64 Python bindings for Samba
ii samba 2:4.2.14+dfsg-0+deb8u13 amd64 SMB/CIFS file, print, and login server
for Unix
ii samba-common 2:4.2.14+dfsg-0+deb8u13 all common files used by both the Samba
server and client
ii samba-common-bin 2:4.2.14+dfsg-0+deb8u13 amd64 Samba common files used by
both the server and the client
ii samba-dsdb-modules 2:4.2.14+dfsg-0+deb8u13 amd64 Samba Directory Services
Database
ii samba-libs:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba core libraries
ii samba-vfs-modules 2:4.2.14+dfsg-0+deb8u13 amd64 Samba Virtual FileSystem
plugins
ii spice-client-glib-usb-acl-helper 0.25-1+b1 amd64 Spice client glib usb acl
helper
ii winbind 2:4.2.14+dfsg-0+deb8u13 amd64 service to resolve user and group
information from Windows NT servers
?
-----------
?
?
?
?
--
Best regards, Alex Orlov