samba - Mar 2015 - samba 4.1.17 on raspberry pi as ad dc - internal dns problems

Hey Peter,

many thanks for your reply.

---
regarding .local domains
I know this is regarded by some as bad form, is actively being 
discouraged by the samba wiki and can cause problems with 
bonjour/zerobla configuration.

I can say for certain that no apple devices will ever come anywhere near 
that network and the other drawbacks of .local like getting signed 
certs... should never be an issue in this case.

I am hesitant to use .net (the domain I own) in fear of having dns 
issues. i do not control the NS for the internet accesible .net domain 
either.

In the end, unless .local will not cause problems like software X will 
not work with .local I should be fine.

---

DNS seems fixed

I was further looking around and studying /var/log/syslog, looking for 
hints when I saw some signs of slapd causing taking ports and causing 
samba to throw errors (cant bind to port)

I removed slapd and rebooted:
- DNS works for internet domains
- host -t SRV _ldap._tcp.my-domain.local --> looking good
- samba_dnsupdate --verbose --> looking good
- smbclient -L localhost -U% --> showing shares

---

Kerberos still on the fritz

kinit administrator at MY-DOMAIN.LOCAL --> kinit: Cannot contact any KDC 
for realm 'MY-DOMAIN.LOCAL' while getting initial credentials
klist -e --> klist: No credentials cache found (ticket cache 
FILE:/tmp/krb5cc_0)

--- /usr/local/samba/etc/smb.conf

# Global parameters
[global]
	workgroup = MY-DOMAIN
	realm = MY-DOMAIN.LOCAL
	netbios name = ADSERVER
	server role = active directory domain controller
	dns forwarder = 192.168.7.1
	idmap_ldb:use rfc2307 = yes

[netlogon]
	path = /usr/local/samba/var/locks/sysvol/fam-busch.local/scripts
	read only = No

[sysvol]
	path = /usr/local/samba/var/locks/sysvol
	read only = No


--- /etc/krb5.conf

[libdefaults]
	default_realm = MY-DOMAIN.LOCAL
	dns_lookup_realm = false
	dns_lookup_kdc = true


--- nsswitch ???

whats that? where? find / -iname "nsswitch" shows 3 directories in my
samba4.1.17 source directory

---

checking daemon.log now and google abit about krb5.

If anything strikes you as odd and/or you have ideas to try, I'll look 
forward to hearing about it.

Thanks
M.

On 12/03/15 15:43, Matthias Busch wrote:
> Hey Peter,
>
> many thanks for your reply.
>
> ---
> regarding .local domains
> I know this is regarded by some as bad form, is actively being 
> discouraged by the samba wiki and can cause problems with 
> bonjour/zerobla configuration.
>
> I can say for certain that no apple devices will ever come anywhere 
> near that network and the other drawbacks of .local like getting 
> signed certs... should never be an issue in this case.
>
> I am hesitant to use .net (the domain I own) in fear of having dns 
> issues. i do not control the NS for the internet accesible .net domain 
> either.
>
> In the end, unless .local will not cause problems like software X will 
> not work with .local I should be fine.
>
> ---
>
> DNS seems fixed
>
> I was further looking around and studying /var/log/syslog, looking for 
> hints when I saw some signs of slapd causing taking ports and causing 
> samba to throw errors (cant bind to port)
>
> I removed slapd and rebooted:
> - DNS works for internet domains
> - host -t SRV _ldap._tcp.my-domain.local --> looking good
> - samba_dnsupdate --verbose --> looking good
> - smbclient -L localhost -U% --> showing shares
>
> ---
>
> Kerberos still on the fritz
>
> kinit administrator at MY-DOMAIN.LOCAL --> kinit: Cannot contact any KDC
> for realm 'MY-DOMAIN.LOCAL' while getting initial credentials
> klist -e --> klist: No credentials cache found (ticket cache 
> FILE:/tmp/krb5cc_0)
>
> --- /usr/local/samba/etc/smb.conf
>
> # Global parameters
> [global]
>     workgroup = MY-DOMAIN
>     realm = MY-DOMAIN.LOCAL
>     netbios name = ADSERVER
>     server role = active directory domain controller
>     dns forwarder = 192.168.7.1
>     idmap_ldb:use rfc2307 = yes
>
> [netlogon]
>     path = /usr/local/samba/var/locks/sysvol/fam-busch.local/scripts
>     read only = No
>
> [sysvol]
>     path = /usr/local/samba/var/locks/sysvol
>     read only = No
>
>
> --- /etc/krb5.conf
>
> [libdefaults]
>     default_realm = MY-DOMAIN.LOCAL
>     dns_lookup_realm = false
>     dns_lookup_kdc = true
>
>
> --- nsswitch ???
>
> whats that? where? find / -iname "nsswitch" shows 3 directories
in my
> samba4.1.17 source directory
>
> ---
>
> checking daemon.log now and google abit about krb5.
>
> If anything strikes you as odd and/or you have ideas to try, I'll look 
> forward to hearing about it.
>
> Thanks
> M.
Hi, please don't use .local, you say that no apple devices will come 
near, but what about an iphone ? and what about avahi ?

When you ran configure, you might as well just run it like this: ./configure

All the rest are defaults and you do not really need debug.

You only need to alter /etc/nsswitch.conf (yes that's the one) if you 
want/need your users to log into the DC.

Rowland

Matthias Busch schrieb am 12.03.2015 16:43:
> I am hesitant to use .net (the domain I own) in fear of having dns 
> issues. i do not control the NS for the internet accesible .net domain 
> either.
At least w.r.t. the Bind backend this fear is not necessary. It is indeed 
exactly what I do. The AD-DNS is only authoritative to
"domain.samdom.com",
not to "samdom.com". There is only one little trick necessary if You
got
a slave nameserver, which is tied to Your AD-DC server. 

# forward lookup
zone "domain.samdom.com" {
        type slave;
        masters { 192.168.1.1;
                  192.168.1.2; };
        file "/etc/bind/namedb/bak.domain.samdom.com";
        forwarders{};
};

# reverse lookup
zone "1.168.192.in-addr.arpa" {
        type slave;
        masters { 192.168.1.1;
                  192.168.1.2; };
        file "/etc/bind/namedb/bak.192.168.1";
        forwarders{};
};

Note the line "forwarders{}", which will ensure, that the local DNS
server
doesn't ask the public DNS, which is authoritative for the public 
"samdom.com". You would then get the IP of "samdom.com" when
looking up
a local host. 

But I agree, that this is a bit of perfectionsm. One can do things simpler. 
On the other hand: one of my two DCs was down for a week (the one 70km away 
in the "weekend"-appartment), but the whole network worked flawlessly.
These
Arm based appliances are definitely less reliable than ordinary PC H/W. I 
use slave DNS servers on my file servers, which keep at least DNS working 
whatever the Raspi or the Cubieboard do (better: don't do...).

Rowland Penny schrieb am 12.03.2015 17:23:
> All the rest are defaults and you do not really need debug.
Hm. It doesn't work at the moment. So he might be forced to debug. :-(

>Hi, please don't use .local, you say that no apple devices will come
>near, but what about an iphone ? and what about avahi ?
>When you ran configure, you might as well just run it like this: ./configure
>All the rest are defaults and you do not really need debug.
>You only need to alter /etc/nsswitch.conf (yes that's the one) if you
>want/need your users to log into the DC.
>Rowland
Peter convinced me to not use .local from now on.

But the .local should not be able to cause my problems?

And yeah, for now, this is for testing/learning purposes, if it works
(good/reliable enough) I plan to use it for my home network, maybe add radius
for wifi
And I can guarantee that no apple devices are coming near that network. and if
some guest would bring one, he can survive without bonjour and zeroconf
Avahi is running, ive seen that. wouldnt miss it if it were gone either.

When configure, I did not know which were the default switches. and since I had
trouble in the first place I enabled debug

my nsswitch.conf I posted down below. I have no clue how to interpret the
content...

---
>At least w.r.t. the Bind backend this fear is not necessary. It is indeed
>exactly what I do. The AD-DNS is only authoritative to
"domain.samdom.com",
>not to "samdom.com". There is only one little trick necessary if
You got
>a slave nameserver, which is tied to Your AD-DC server.
>Note the line "forwarders{}", which will ensure, that the local
DNS server
>doesn't ask the public DNS, which is authoritative for the public
>"samdom.com". You would then get the IP of "samdom.com"
when looking up
>a local host.
>But I agree, that this is a bit of perfectionsm. One can do things simpler.
>On the other hand: one of my two DCs was down for a week (the one 70km away
>in the "weekend"-appartment), but the whole network worked
flawlessly. These
>Arm based appliances are definitely less reliable than ordinary PC H/W. I
>use slave DNS servers on my file servers, which keep at least DNS working
>whatever the Raspi or the Cubieboard do (better: don't do...).
As I said before, I would like to stay clear of bind if I can. At least for now.
It adds one more level to configure, administer and troubleshoot.

I think adding components like a 2nd DC or a slave ns or a second dhcp* for
redundancy may be a great idea later when the system is in production and does
not perform as reliable as expected.
In the meantime, Clients still work without DC, static ips or router dhcp can
push corrected ip/dns settings and radius can be configured to use fallback
user/pass if AD goes down...

*DHCP: Still havent decided if I should change router dhcp to push out AD DNS
and domain name or disable router dhcp and get my own dhcp going - including
dynamic dns updates...

---

kerberos still isnt working and I dont know enough about kerberos yet to really
trouble shoot or see problems in logs...

after further googling I think I may have been in the wrong when I copied the
samba supplied krb5.conf over the one in /etc.
so i restored the one in etc and added the samba one...

the change(s) in the krb5.conf did not help...

--- this is my /etc/krb5.conf

[libdefaults]
         default_realm = MY-DOMAIN.LOCAL
         dns_lookup_realm = false
         dns_lookup_kdc = true


# The following krb5.conf variables are only for MIT Kerberos.
         krb4_config = /etc/krb.conf
         krb4_realms = /etc/krb.realms
         kdc_timesync = 1
         ccache_type = 4
         forwardable = true
         proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
         v4_instance_resolve = false
         v4_name_convert = {
                 host = {
                         rcmd = host
                         ftp = ftp
                 }
                 plain = {
                         something = something-else
                 }
         }
         fcc-mit-ticketflags = true

[realms]
         MY-DOMAIN.LOCAL = {
                 kdc = adserver.my-domain.local			<-- tried with adserver
                 admin_server = adserver.my-domain.local		and
adserver.my-domain.local
			}

	... lots of .MIT.EDU entries ...

[domain_realm]
         .mit.edu = ATHENA.MIT.EDU
         mit.edu = ATHENA.MIT.EDU
         .media.mit.edu = MEDIA-LAB.MIT.EDU
         media.mit.edu = MEDIA-LAB.MIT.EDU
         .csail.mit.edu = CSAIL.MIT.EDU
         csail.mit.edu = CSAIL.MIT.EDU
         .whoi.edu = ATHENA.MIT.EDU
         whoi.edu = ATHENA.MIT.EDU
         .stanford.edu = stanford.edu
         .slac.stanford.edu = SLAC.STANFORD.EDU
         .toronto.edu = UTORONTO.CA
         .utoronto.ca = UTORONTO.CA

[login]
         krb4_convert = true
         krb4_get_tickets = false



--- this is my /etc/nsswitch.conf:

passwd:         compat
group:          compat
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

---

Matze

RESULT!

~# kinit administrator at MY-DOMAIN.LOCAL
Password for administrator at MY-DOMAIN.LOCAL:
Warning: Your password will expire in 41 days on Thu Apr 23 16:57:35 2015

!!!!

---

I should have listened to you guys much sooner. I suspect that the 
.local did indeed have something to do with it since mDNS was running 
and may have screwed with dns resolution for *.local. tlds?

additionally, I adjusted the /etc/krb5.conf file according to Peters 
suggestion.
rowland says I only need the top four lines? samba generated a krb5.conf 
file for me with only those 4 lines.
the longer one is working now, is there a reason for why the shorter one 
would be better?

---
>Btw, we would like to check the smb.conf, too..
I posted my entire smb.conf this afternoon already.

---
>and yes, you do need winbind adding to the passwd & group lines in
>/etc/nsswitch.conf, but you need more, see the wiki page I posted earlier.
looking into that next!

---
 >> syslog paste...

 > There is something going on there, how are you starting samba ?

via init.d script / on boot
see first post for where I got the script from and how I edited it...
> OH yes you do!
>tcp        0      0 0.0.0.0:88              0.0.0.0:* LISTEN 2239/samba
>udp        0      0 192.168.7.254:88 0.0.0.0:* 2239/samba
ah, I was looking for krb5 or similar process name...

---
> ipv6
well, its not exactly enabled. no ipv6 in network/interfaces, none in /etc/hosts
and i am pretty sure I build without ipv6 support.
if need be I could go deeper into raspbian and see if I can forceable disable
ipv6

however, in the not too distant future, the possibility to at least run a
dualstack should exist.
forcing ipv6 off in the OS would be a step in the wrong direction for that :)

---

just tested...
I was able to add a win7pro to the domain!