samba - Mar 2015 - Joining a domain

Hello,

Please consider a scenario in which samba is sharing files and users
provide their Active Directory usernames and passwords to log into to
samba.

1. Must "net join" be used?

2. Under what circumstances will samba (and family) require an
explicit "net join"?

3. What technically is happening when samba/computer "joins" the
domain?
3a. Is a file added to the hard drive?
3b. Is the join "persistent" across reboots?

4. How can I tell is a samba server has been "joined" to the domain?

Chapter 10 of the Oreilly 3rd edition book describes domain
membership, but it leaves me wanting to understand more.  For example,
"net join" has never worked well (generally spews some kind of
complaint) but things still work.  But I'm not even sure I have to
issue "net join" I just sort of do it in a panic of trying everything
to get the darn thing working.

Thank you,

Chris

Hello Chris,

Am 10.03.2015 um 18:26 schrieb Chris Stankevitz:
> Please consider a scenario in which samba is sharing files and users
> provide their Active Directory usernames and passwords to log into to
> samba.
> 
> 1. Must "net join" be used?
If you want to join the domain, yes.


> 2. Under what circumstances will samba (and family) require an
> explicit "net join"?
See 1.
What do you mean with "and family"?


> 3. What technically is happening when samba/computer "joins" the
domain?
There are thousands of sites describing, what happens when a computer
joins a domain.

In short: An account is created in the domain, that the computer uses to
authenticate against the domain to proof to be a member of the domain.
The computer automatically changes the machine accounts password
(default = every 30 days).


> 3a. Is a file added to the hard drive?
It's written into secrets.tdb for domain members. For DCs more happen in
the background, when joining the domain.


> 3b. Is the join "persistent" across reboots?
Yes. Otherwise you need some extra admins, re-joining all computers
every morning before users can start to work. ;-)


> 4. How can I tell is a samba server has been "joined" to the
domain?
E. g.
# wbinfo -t
can be use to check winbinds connection to a trusted DC.



> Chapter 10 of the Oreilly 3rd edition book describes domain
> membership, but it leaves me wanting to understand more.  For example,
> "net join" has never worked well (generally spews some kind of
> complaint) but things still work.
Never had problems to join a Samba host yet. Examples?


Regards,
Marc

Marc,

Thank you for taking the time to give me some complete answers.  When
writing to lists like these I often struggle with how much or little
detail to give.... and I am eager to add more detail where you have
explicitly asked.

On Tue, Mar 10, 2015 at 2:13 PM, Marc Muehlfeld <mmuehlfeld at samba.org>
wrote:
>> 1. Must "net join" be used?
>
> If you want to join the domain, yes.
I'm sorry for being so daft, but I am asking you if I need/want to
join the domain.  I do not know the answer.  Reminder of my scenario:
samba is sharing files and users provide their Active Directory
usernames and passwords to log into to samba.  I will call this
"Scenario A".
>> 2. Under what circumstances will samba (and family) require an
>> explicit "net join"?
>
> See 1.
> What do you mean with "and family"?
By "and family" I was conceding that I do not know what software it is
that is requires domain join.  Maybe it's samba or windbindd or
something else.  I can see already your response "no software requires
that you join a domain -- that is a personal decision up to a human
and not up to a computer." Which brings us back to my original
question number 1 above.
>> 3a. Is a file added to the hard drive?
>
> It's written into secrets.tdb for domain members. For DCs more happen
in
> the background, when joining the domain.
Thank you this is the secret sauce I was not able to devine from
reading Oreilly Chapter 10.  Is there a tool I can use to query the
secrets.tdb file to see what is the current "state" respect to domain
membership?  Perhaps it is "wbinfo -t".

I ask this question because I often find myself sitting at a Samba
server that is failing to do "Scenario A" and I wonder "Well, has
this
computer been joined to the domain?"  (Not that I even know whether or
not the question is important).
>> Chapter 10 of the Oreilly 3rd edition book describes domain
>> membership, but it leaves me wanting to understand more.  For example,
>> "net join" has never worked well (generally spews some kind
of
>> complaint) but things still work.
>
> Never had problems to join a Samba host yet. Examples?
I wish I had a setup that was not working right now to dissect (and
learn from) but I do not.  However, in the past I have had:

net join -U XXXXX\\cstankevitz

The command returned what appears to be an error:

kerberos_kinit_password XXXXX\cstankevitz at XXXXX.CORP failed: Client
not found in Kerberos database
Failed to join domain: failed to connect to AD: Client not found in
Kerberos database
ADS join did not work, falling back to RPC...
Unable to find a suitable server for domain XXXXX
Unable to find a suitable server for domain XXXXX

Thank you again,

Chris