samba - Oct 2021 - Unable to join domain

Maybe I'm confused about the word server.  What constitutes a server that
makes it impossible for it to join a domain?  fsdc01 was just a samba file
server but if I remove the samba configuration, can't I then join it to the
domain (after following the wiki steps of adding a member)?

What is throwing me off is that it seems to require a subdomain or at
least, that is how the wiki configuration is designed.  This has to be done
with a subdomain?  I can't skip the subdomain the subdomain?  For better
clarity I could start over and have my subdomain as internal if I need one
so it would be internal.test-server.lan and then have all the hostnames but
I was hoping to have root domain and hostnames only and I can see now
that due to my naming schema, I confused everyone.  My bad.  I did choose
dc01 because I figured everything would attach to it unless I built a dc02
which I thought about doing further down the line just for understanding
how things work.

I'll start over with my Debian vm being DC01.INTERNAL.TEST-SERVER.LAN
(hostname dc01 and then my Fedora file server can be
FS01.INTERNAL.TEST-SERVER.LAN.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In all things, Be Intentional.


On Mon, Oct 11, 2021 at 3:29 PM Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Mon, 2021-10-11 at 15:01 -0400, Rob Campbell wrote:
> > The Debian DC DC01 seems to be just fine.  I have no issues with
> > that.
> >
> > FSDC02 is Fedora Server which I was told could be a member or a
> > standalone server.  I want to use it as a member.  It seems that I am
> > able to join it as a member but the DNS is not registering.  FSDC02
> > was test-server.lan before I was told that I needed to use Debian as
> > the first DC.  So I changed test-server.lan to FSDC02 and removed the
> > samba configuration I had successfully running on it as a standalone
> > file server, created a Debian vm, changed test-server.lan to fsdc02
> > and set Debian to DC01.test-server.lan.  I then went through the wiki
> > for Samba as an AD DC.  Once that was working as expected I started
> > working on setting fsdc02 up as a member.  I can rename it to FS01
> > for clarity but last time I had a problem removing but I can try it
> > again.
>
> A standalone server is not and never can be a member of a domain.
>
> When you set up a domain, you need to choose a dns domain and then any
> domain members (DC's, RODC's, Unix domain members and Windows
PC's)
> need to use this dns domain. You then use different hostnames to
> identify each computer. Lets say your dns domain is
> 'samdom.example.com', you would then have FQDN's in the
following
> format:
> dc1.samdom.example.com
> rodc1.samdom.example.com
> unix.samdom.example.com
> windows.samdom.example.com
>
> They all use 'samdom.example.com' for the dns domain and
> 'SAMDOM.EXAMPLE.COM' for the realm.
> This dns information is all stored in the AD database and can be
> read/written by each DC, this is why AD dns is known as multi-master.
>
> As I said previously, using the fedora packages for a DC is still
> considered experimental, but they can be used for a Unix domain member
> because the KDC on a Debian DC will be using Heimdal.
>
> From what I seen in the OP's posts, I think he needs to check dns, do
> all his machines use the same dns domain name ? can each machine ping
> any other machine by short hostname and fqdn ?
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Mon, 2021-10-11 at 18:01 -0400, Rob Campbell wrote:
> Maybe I'm confused about the word server.  What constitutes a server
> that makes it impossible for it to join a domain? 
The word 'server' is very broad reaching, but when you combine it with
the word 'standalone', you get a 'standalone server' and this
type of
Samba server contains its own user & group database and requires Samba
users and the same users in /etc/passwd. A standalone server is akin to
Windows Home edition and cannot join a domain.
>  fsdc01 was just a samba file server but if I remove the samba
> configuration, can't I then join it to the domain (after following
> the wiki steps of adding a member)?
You should be able to join any Unix computer to an AD domain, provided
it is configured correctly.
 
> 
> What is throwing me off is that it seems to require a subdomain or at
> least, that is how the wiki configuration is designed.  This has to
> be done with a subdomain?  I can't skip the subdomain the subdomain? 
If you have a registered domain, then you can use that, but best
practise is to a subdomain of your registered domain (This isn't just a
Samba best practice, it is also a Microsoft best practice).
> For better clarity I could start over and have my subdomain as
> internal if I need one so it would be internal.test-server.lan and
> then have all the hostnames but I was hoping to have root domain and
> hostnames only and I can see now that due to my naming schema, I
> confused everyone.
You can use just the domain if you wish, but best practice is to use a
subdomain.
>   My bad.
No, just lack of knowledge and we are all guilty of that from time to
time.
>   I did choose dc01 because I figured everything would attach to it
> unless I built a dc02 which I thought about doing further down the
> line just for understanding how things work.
It is another best practice to run multiple AD DC's
> 
> I'll start over with my Debian vm being DC01.INTERNAL.TEST-SERVER.LAN 
> (hostname dc01 and then my Fedora file server can be
> FS01.INTERNAL.TEST-SERVER.LAN.
That sounds a better idea.

Rowland