This weekend we moved our samba PDC to a new machine. Now we are
having a few issues with not being able to join new computers to the
domain and some users cannot change their passwords. People can still
login and such though. Here is a brief synopsis:
Old server was named roark IP 10.8.2.3. It housed mail, ldap, samba, and
a few other things. Was fedora 11 with samba samba-3.4.7.
New server is Centos 5.5 with 3.0.33 originally but I upgraded it to the
"samba3x" package and got a whopping 3.3.8 version. IP 10.8.3.4
Both old and new have the BDC set at 10.8.2.2
Everything worked until the move this weekend... I know.. famous last
words. ;)
This weekend we migrated all the user files to the new machine, copied
over /etc/samba/*, edited the ldap portion of smb.conf accordingly,
changed all the other servers (we have about a dozen or so home servers
for various divisions) to reflect the new IP of the new server and
updated DNS accordingly. All seemed fine as we were able to login/logout
and get to all the shares just fine. the problem came when users went to
change their passwords using the windows method (CTRL+ALT+DEL -> change
password), which previously worked. Also we are unable to join new
computers to the domain at all. Although, users on the same vlan
(10.8.3.X) as roark are able to change their passwords it seems. This is
odd since all but 3 of the users are on roark as their home server. The
other 3 are on a seperate server but are still able to change their
passwords. The error that users get when trying to change their password
or join a new pc to the domain is "Domain ADMIN not found" or
something
along those lines.
I have tried everything I can think of to get this resolved. I have made
sure the SID stayed the same on roark, rejoined the outlying servers to
the domain, reset the smbpasswd ldap password, and scoured every log
file I can find. All to no avail. I am including a few configs in hopes
that someone can help guide me into fixing this issue.
I am also considering moving the PDC back to a fedora machine (fedora 13
to be exact) so that it is more like the original machine and can get
the same branch of samba.
I hope someone out there can guide me in the correct direction to fix
this. :)
Here is the CURRENT roark smb.conf:
[root at roark ~]# cat /etc/samba/smb.conf
# Samba config file created using SWAT
# from UNKNOWN (0.0.0.0)
# Date: 2001/07/31 13:51:02
# Global parameters
[global]
netbios name = roark
workgroup = ADMIN
server string = Roark
hosts allow = 10.8. 127.
os level = 66
preferred master = Yes
domain master = Yes
local master = Yes
# oplocks = no
# level2 oplocks = no
interfaces = lo,eth0
passdb backend = ldapsam:ldap://10.8.2.3
ldap suffix = dc=mdah,dc=state,dc=ms,dc=us
ldap machine suffix = Computers
ldap user suffix = ou=People
ldap group suffix = ou=Group
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us
idmap backend = ldap:ldap://mdah.state.ms.us
map acl inherit = Yes
printer admin = root, dbrooks, smccoy, jomiles, sokolsky
#winbind enum users = yes
#winbind enum groups = yes
name resolve order = wins bcast hosts
security = user
# passwd program = /usr/bin/passwd %u
encrypt passwords = yes
update encrypted = Yes
unix password sync = no
ldap passwd sync = yes
update encrypted = yes
password server = mail
# passwd chat = *New*Password* %n\n *Re-enter*new*password* %n\n
*Password*changed*
# passwd chat = *New*UNIX*password* %n\n
*ReType*new*UNIX*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*
# add user script = /usr/sbin/useradd -g smbbox -c "Machine
Account" -d /dev/null -M -s /bin/false %U
wins support = Yes
wins proxy = yes
domain logons = Yes
logon path = \\%N\profiles\%U
logon script = scripts\%U.bat
logon drive = R:
logon home = \\roark\%U
time server = yes
printing = cups
load printers = yes
guest account = nobody
map to guest = bad user
map to guest = bad password
guest ok = yes
dns proxy = No
log file = /var/log/samba/log.%m
max log size = 500
log level = 3 vfs:2
#log level = 10
syslog = 0
hide dot files = yes
time server = yes
template shell = /bin/false
follow symlinks = yes
username map = /etc/samba/smbusers
profile acls = yes
host msdfs = yes
idmap uid = 20000-30000
idmap gid = 20000-30000
# winbind separator = +
template homedir = /home/winnt/%D/%U
template shell = /bin/bash
# winbind offline logon = false
# winbind use default domain = no
allow trusted domains = yes
unix charset = LOCALE
enable privileges = yes
printcap name = CUPS
show add printer wizard = no
# add user script = /usr/sbin/smbldap-useradd -a -m "%u"
# delete user script = /usr/sbin/smbldap-userdel "%u"
# add group script = /usr/sbin/smbldap-groupadd -p "%g"
# delete group script = /usr/sbin/smbldap-groupdel "%g"
# add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
# delete user from group script = /usr/sbin/smbldap-groupmod -x "%u"
"%g"
# set primary group script = /usr/sbin/smbldap-groupmod -g "%g"
"%u"
# add machine script = /usr/sbin/smbldap-useradd -w "%u"
posix locking = No
msdfs root = yes
ldap ssl = Off
[homes].....
Here is the BDC (archives3) config:
[root at archives3 ~]# cat /etc/samba/smb.conf
[global]
interfaces = eth0 lo
domain master = no
encrypt passwords = yes
preferred master = no
local master = no
domain logons = yes
msdfs root = yes
workgroup = ADMIN
netbios name = ARCHIVES3
server string = ARCHIVES3
printcap name = cups
load printers = yes
printing = cups
log file = /var/log/samba/log.%m
max log size = 50
log level = 4
security = user
username map = /etc/samba/smbusers
wins server = 10.8.3.4
wins support = no
name resolve order = wins bcast hosts
ldap suffix = dc=mdah,dc=state,dc=ms,dc=us
ldap machine suffix = Computers
ldap user suffix = ou=People
ldap group suffix = ou=Group
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us
idmap backend = ldap:ldap://mdah.state.ms.us
idmap uid = 20000-30000
idmap gid = 20000-30000
#winbind use default domain = yes
#winbind nested groups = yes
#winbind trusted domains only = Yes
passdb backend = ldapsam:"ldap://mail.mdah.state.ms.us
ldap://archives3.mdah.state.ms.us"
enable privileges = yes
local master = no
preferred master = no
os level = 40
posix locking = No
password server = mail
ldap ssl = Off
[homes]....
and just one of the many outlying servers:
cat /etc/samba/smb.conf
# Samba config file created using SWAT
# from 10.8.9.236 (10.8.9.236)
# Date: 2005/05/26 04:39:37
# Global parameters
[global]
workgroup = ADMIN
netbios name = ARROWHEAD
hosts allow = 10.8.
server string = HP Samba Server %v
encrypt passwords = Yes
guest account = nobody
map to guest = bad user
guest ok = yes
log file = /var/log/samba/log.%m
max log size = 5000
log level = 10
# printcap name = cups
printcap name = /etc/printcap
os level = 30
preferred master = Yes
domain master = no
local master = yes
dns proxy = No
# wins proxy = Yes
wins support = no
wins server = 10.8.3.4
printing = cups
name resolve order = wins hosts bcast
time server = yes
security = user
passwd program = /usr/bin/passwd %u
encrypt passwords = yes
update encrypted = Yes
# unix password sync = no
password server = roark
#passwd chat = *New*Password* %n\n *Re-enter*new*password*
%n\n*Password*changed*
passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*
add user script = /usr/sbin/useradd -g smbbox -c "MachineAccount" -d
/dev/null -M -s /bin/false %U
domain logons = Yes
logon path = \\%N\profiles\%U
logon script = scripts\%U.bat
logon drive = R:
logon home = \\arrowhead\%U
load printers = yes
hide dot files = yes
template shell = /bin/false
follow sym links = yes
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
winbind use default domain = no
msdfs root = yes
posix locking = No
ldap suffix = dc=mdah,dc=state,dc=ms,dc=us
ldap machine suffix = ou=Computers
ldap user suffix = ou=People
ldap group suffix = ou=Group
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us
idmap backend = ldap:ldap://mdah.state.ms.us
idmap uid = 20000 - 30000
idmap gid = 20000 - 30000
map acl inherit = Yes
template shell = /sbin/nologin
winbind use default domain = yes
winbind nested groups = yes
winbind enum groups = yes
winbind enum users = yes
ldap passwd sync = yes
passdb backend = ldapsam:ldap://mail.mdah.state.ms.us
ldap ssl = Off
socket options = IPTOS_LOWDELAY TCP_NODELAY SO_RCVBUF=65536
SO_SNDBUF=65536 SO_KEEPALIVE READ_SIZE=65536
use mmap = No
use sendfile = Yes
blocking locks = No
read raw = no
write raw = no
kernel oplocks = no
oplocks = yes
level2 oplocks = yes
[homes]
On 10/12/2010 5:02 PM, Donny Brooks wrote:> This weekend we moved our samba PDC to a new machine. Now we are > having a few issues with not being able to join new computers to the > domain and some users cannot change their passwords. People can still > login and such though. Here is a brief synopsis: > > Old server was named roark IP 10.8.2.3. It housed mail, ldap, samba, > and a few other things. Was fedora 11 with samba samba-3.4.7. > New server is Centos 5.5 with 3.0.33 originally but I upgraded it to > the "samba3x" package and got a whopping 3.3.8 version. IP 10.8.3.4 > Both old and new have the BDC set at 10.8.2.2 > > Everything worked until the move this weekend... I know.. famous last > words. ;) > > This weekend we migrated all the user files to the new machine, copied > over /etc/samba/*, edited the ldap portion of smb.conf accordingly, > changed all the other servers (we have about a dozen or so home > servers for various divisions) to reflect the new IP of the new server > and updated DNS accordingly. All seemed fine as we were able to > login/logout and get to all the shares just fine. the problem came > when users went to change their passwords using the windows method > (CTRL+ALT+DEL -> change password), which previously worked. Also we > are unable to join new computers to the domain at all. Although, users > on the same vlan (10.8.3.X) as roark are able to change their > passwords it seems. This is odd since all but 3 of the users are on > roark as their home server. The other 3 are on a seperate server but > are still able to change their passwords. The error that users get > when trying to change their password or join a new pc to the domain is > "Domain ADMIN not found" or something along those lines. > > I have tried everything I can think of to get this resolved. I have > made sure the SID stayed the same on roark, rejoined the outlying > servers to the domain, reset the smbpasswd ldap password, and scoured > every log file I can find. All to no avail. I am including a few > configs in hopes that someone can help guide me into fixing this issue. > > I am also considering moving the PDC back to a fedora machine (fedora > 13 to be exact) so that it is more like the original machine and can > get the same branch of samba. > > I hope someone out there can guide me in the correct direction to fix > this. :) > > > Here is the CURRENT roark smb.conf: > > [root at roark ~]# cat /etc/samba/smb.conf > # Samba config file created using SWAT > # from UNKNOWN (0.0.0.0) > # Date: 2001/07/31 13:51:02 > > # Global parameters > [global] > netbios name = roark > workgroup = ADMIN > server string = Roark > hosts allow = 10.8. 127. > os level = 66 > preferred master = Yes > domain master = Yes > local master = Yes > # oplocks = no > # level2 oplocks = no > interfaces = lo,eth0 > > passdb backend = ldapsam:ldap://10.8.2.3 > ldap suffix = dc=mdah,dc=state,dc=ms,dc=us > ldap machine suffix = Computers > ldap user suffix = ou=People > ldap group suffix = ou=Group > ldap idmap suffix = ou=Idmap > ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us > idmap backend = ldap:ldap://mdah.state.ms.us > map acl inherit = Yes > printer admin = root, dbrooks, smccoy, jomiles, sokolsky > > #winbind enum users = yes > #winbind enum groups = yes > name resolve order = wins bcast hosts > > security = user > # passwd program = /usr/bin/passwd %u > encrypt passwords = yes > update encrypted = Yes > unix password sync = no > ldap passwd sync = yes > update encrypted = yes > > > password server = mail > # passwd chat = *New*Password* %n\n *Re-enter*new*password* %n\n > *Password*changed* > # passwd chat = *New*UNIX*password* %n\n > *ReType*new*UNIX*password* %n\n > *passwd:*all*authentication*tokens*updated*successfully* > > # add user script = /usr/sbin/useradd -g smbbox -c "Machine > Account" -d /dev/null -M -s /bin/false %U > wins support = Yes > wins proxy = yes > domain logons = Yes > logon path = \\%N\profiles\%U > logon script = scripts\%U.bat > logon drive = R: > logon home = \\roark\%U > time server = yes > printing = cups > load printers = yes > guest account = nobody > map to guest = bad user > map to guest = bad password > guest ok = yes > dns proxy = No > > log file = /var/log/samba/log.%m > max log size = 500 > log level = 3 vfs:2 > #log level = 10 > syslog = 0 > hide dot files = yes > time server = yes > template shell = /bin/false > follow symlinks = yes > username map = /etc/samba/smbusers > profile acls = yes > host msdfs = yes > idmap uid = 20000-30000 > idmap gid = 20000-30000 > # winbind separator = + > template homedir = /home/winnt/%D/%U > template shell = /bin/bash > # winbind offline logon = false > # winbind use default domain = no > allow trusted domains = yes > unix charset = LOCALE > enable privileges = yes > printcap name = CUPS > show add printer wizard = no > # add user script = /usr/sbin/smbldap-useradd -a -m "%u" > # delete user script = /usr/sbin/smbldap-userdel "%u" > # add group script = /usr/sbin/smbldap-groupadd -p "%g" > # delete group script = /usr/sbin/smbldap-groupdel "%g" > # add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" > # delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" > "%g" > # set primary group script = /usr/sbin/smbldap-groupmod -g "%g" "%u" > # add machine script = /usr/sbin/smbldap-useradd -w "%u" > posix locking = No > msdfs root = yes > ldap ssl = Off > > [homes]..... > > > Here is the BDC (archives3) config: > > [root at archives3 ~]# cat /etc/samba/smb.conf > [global] > interfaces = eth0 lo > domain master = no > encrypt passwords = yes > preferred master = no > local master = no > domain logons = yes > msdfs root = yes > workgroup = ADMIN > netbios name = ARCHIVES3 > server string = ARCHIVES3 > printcap name = cups > load printers = yes > printing = cups > log file = /var/log/samba/log.%m > max log size = 50 > log level = 4 > security = user > username map = /etc/samba/smbusers > wins server = 10.8.3.4 > wins support = no > name resolve order = wins bcast hosts > ldap suffix = dc=mdah,dc=state,dc=ms,dc=us > ldap machine suffix = Computers > ldap user suffix = ou=People > ldap group suffix = ou=Group > ldap idmap suffix = ou=Idmap > ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us > idmap backend = ldap:ldap://mdah.state.ms.us > idmap uid = 20000-30000 > idmap gid = 20000-30000 > #winbind use default domain = yes > #winbind nested groups = yes > #winbind trusted domains only = Yes > passdb backend = ldapsam:"ldap://mail.mdah.state.ms.us > ldap://archives3.mdah.state.ms.us" > enable privileges = yes > local master = no > preferred master = no > os level = 40 > posix locking = No > password server = mail > ldap ssl = Off > > [homes].... > > > and just one of the many outlying servers: > > cat /etc/samba/smb.conf > # Samba config file created using SWAT > # from 10.8.9.236 (10.8.9.236) > # Date: 2005/05/26 04:39:37 > > # Global parameters > [global] > workgroup = ADMIN > netbios name = ARROWHEAD > hosts allow = 10.8. > server string = HP Samba Server %v > encrypt passwords = Yes > guest account = nobody > map to guest = bad user > guest ok = yes > log file = /var/log/samba/log.%m > max log size = 5000 > log level = 10 > # printcap name = cups > printcap name = /etc/printcap > os level = 30 > preferred master = Yes > domain master = no > local master = yes > dns proxy = No > # wins proxy = Yes > wins support = no > wins server = 10.8.3.4 > printing = cups > name resolve order = wins hosts bcast > time server = yes > security = user > passwd program = /usr/bin/passwd %u > encrypt passwords = yes > update encrypted = Yes > # unix password sync = no > password server = roark > #passwd chat = *New*Password* %n\n *Re-enter*new*password* > %n\n*Password*changed* > passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n > *passwd:*all*authentication*tokens*updated*successfully* > > add user script = /usr/sbin/useradd -g smbbox -c "MachineAccount" -d > /dev/null -M -s /bin/false %U > domain logons = Yes > logon path = \\%N\profiles\%U > logon script = scripts\%U.bat > logon drive = R: > logon home = \\arrowhead\%U > load printers = yes > hide dot files = yes > template shell = /bin/false > follow sym links = yes > > idmap uid = 16777216-33554431 > idmap gid = 16777216-33554431 > winbind use default domain = no > msdfs root = yes > posix locking = No > > ldap suffix = dc=mdah,dc=state,dc=ms,dc=us > ldap machine suffix = ou=Computers > ldap user suffix = ou=People > ldap group suffix = ou=Group > ldap idmap suffix = ou=Idmap > ldap admin dn = cn=Manager,dc=mdah,dc=state,dc=ms,dc=us > idmap backend = ldap:ldap://mdah.state.ms.us > idmap uid = 20000 - 30000 > idmap gid = 20000 - 30000 > map acl inherit = Yes > template shell = /sbin/nologin > winbind use default domain = yes > winbind nested groups = yes > winbind enum groups = yes > winbind enum users = yes > ldap passwd sync = yes > passdb backend = ldapsam:ldap://mail.mdah.state.ms.us > ldap ssl = Off > > socket options = IPTOS_LOWDELAY TCP_NODELAY SO_RCVBUF=65536 > SO_SNDBUF=65536 SO_KEEPALIVE READ_SIZE=65536 > > use mmap = No > use sendfile = Yes > blocking locks = No > read raw = no > write raw = no > > kernel oplocks = no > oplocks = yes > level2 oplocks = yes > > [homes]And this is odd, I bumped the logging level to 10 and did some digging. I am getting this on ALL the machines. INCLUDING the PDC: ADMIN(1) current master browser = UNKNOWN I have googled for that error but to no avail. Seems others have asked it but no one answered.