Hi,
I am busy trying to get another 2003 server setup and working so that we
have backup servers when authenticating to AD. I believe the way we have to
do it is to not specify a server when joining the domain, but rather just
connect to the domain. Here is what I did.
I installed a standard 2003 server, and then installed a second one, making
it another controller in the domain. So that seems fine, and I can join each
one separately if I specify the server to connect to. On a side note, I
couldn't join the domain from my machines without using Kerberos for some
reason, I don't even remember telling the AD domain that Kerberos must be
used. Anyway, if I then remove the server name to connect to, I can then
(about 80%) of the time, join a server. Here is the confusing part though,
when I join the domain, it picks a random controller and joins to that one,
no specific one. What I need to be able todo is to join one of them, and
when that one fails, move over to another one. I have a suspicion that I
would need to re-issue the Kerberos ticket when moving servers, since I
assume they would have different tickets. Just to jump back to my 2003
configuration, the first domain controller I installed was a default install
using the 2003 mode (not 2000 native), with no other configuration changes.
Below is how I connect to the domain etc.
This is my Kerberos file
[root@server] ~ # cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5lib.log
[libdefaults]
default_realm = DEADMIND.LOCAL
[realms]
DEADMIND.LOCAL = {
kdc = deadmind.deadmind.local
default_domain = deadmind.local
}
[domain realm]
.deadmind.local = DEADMIND.LOCAL
deadmind.local = DEADMIND.LOCAL
[root@server] ~ #
This is my smb.conf file:
[root@server] ~ # cat /usr/local/etc/smb.conf
[global]
winbind separator=+
winbind cache time=10
workgroup=MASTERMIND
realm=deadmind.local
security=ads
winbind uid=10000-20000
winbind gid=10000-20000
winbind use default domain=yes
client ntlmv2 auth=yes
[root@server] ~ #
This is how I join etc:
[root@server] ~ # net ads join -w MASTERMIND -U Administrator%passwordhere
[2006/01/31 07:54:50, 0] libads/ldap.c:ads_add_machine_acct(1368)
ads_add_machine_acct: Host account for server already exists - modifying
old account
Using short domain name -- MASTERMIND
Joined 'SERVER' to realm 'DEADMIND.LOCAL'
[root@server] ~ #
I then run winbindd and nmbd, and I can lookup users using wbinfo -u etc.
Once that is working and I unplug the one im connected to (which I don't
want to have to guess which one it is), I then cant lookup users and it
doesn't switch to the other server.
Am I doing something wrong?
Thanks,
Ian