[Samba] Member Server Setup Assistance

James
2015-01-02T16:57:16Z

Rowland,

     I've gotten a bit further. It appears my use of '.local' is
causing
the issue from what I've researched. I  ran '|/etc/init.d/avahi-daemon
stop'. |This allowed me to successfully join the domain.

Enter administrator at DOMAIN.LOCAL's password:
Using short domain name -- DOMAIN
Joined 'PFMEMBER1' to dns domain 'domain.local'
DNS Update for pfmember1.local failed: ERROR_DNS_UPDATE_FAILED
DNS update failed: NT_STATUS_UNSUCCESSFUL
||
On 1/2/2015 8:55 AM, Rowland Penny wrote:
> On 02/01/15 13:41, James wrote:
>> Hi Rowland,
>>
>>     If you don't mind I like to post my member server configuration
>> as I attempt again. This is how my member server(Ubuntu 12.04) is
>> configured after fresh install and prior to Samba build. Anything
I'm
>> missing that could cause my issue as I proceed? I assume no other
>> prerequisites must be done on the other DC's either? Thanks.
>>
>> /*# From Wiki for DC build*/
>> apt-get install build-essential libacl1-dev libattr1-dev libblkid-dev
>> libgnutls-dev libreadline-dev python-dev libpam0g-dev
>> python-dnspython gdb pkg-config libpopt-dev libldap2-dev dnsutils
>> libbsd-dev attr krb5-user docbook-xsl libcups2-dev acl
>>
>>
>> /*# Fstab file*/
>> ext4    errors=remount-ro,user_xattr,acl,barrier=1 1       1
>>
>>
>> */# Hosts File/*
>> 127.0.0.1       localhost
>> 172.16.232.25   pfmember1.domain.local    pfmember1
>>
>> # The following lines are desirable for IPv6 capable hosts
>> ::1     ip6-localhost ip6-loopback
>> fe00::0 ip6-localnet
>> ff00::0 ip6-mcastprefix
>> ff02::1 ip6-allnodes
>> ff02::2 ip6-allrouters
>>
>>
>> */# Hostname/* */File/*
>> pfmember1.domain.local
>
> if you are referring to /etc/hostname, then it should just contain
> 'pfmember1'.
>
> Also, are you fixed on using Ubuntu 12.04, if you were to use Debian
> Wheezy and backports, you wouldn't have to compile samba4.
>
> Rowland
>
>>
>> */#/network/interfaces/*
>> # This file describes the network interfaces available on your system
>> # and how to activate them. For more information, see interfaces(5).
>>
>> # The loopback network interface
>> auto lo
>> iface lo inet loopback
>>
>> # The primary network interface
>> auto eth0
>> iface eth0 inet static
>>         address 172.16.232.25
>>         netmask 255.255.255.0
>>         gateway 172.16.232.201
>>         network 172.16.232.0
>>         broadcast 172.16.232.255
>>         dns-search domain.local
>>         dns-nameservers 172.16.232.29
>>
>>
>>
>>
>>
>> On 1/1/2015 4:34 AM, Rowland Penny wrote:
>>> On 01/01/15 00:07, James wrote:
>>>> Hi Rowland,
>>>>
>>>>     I forgot to tell you the results were from my Domain
Controller
>>>> and not the member server. Member server returned something to
the
>>>> effect of 'user not found'. I am only starting the 3
>>>> services(smbd,nmbd and windbindd) listed in the wiki. Should I
be
>>>> starting Samba with command line switches to start as a member
>>>> server? Is that even possible?
>>>
>>> Hi, there are two ways of running samba4, the classic or original
>>> way that samba3 was used, or as an AD DC. If you run samba4 in the
>>> classic way, you need to start the smbd & nmbd deamons and
>>> optionally the winbind daemon. If you use samba4 as an AD DC, then
>>> you only start the samba daemon, this will start any other required
>>> deamons, you only start the samba daemon on an AD DC.
>>>
>>> As you are trying to set up a member server, you must carry out the
>>> tests on the member server.
>>>
>>> Rowland
>>>
>>>>
>>>>     Thanks for you smb.conf. I will attempt again using your
>>>> smb.conf as a template and try again.
>>>>
>>>> On 12/31/2014 2:20 PM, Rowland Penny wrote:
>>>>> On 31/12/14 19:07, James wrote:
>>>>>> Rowland,
>>>>>>
>>>>>>     I decided to start over with a fresh install and
attempted
>>>>>> again. Only change I made was to start my mappings at
10000. I
>>>>>> gave 'Domain Users' group gid 10000 and
'tuser' has uid 10001.
>>>>>> Still didn't work btw.
>>>>>>
>>>>>>  dn: CN=Test User,CN=Users,DC=domain,DC=local
>>>>>> objectClass: top
>>>>>> objectClass: person
>>>>>> objectClass: organizationalPerson
>>>>>> objectClass: user
>>>>>> cn: Test User
>>>>>> sn: User
>>>>>> givenName: Test
>>>>>> instanceType: 4
>>>>>> whenCreated: 20141231172021.0Z
>>>>>> displayName: Test User
>>>>>> uSNCreated: 477557
>>>>>> name: Test User
>>>>>> objectGUID: 90f95763-fe52-42b9-af86-8a84a4d5dd78
>>>>>> userAccountControl: 66048
>>>>>> codePage: 0
>>>>>> countryCode: 0
>>>>>> pwdLastSet: 130645200220000000
>>>>>> primaryGroupID: 513
>>>>>> objectSid:
S-1-5-21-940051827-2291820289-3341758437-3126
>>>>>> accountExpires: 9223372036854775807
>>>>>> sAMAccountName: tuser
>>>>>> sAMAccountType: 805306368
>>>>>> userPrincipalName: tuser at domain.local
>>>>>> objectCategory:
>>>>>> CN=Person,CN=Schema,CN=Configuration,DC=domain,DC=local
>>>>>> unixUserPassword: ABCD!efgh12345$67890
>>>>>> uid: tuser
>>>>>> msSFU30Name: tuser
>>>>>> msSFU30NisDomain: domain
>>>>>> uidNumber: 10001
>>>>>> loginShell: /bin/sh
>>>>>> unixHomeDirectory: /home/tuser
>>>>>> gidNumber: 10000
>>>>>> whenChanged: 20141231185807.0Z
>>>>>> uSNChanged: 477620
>>>>>> distinguishedName: CN=Test
User,CN=Users,DC=domain,DC=local
>>>>>>
>>>>>>
>>>>>> On 12/31/2014 1:50 PM, Rowland Penny wrote:
>>>>>>> On 31/12/14 18:28, James wrote:
>>>>>>>> Hi Rowland,
>>>>>>>>
>>>>>>>>     passwd:         compat winbind
>>>>>>>>     group:            compat winbind
>>>>>>>>
>>>>>>>> 'getent passwd tuser' results in a
blank terminal line.
>>>>>>>>
>>>>>>>>
>>>>>>>> On 12/31/2014 1:12 PM, Rowland Penny wrote:
>>>>>>>>> On 31/12/14 17:55, James wrote:
>>>>>>>>>> Hi Rowland,
>>>>>>>>>>
>>>>>>>>>>     I did. Unfortunately something is
still amiss. I do
>>>>>>>>>> receive a response from 'getent
group domain
>>>>>>>>>> users'(users:x:100).
>>>>>>>>>>
>>>>>>>>>> On 12/31/2014 12:26 PM, Rowland Penny
wrote:
>>>>>>>>>>> On 31/12/14 17:23, James wrote:
>>>>>>>>>>>> Rowland,
>>>>>>>>>>>>
>>>>>>>>>>>>     I set a user with a uid and
domain users group with a
>>>>>>>>>>>> gid but I'm still unable to
view them using 'id'. I do
>>>>>>>>>>>> notice a few strange
observations. If I go to another user
>>>>>>>>>>>> to attempt to assign a uid. I
get the default value of
>>>>>>>>>>>> 10000. I would expect 2001
given I set the first user with
>>>>>>>>>>>> uid 2000. Groups however appear
to increment.
>>>>>>>>>>>>
>>>>>>>>>>>> On 12/31/2014 10:52 AM, Rowland
Penny wrote:
>>>>>>>>>>>>> On 31/12/14 15:42, James
wrote:
>>>>>>>>>>>>>> Hello Stefan,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>     I learned the hard
way about .local. I understand
>>>>>>>>>>>>>> going forward.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I do have an issue with
the member server. Following
>>>>>>>>>>>>>> along with the wiki I
get stuck at 'Testing the Winbind
>>>>>>>>>>>>>> user/group
mapping'. Wbinfo works as expected but not
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> #*id DomainUser*
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> #*getent passwd*
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> #*getent group*
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> #*chown
DomainUser:DomainGroup file*
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> #*chgrp DomainGroup
file*
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> etc.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I receive 'id:
sambauser: No such user'. It will only
>>>>>>>>>>>>>> retrieve local machine
users. Let me preface by saying
>>>>>>>>>>>>>> this is a Ubuntu 12.04
server with Samba 4.1.14. Thanks.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> On 12/31/2014 10:00 AM,
Stefan Kania wrote:
>>>>>>>>>>>>>>> -----BEGIN PGP
SIGNED MESSAGE-----
>>>>>>>>>>>>>>> Hash: SHA1
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Hello James,
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Am 31.12.2014 um
15:48 schrieb James:> Hello,
>>>>>>>>>>>>>>>> I'm
following along with the wiki(Setup a Samba AD
>>>>>>>>>>>>>>>> Member Server)
>>>>>>>>>>>>>>>> and I have a
question after reading the 'Set up a basic
>>>>>>>>>>>>>>>> smb.conf'
>>>>>>>>>>>>>>>> section.
>>>>>>>>>>>>>>> Please show us your
smb.conf
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>   Do I need to
extend the schema in order for my member
>>>>>>>>>>>>>>> server to
>>>>>>>>>>>>>>>> successfully
join and service file shares?
>>>>>>>>>>>>>>> No, you dont have
to.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Do I need to
configure a
>>>>>>>>>>>>>>>> krb5.conf file?
Thanks.
>>>>>>>>>>>>>>> If your DC is a
samba4 DC just copy krb5.conf to your
>>>>>>>>>>>>>>> new memberserver
>>>>>>>>>>>>>>> Stefan
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> - -- Stefan Kania
>>>>>>>>>>>>>>> Landweg 13
>>>>>>>>>>>>>>> 25693 St.
Michaelisdonn
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Signieren jeder
E-Mail hilft Spam zu reduzieren.
>>>>>>>>>>>>>>> Signieren Sie ihre
>>>>>>>>>>>>>>> E-Mail. Weiter
Informationen unter http://www.gnupg.org
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Mein Schl?ssel
liegt auf
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
hkp://subkeys.pgp.net
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> -----BEGIN PGP
SIGNATURE-----
>>>>>>>>>>>>>>> Version: GnuPG v1
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
iEYEARECAAYFAlSkD3EACgkQ2JOGcNAHDTZdlwCgwsQF0g/pFp65ldcTMWDcJ1O7
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
LScAoLDzorUJNDCik4FP9dBUxKCbAbGN
>>>>>>>>>>>>>>> =SOSt
>>>>>>>>>>>>>>> -----END PGP
SIGNATURE-----
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> If you followed the wiki,
you will be using the 'ad'
>>>>>>>>>>>>> backend. For this to work,
you need to add 'uidNumber'
>>>>>>>>>>>>> attributes to your users
and a 'gidNumber' attribute to at
>>>>>>>>>>>>> least the Domain Users
group. the numbers that you add
>>>>>>>>>>>>> must be between the range
you set in your smb.conf, again
>>>>>>>>>>>>> if you followed the wiki,
this will be between 500-40000.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Rowland
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> You have restarted samba,
haven't you ?
>>>>>>>>>>> You may have to wait a short time,
or clear the cache with
>>>>>>>>>>> 'net cache flush'
>>>>>>>>>>>
>>>>>>>>>>> Rowland
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>> OK, can you post the 'passwd' &
'group' lines from /etc/nsswitch
>>>>>>>>>
>>>>>>>>> Do you get anything from 'getent passwd
<a domain user>'
>>>>>>>>>
>>>>>>>>> Rowland
>>>>>>>>>
>>>>>>>>
>>>>>>> OK, install ldb-tools if not already installed,
then run:
>>>>>>>
>>>>>>> ldbedit -e nano -H /var/lib/samba/private/sam.ldb
>>>>>>> sAMAccountName=tuser
>>>>>>>
>>>>>>> Post the (sanitized) result
>>>>>>>
>>>>>>> Rowland
>>>>>>>
>>>>>>
>>>>>
>>>>> OK, you added that user with ADUC (RSAT) and as such you
are using
>>>>> the std windows start number 10000, which is the way I run
samba.
>>>>> Here is my smb.conf from the laptop I am writing this on:
>>>>>
>>>>> [global]
>>>>>         workgroup = EXAMPLE
>>>>>         security = ADS
>>>>>         realm = EXAMPLE.COM
>>>>>         dedicated keytab file = /etc/krb5.keytab
>>>>>         kerberos method = secrets and keytab
>>>>>         server string = Samba 4 Client %h
>>>>>         winbind enum users = yes
>>>>>         winbind enum groups = yes
>>>>>         winbind use default domain = yes
>>>>>         winbind expand groups = 4
>>>>>         winbind nss info = rfc2307
>>>>>         winbind refresh tickets = Yes
>>>>>         winbind normalize names = Yes
>>>>>         idmap config * : backend = tdb
>>>>>         idmap config * : range = 2000-9999
>>>>>         idmap config EXAMPLE : backend  = ad
>>>>>         idmap config EXAMPLE : range = 10000-999999
>>>>>         idmap config EXAMPLE : schema_mode = rfc2307
>>>>>         printcap name = cups
>>>>>         cups options = raw
>>>>>         usershare allow guests = yes
>>>>>         domain master = no
>>>>>         local master = no
>>>>>         preferred master = no
>>>>>         os level = 20
>>>>>         map to guest = bad user
>>>>>         vfs objects = acl_xattr
>>>>>         map acl inherit = Yes
>>>>>         store dos attributes = Yes
>>>>>
>>>>> Compare it with yours, I can assure you it works.
>>>>>
>>>>> Rowland
>>>>>
>>>>
>>>
>>
>> --
>> -James
>

--
-James