samba - Mar 2015 - Debian Jessie AD DC w. BIND9 : DNS update fails for debian squeezy member server

Yes, it was/is an NT-4 style PDC with Samba 3.2.5 on lenny. I did a clean
install of jessie and installed samba 4.1.17 from jessie repositories. Is
there a better way?

Strangely the domain join, shares and users did work before on the squeezy
member against the Samba4 AD DC with security = domain and no keytab
defined, nor created.

The only thing that didn't work, was setting the dns record during 'net
ads
join -Uadministrator'. I'll probably go back to the old, ugly,
overloaded
smb.conf, so that I have the users working and add the dns entries manually
for the other linux machines.

Greetings,
Timo

On 20 March 2015 at 18:11, Rowland Penny <rowlandpenny at googlemail.com>
wrote:
> On 20/03/15 16:56, Timo Altun wrote:
>
>> On 20 March 2015 at 17:00, Rowland Penny <rowlandpenny at
googlemail.com
>> <mailto:rowlandpenny at googlemail.com>> wrote:
>>
>>     On 20/03/15 15:47, Timo Altun wrote:
>>
>>         I'm sorry it got confusing, changed the topic and I'll
try to
>>         explain. I am using Jessie on the DC. Server13 is a linux file
>>         server and domain member, it is on squeeze. If possible, I do
>>         not want to upgrade it. The problem here is, that it does not
>>         seem to generate a DNS record when joining the domain and,
>>         after setting up the new smb.conf, the users aren't passed
on
>>         from winbind to the local authentication tools. It also caused
>>         the single share I set up in the smb.conf to be unaccessible
>>         by user administrator. Maybe something with the keytab file is
>>         not working.
>>
>>
>>     You were confused :-D
>>
>>
>> And I most definitely still am :)
>> In general, am I right, that Kerberos is working as intended, when I am
>> able to get tickets?
>> Further, my old smb.conf used security = domain and no keytab...might
>> this be the reason for the winbind users not being transferred?
>> Maybe it's also necessary for DNS updates to have that part
working.
>>
>>
>>
>>
> Was your old domain server an NT-4 style PDC ? you didn't use kerberos
> with this type of server. Now that you are using a Samba4 AD DC, you have
> to use 'security = ADS' and keytabs, the main keytab (usually
> /etc/krb5.keytab) is created for you when you run 'net ads join -U
> Administrator', the join should create the dns record for the client
but
> sometimes it doesn't. This is not a problem, you just have to create
them
> manually on the DC with 'samba-tool dns add <server> <zone>
<name>
> <A|AAAA|PTR|CNAME|NS|MX|SRV|TXT> <data>'. See samba-tool
dns add --help'
> for more info.
>
> Having said all that, one thing that I don't think has been raised yet,
> how did you install samba on the DC ?
>
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On 20/03/15 18:28, Timo Altun wrote:
> Yes, it was/is an NT-4 style PDC with Samba 3.2.5 on lenny. I did a 
> clean install of jessie and installed samba 4.1.17 from jessie 
> repositories. Is there a better way?
>
> Strangely the domain join, shares and users did work before on the 
> squeezy member against the Samba4 AD DC with security = domain and no 
> keytab defined, nor created.
>
> The only thing that didn't work, was setting the dns record during 
> 'net ads join -Uadministrator'. I'll probably go back to the
old,
> ugly, overloaded smb.conf, so that I have the users working and add 
> the dns entries manually for the other linux machines.
>
> Greetings,
> Timo
>
> On 20 March 2015 at 18:11, Rowland Penny <rowlandpenny at googlemail.com
> <mailto:rowlandpenny at googlemail.com>> wrote:
>
>     On 20/03/15 16:56, Timo Altun wrote:
>
>         On 20 March 2015 at 17:00, Rowland Penny
>         <rowlandpenny at googlemail.com
>         <mailto:rowlandpenny at googlemail.com>
>         <mailto:rowlandpenny at googlemail.com
>         <mailto:rowlandpenny at googlemail.com>>> wrote:
>
>             On 20/03/15 15:47, Timo Altun wrote:
>
>                 I'm sorry it got confusing, changed the topic and
I'll
>         try to
>                 explain. I am using Jessie on the DC. Server13 is a
>         linux file
>                 server and domain member, it is on squeeze. If
>         possible, I do
>                 not want to upgrade it. The problem here is, that it
>         does not
>                 seem to generate a DNS record when joining the domain and,
>                 after setting up the new smb.conf, the users aren't
>         passed on
>                 from winbind to the local authentication tools. It
>         also caused
>                 the single share I set up in the smb.conf to be
>         unaccessible
>                 by user administrator. Maybe something with the keytab
>         file is
>                 not working.
>
>
>             You were confused :-D
>
>
>         And I most definitely still am :)
>         In general, am I right, that Kerberos is working as intended,
>         when I am able to get tickets?
>         Further, my old smb.conf used security = domain and no
>         keytab...might this be the reason for the winbind users not
>         being transferred?
>         Maybe it's also necessary for DNS updates to have that part
>         working.
>
>
>
>
>     Was your old domain server an NT-4 style PDC ? you didn't use
>     kerberos with this type of server. Now that you are using a Samba4
>     AD DC, you have to use 'security = ADS' and keytabs, the main
>     keytab (usually /etc/krb5.keytab) is created for you when you run
>     'net ads join -U Administrator', the join should create the dns
>     record for the client but sometimes it doesn't. This is not a
>     problem, you just have to create them manually on the DC with
>     'samba-tool dns add <server> <zone> <name>
>     <A|AAAA|PTR|CNAME|NS|MX|SRV|TXT> <data>'. See
samba-tool dns add
>     --help' for more info.
>
>     Having said all that, one thing that I don't think has been raised
>     yet, how did you install samba on the DC ?
>
>
>     Rowland
>
>
>     -- 
>     To unsubscribe from this list go to the following URL and read the
>     instructions: https://lists.samba.org/mailman/options/samba
>
>
OK, have you run this command (on any of your computers):

samba-tool domain provision

and if so which

Rowland

I did not run that command at all. I did run samba-tool classicupgrade on
the DC after setting up ldap with my data. As far as I understand the
provisioning of the domain is done during that process. And on the other
machines provisioning must not be done, right?
On 20 Mar 2015 19:35, "Rowland Penny" <rowlandpenny at
googlemail.com> wrote:
> On 20/03/15 18:28, Timo Altun wrote:
>
>> Yes, it was/is an NT-4 style PDC with Samba 3.2.5 on lenny. I did a
clean
>> install of jessie and installed samba 4.1.17 from jessie repositories.
Is
>> there a better way?
>>
>> Strangely the domain join, shares and users did work before on the
>> squeezy member against the Samba4 AD DC with security = domain and no
>> keytab defined, nor created.
>>
>> The only thing that didn't work, was setting the dns record during
'net
>> ads join -Uadministrator'. I'll probably go back to the old,
ugly,
>> overloaded smb.conf, so that I have the users working and add the dns
>> entries manually for the other linux machines.
>>
>> Greetings,
>> Timo
>>
>> On 20 March 2015 at 18:11, Rowland Penny <rowlandpenny at
googlemail.com
>> <mailto:rowlandpenny at googlemail.com>> wrote:
>>
>>     On 20/03/15 16:56, Timo Altun wrote:
>>
>>         On 20 March 2015 at 17:00, Rowland Penny
>>         <rowlandpenny at googlemail.com
>>         <mailto:rowlandpenny at googlemail.com>
>>         <mailto:rowlandpenny at googlemail.com
>>         <mailto:rowlandpenny at googlemail.com>>> wrote:
>>
>>             On 20/03/15 15:47, Timo Altun wrote:
>>
>>                 I'm sorry it got confusing, changed the topic and
I'll
>>         try to
>>                 explain. I am using Jessie on the DC. Server13 is a
>>         linux file
>>                 server and domain member, it is on squeeze. If
>>         possible, I do
>>                 not want to upgrade it. The problem here is, that it
>>         does not
>>                 seem to generate a DNS record when joining the domain
and,
>>                 after setting up the new smb.conf, the users aren't
>>         passed on
>>                 from winbind to the local authentication tools. It
>>         also caused
>>                 the single share I set up in the smb.conf to be
>>         unaccessible
>>                 by user administrator. Maybe something with the keytab
>>         file is
>>                 not working.
>>
>>
>>             You were confused :-D
>>
>>
>>         And I most definitely still am :)
>>         In general, am I right, that Kerberos is working as intended,
>>         when I am able to get tickets?
>>         Further, my old smb.conf used security = domain and no
>>         keytab...might this be the reason for the winbind users not
>>         being transferred?
>>         Maybe it's also necessary for DNS updates to have that part
>>         working.
>>
>>
>>
>>
>>     Was your old domain server an NT-4 style PDC ? you didn't use
>>     kerberos with this type of server. Now that you are using a Samba4
>>     AD DC, you have to use 'security = ADS' and keytabs, the
main
>>     keytab (usually /etc/krb5.keytab) is created for you when you run
>>     'net ads join -U Administrator', the join should create the
dns
>>     record for the client but sometimes it doesn't. This is not a
>>     problem, you just have to create them manually on the DC with
>>     'samba-tool dns add <server> <zone> <name>
>>     <A|AAAA|PTR|CNAME|NS|MX|SRV|TXT> <data>'. See
samba-tool dns add
>>     --help' for more info.
>>
>>     Having said all that, one thing that I don't think has been
raised
>>     yet, how did you install samba on the DC ?
>>
>>
>>     Rowland
>>
>>
>>     --     To unsubscribe from this list go to the following URL and
read
>> the
>>     instructions: https://lists.samba.org/mailman/options/samba
>>
>>
>>
> OK, have you run this command (on any of your computers):
>
> samba-tool domain provision
>
> and if so which
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>