thr3ads.net - samba - [Samba] [SAMBA] Problems with joining a second DC to AD [May 2015]

If this information is useful, please help other people find it:
Share via:

Stephan Mattecka

2015-May-21 16:41 UTC

[Samba] [SAMBA] Problems with joining a second DC to AD

Hi Rowland and Louis,
?
I did try both of your suggestions, but nothing changed on DC2. I did check all
the DNS-settings (resolv.conf and hosts), so that I don't think that this is
the reason for the error-messages.
?
I did set the loglevel to 5 and will try to find the differences between both
machines. These are just virtual machines to test the building of a AD-Domain
before using it in real life.
?
Regards
Stephan
?
?
?

Gesendet:?Donnerstag, 21. Mai 2015 um 10:39 Uhr
Von:?"L.P.H. van Belle" <belle at bazuin.nl>
An:?"samba at lists.samba.org" <samba at lists.samba.org>
Betreff:?Re: [Samba] [SAMBA] Problems with joining a second DC to AD
Hai,

I hope, your domain is not .lan ( reserved name for mDNS )
can be used, but can give problemens.

in smb.conf
change :
interfaces = lo, eth0
to
interfaces = lo, IP_of_eth0

and make sure your /etc/hosts and /etc/resolv.conf on DC2 are correct.
make sure you have in /etc/resolv.conf on DC2.
search example.lan
nameserver IP_OF_DC1



and try again.

Greetz,

Louis


>-----Oorspronkelijk bericht-----
>Van: ste-fun_s at gmx.de [mailto:samba-bounces at lists.samba.org]
>Namens Stephan Mattecka
>Verzonden: donderdag 21 mei 2015 9:18
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] [SAMBA] Problems with joining a second DC to AD
>
>Hello,
>?
>I try to setup an AD-Domain with the help of Sernet-Samba
>packages. Currently I'm using Scientific Linux (SL) 6.6 and
>Sernet-Samba 4.1.17 packages. I tried the procedure two times
>with fresh minimal SL installations.
>?
>I could successfully install a AD-Domain-Controller.
>Now I tried to add a second DC to this AD-Domain and followed
>carefully the instructions at the samba wiki.
>I could also join the second DC to my domain, but when I try to run
>?
>samba-tool ntacl sysvolreset
>?
>on the 2nd DC I get the following error messages:
>?
>
>open: error=2 (No such file or directory)
>ERROR(runtime): uncaught exception - (-1073741823,
>'Undetermined error')
>? File
>"/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
>line 175, in _run
>??? return self.run(*args, **kwargs)
>? File
>"/usr/lib64/python2.6/site-packages/samba/netcmd/ntacl.py",
>line 218, in run
>??? lp, use_ntvfs=use_ntvfs)
>? File
>"/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>", line 1612, in setsysvolacl
>??? set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn,
>samdb, lp, use_ntvfs, passdb=s4_passdb)
>? File
>"/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>", line 1505, in set_gpos_acl
>??? use_ntvfs=use_ntvfs, skip_invalid_chown=True,
>passdb=passdb, service=SYSVOL_SERVICE)
>? File "/usr/lib64/python2.6/site-packages/samba/ntacls.py",
>line 154, in setntacl
>??? smbd.set_nt_acl(file, security.SECINFO_OWNER |
>security.SECINFO_GROUP | security.SECINFO_DACL |
>security.SECINFO_SACL, sd, service=service)
>?
>My smb.conf on DC1:
>?
>
># Global parameters
>[global]
>??????? workgroup = EXAMPLE
>??????? realm = EXAMPLE.LAN
>??????? netbios name = DC1
>??????? interfaces = lo, eth0
>??????? bind interfaces only = Yes
>??????? server role = active directory domain controller
>??????? idmap_ldb:use rfc2307 = yes
>[netlogon]
>??????? path = /var/lib/samba/sysvol/pentracor.lan/scripts
>??????? read only = No
>[sysvol]
>??????? path = /var/lib/samba/sysvol
>??????? read only = No
>?
>smb.conf ond DC2:
>?
>
># Global parameters
>[global]
>??????? workgroup = EXAMPLE
>??????? realm = example.lan
>??????? netbios name = DC2
>??????? interfaces = lo, eth1
>??????? bind interfaces only = Yes
>??????? server role = active directory domain controller
>[netlogon]
>??????? path = /var/lib/samba/sysvol/example.lan/scripts
>??????? read only = No
>[sysvol
>??????? path = /var/lib/samba/sysvol
>??????? read only = No
>?
>I did turn off iptables and SELinux on both machines for
>testing purposes. The folder /var/lib/samba/sysvol exists on
>DC2. On DC1 I can run the sysvolreset command without any problems.
>?
>Hopefully someone has an idea what might be wrong here.
>?
>Regards
>Stephan Mattecka
>--
>To unsubscribe from this list go to the following URL and read the
>instructions: https://lists.samba.org/mailman/options/samba
>
--
To unsubscribe from this list go to the following URL and read the
instructions:
https://lists.samba.org/mailman/options/samba[https://lists.samba.org/mailman/options/samba]

Rowland Penny

2015-May-21 17:06 UTC

head link

[Samba] [SAMBA] Problems with joining a second DC to AD

On 21/05/15 17:41, Stephan Mattecka wrote:> Hi Rowland and Louis,
>   
> I did try both of your suggestions, but nothing changed on DC2. I did check
all the DNS-settings (resolv.conf and hosts), so that I don't think that
this is the reason for the error-messages.
>   
> I did set the loglevel to 5 and will try to find the differences between
both machines. These are just virtual machines to test the building of a
AD-Domain before using it in real life.
>   
> Regards
> Stephan
>   
>   
>   
>
> Gesendet: Donnerstag, 21. Mai 2015 um 10:39 Uhr
> Von: "L.P.H. van Belle" <belle at bazuin.nl>
> An: "samba at lists.samba.org" <samba at lists.samba.org>
> Betreff: Re: [Samba] [SAMBA] Problems with joining a second DC to AD
> Hai,
>
> I hope, your domain is not .lan ( reserved name for mDNS )
> can be used, but can give problemens.
>
> in smb.conf
> change :
> interfaces = lo, eth0
> to
> interfaces = lo, IP_of_eth0
>
> and make sure your /etc/hosts and /etc/resolv.conf on DC2 are correct.
> make sure you have in /etc/resolv.conf on DC2.
> search example.lan
> nameserver IP_OF_DC1
>
>
>
> and try again.
>
> Greetz,
>
> Louis
>
>
>
>> -----Oorspronkelijk bericht-----
>> Van: ste-fun_s at gmx.de [mailto:samba-bounces at lists.samba.org]
>> Namens Stephan Mattecka
>> Verzonden: donderdag 21 mei 2015 9:18
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] [SAMBA] Problems with joining a second DC to AD
>>
>> Hello,
>>   
>> I try to setup an AD-Domain with the help of Sernet-Samba
>> packages. Currently I'm using Scientific Linux (SL) 6.6 and
>> Sernet-Samba 4.1.17 packages. I tried the procedure two times
>> with fresh minimal SL installations.
>>   
>> I could successfully install a AD-Domain-Controller.
>> Now I tried to add a second DC to this AD-Domain and followed
>> carefully the instructions at the samba wiki.
>> I could also join the second DC to my domain, but when I try to run
>>   
>> samba-tool ntacl sysvolreset
>>   
>> on the 2nd DC I get the following error messages:
>>   
>>
>> open: error=2 (No such file or directory)
>> ERROR(runtime): uncaught exception - (-1073741823,
>> 'Undetermined error')
>>    File
>>
"/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
>> line 175, in _run
>>      return self.run(*args, **kwargs)
>>    File
>> "/usr/lib64/python2.6/site-packages/samba/netcmd/ntacl.py",
>> line 218, in run
>>      lp, use_ntvfs=use_ntvfs)
>>    File
>> "/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>> ", line 1612, in setsysvolacl
>>      set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn,
>> samdb, lp, use_ntvfs, passdb=s4_passdb)
>>    File
>> "/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>> ", line 1505, in set_gpos_acl
>>      use_ntvfs=use_ntvfs, skip_invalid_chown=True,
>> passdb=passdb, service=SYSVOL_SERVICE)
>>    File "/usr/lib64/python2.6/site-packages/samba/ntacls.py",
>> line 154, in setntacl
>>      smbd.set_nt_acl(file, security.SECINFO_OWNER |
>> security.SECINFO_GROUP | security.SECINFO_DACL |
>> security.SECINFO_SACL, sd, service=service)
>>   
>> My smb.conf on DC1:
>>   
>>
>> # Global parameters
>> [global]
>>          workgroup = EXAMPLE
>>          realm = EXAMPLE.LAN
>>          netbios name = DC1
>>          interfaces = lo, eth0
>>          bind interfaces only = Yes
>>          server role = active directory domain controller
>>          idmap_ldb:use rfc2307 = yes
>> [netlogon]
>>          path = /var/lib/samba/sysvol/pentracor.lan/scripts
>>          read only = No
>> [sysvol]
>>          path = /var/lib/samba/sysvol
>>          read only = No
>>   
>> smb.conf ond DC2:
>>   
>>
>> # Global parameters
>> [global]
>>          workgroup = EXAMPLE
>>          realm = example.lan
>>          netbios name = DC2
>>          interfaces = lo, eth1
>>          bind interfaces only = Yes
>>          server role = active directory domain controller
>> [netlogon]
>>          path = /var/lib/samba/sysvol/example.lan/scripts
>>          read only = No
>> [sysvol
>>          path = /var/lib/samba/sysvol
>>          read only = No
>>   
>> I did turn off iptables and SELinux on both machines for
>> testing purposes. The folder /var/lib/samba/sysvol exists on
>> DC2. On DC1 I can run the sysvolreset command without any problems.
>>   
>> Hopefully someone has an idea what might be wrong here.
>>   
>> Regards
>> Stephan Mattecka
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions: https://lists.samba.org/mailman/options/samba
>>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:
https://lists.samba.org/mailman/options/samba[https://lists.samba.org/mailman/options/samba]
OK, try commenting out the interfaces lines, restart samba on both 
machines and see how you go on.

I do not know if you are trying in anyway to sync sysvol between the 2 
DCs, if you are this could give you a problem, as idmap.ldb is different 
between the DCs, the workaround is to copy idmap.ldb from the first DC 
to the second and run sysvolreset, but this is where we came in :-D

Can you post the command you used to provision the first DC and the 
command you used to join the second DC to the first.

Rowland

Stephan Mattecka

2015-May-26 09:42 UTC

head link

[Samba] [SAMBA] Problems with joining a second DC to AD

Gesendet:?Donnerstag, 21. Mai 2015 um 19:06 Uhr
Von:?"Rowland Penny" <rowlandpenny at googlemail.com>
An:?samba at lists.samba.org
Betreff:?Re: [Samba] [SAMBA] Problems with joining a second DC to AD
On 21/05/15 17:41, Stephan Mattecka wrote:> Hi Rowland and Louis,
>
> I did try both of your suggestions, but nothing changed on DC2. I did check
all the DNS-settings (resolv.conf and hosts), so that I don't think that
this is the reason for the error-messages.
>
> I did set the loglevel to 5 and will try to find the differences between
both machines. These are just virtual machines to test the building of a
AD-Domain before using it in real life.
>
> Regards
> Stephan
>
>
>
>
> Gesendet: Donnerstag, 21. Mai 2015 um 10:39 Uhr
> Von: "L.P.H. van Belle" <belle at bazuin.nl>
> An: "samba at lists.samba.org" <samba at lists.samba.org>
> Betreff: Re: [Samba] [SAMBA] Problems with joining a second DC to AD
> Hai,
>
> I hope, your domain is not .lan ( reserved name for mDNS )
> can be used, but can give problemens.
>
> in smb.conf
> change :
> interfaces = lo, eth0
> to
> interfaces = lo, IP_of_eth0
>
> and make sure your /etc/hosts and /etc/resolv.conf on DC2 are correct.
> make sure you have in /etc/resolv.conf on DC2.
> search example.lan
> nameserver IP_OF_DC1
>
>
>
> and try again.
>
> Greetz,
>
> Louis
>
>
>
>> -----Oorspronkelijk bericht-----
>> Van: ste-fun_s at gmx.de [mailto:samba-bounces at lists.samba.org]
>> Namens Stephan Mattecka
>> Verzonden: donderdag 21 mei 2015 9:18
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] [SAMBA] Problems with joining a second DC to AD
>>
>> Hello,
>>
>> I try to setup an AD-Domain with the help of Sernet-Samba
>> packages. Currently I'm using Scientific Linux (SL) 6.6 and
>> Sernet-Samba 4.1.17 packages. I tried the procedure two times
>> with fresh minimal SL installations.
>>
>> I could successfully install a AD-Domain-Controller.
>> Now I tried to add a second DC to this AD-Domain and followed
>> carefully the instructions at the samba wiki.
>> I could also join the second DC to my domain, but when I try to run
>>
>> samba-tool ntacl sysvolreset
>>
>> on the 2nd DC I get the following error messages:
>>
>>
>> open: error=2 (No such file or directory)
>> ERROR(runtime): uncaught exception - (-1073741823,
>> 'Undetermined error')
>> File
>>
"/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
>> line 175, in _run
>> return self.run(*args, **kwargs)
>> File
>> "/usr/lib64/python2.6/site-packages/samba/netcmd/ntacl.py",
>> line 218, in run
>> lp, use_ntvfs=use_ntvfs)
>> File
>> "/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>> ", line 1612, in setsysvolacl
>> set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn,
>> samdb, lp, use_ntvfs, passdb=s4_passdb)
>> File
>> "/usr/lib64/python2.6/site-packages/samba/provision/__init__.py
>> ", line 1505, in set_gpos_acl
>> use_ntvfs=use_ntvfs, skip_invalid_chown=True,
>> passdb=passdb, service=SYSVOL_SERVICE)
>> File "/usr/lib64/python2.6/site-packages/samba/ntacls.py",
>> line 154, in setntacl
>> smbd.set_nt_acl(file, security.SECINFO_OWNER |
>> security.SECINFO_GROUP | security.SECINFO_DACL |
>> security.SECINFO_SACL, sd, service=service)
>>
>> My smb.conf on DC1:
>>
>>
>> # Global parameters
>> [global]
>> workgroup = EXAMPLE
>> realm = EXAMPLE.LAN
>> netbios name = DC1
>> interfaces = lo, eth0
>> bind interfaces only = Yes
>> server role = active directory domain controller
>> idmap_ldb:use rfc2307 = yes
>> [netlogon]
>> path = /var/lib/samba/sysvol/pentracor.lan/scripts
>> read only = No
>> [sysvol]
>> path = /var/lib/samba/sysvol
>> read only = No
>>
>> smb.conf ond DC2:
>>
>>
>> # Global parameters
>> [global]
>> workgroup = EXAMPLE
>> realm = example.lan
>> netbios name = DC2
>> interfaces = lo, eth1
>> bind interfaces only = Yes
>> server role = active directory domain controller
>> [netlogon]
>> path = /var/lib/samba/sysvol/example.lan/scripts
>> read only = No
>> [sysvol
>> path = /var/lib/samba/sysvol
>> read only = No
>>
>> I did turn off iptables and SELinux on both machines for
>> testing purposes. The folder /var/lib/samba/sysvol exists on
>> DC2. On DC1 I can run the sysvolreset command without any problems.
>>
>> Hopefully someone has an idea what might be wrong here.
>>
>> Regards
>> Stephan Mattecka
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions: https://lists.samba.org/mailman/options/samba
>>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:
https://lists.samba.org/mailman/options/samba[https://lists.samba.org/mailman/options/samba][https://lists.samba.org/mailman/options/samba[https://lists.samba.org/mailman/options/samba]]
>OK, try commenting out the interfaces lines, restart samba on both
>machines and see how you go on.
>I do not know if you are trying in anyway to sync sysvol between the 2
>DCs, if you are this could give you a problem, as idmap.ldb is different
>between the DCs, the workaround is to copy idmap.ldb from the first DC
>to the second and run sysvolreset, but this is where we came in :-D
>
>Can you post the command you used to provision the first DC and the
>command you used to join the second DC to the first.
>
>Rowland
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:
https://lists.samba.org/mailman/options/samba[https://lists.samba.org/mailman/options/samba]
Hello Rowland,

I did comment the interfaces lines but nothing changed for the sysvolcheck on
dc2.
I also get an error message for ntacl sysvolcheck. The loglevel 5 output is the
following (for sysvolcheck in this case, I deleted some lines about loglevels
being 5):

INFO: Current debug levels:
  all: 5
Processing section "[netlogon]"
Processing section "[sysvol]"
pm_process() returned Yes
schema_fsmo_init: we are master[no] updates allowed[no]
schema_fsmo_init: we are master[no] updates allowed[no]
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
params.c:pm_process() - Processing configuration file
"/etc/samba/smb.conf"
Processing section "[global]"
doing parameter workgroup = EXAMPLE
doing parameter realm = example.lan
doing parameter netbios name = DC2
doing parameter server role = active directory domain controller
doing parameter log level = 5
INFO: Current debug levels:
  all: 5
doing parameter idmap_ldb:use rfc2307 = yes
Processing section "[netlogon]"
doing parameter path = /var/lib/samba/sysvol/example.lan/scripts
doing parameter read only = No
Processing section "[sysvol]"
doing parameter path = /var/lib/samba/sysvol
doing parameter read only = No
pm_process() returned Yes
Attempting to register passdb backend smbpasswd
Successfully added passdb backend 'smbpasswd'
Attempting to register passdb backend tdbsam
Successfully added passdb backend 'tdbsam'
Attempting to register passdb backend wbc_sam
Successfully added passdb backend 'wbc_sam'
Attempting to register passdb backend samba_dsdb
Successfully added passdb backend 'samba_dsdb'
Attempting to register passdb backend samba4
Successfully added passdb backend 'samba4'
Attempting to register passdb backend ldapsam
Successfully added passdb backend 'ldapsam'
Attempting to register passdb backend NDS_ldapsam
Successfully added passdb backend 'NDS_ldapsam'
Attempting to register passdb backend IPA_ldapsam
Successfully added passdb backend 'IPA_ldapsam'
Attempting to find a passdb backend to match
samba_dsdb:tdb:///var/lib/samba/private/sam.ldb (samba_dsdb)
Found pdb backend samba_dsdb
ldb_wrap open of idmap.ldb
pdb backend samba_dsdb:tdb:///var/lib/samba/private/sam.ldb has a valid init
ERROR(<type 'exceptions.TypeError'>): uncaught exception - (2,
'No such file or directory')
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
line 175, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/ntacl.py",
line 249, in run
    lp)
  File
"/usr/lib64/python2.6/site-packages/samba/provision/__init__.py", line
1726, in checksysvolacl
    direct_db_access)
  File
"/usr/lib64/python2.6/site-packages/samba/provision/__init__.py", line
1677, in check_gpos_acl
    domainsid, direct_db_access)
  File
"/usr/lib64/python2.6/site-packages/samba/provision/__init__.py", line
1621, in check_dir_acl
    fsacl = getntacl(lp, path, direct_db_access=direct_db_access,
service=SYSVOL_SERVICE)
  File "/usr/lib64/python2.6/site-packages/samba/ntacls.py", line 73,
in getntacl
    xattr.XATTR_NTACL_NAME)

For provisioning and joining I followed strictly the HowTos on the samba Wiki. I
used the following commands:

samba-tool domain provision --use-rfc2307 --interactive
--option="interfaces=lo eth0" --option="bind interfaces
only=yes" (provisioning on DC1)

samba-tool domain join example.lan DC -Uadministrator --realm=example.lan
--dns-backend=SAMBA_INTERNAL --option="interfaces=lo eth0"
--option="bind interfaces only=yes" (joining DC2)

I just came to the problem because I wanted to sync the sysvol between the two
DCs. But then I got this error-message on DC2.
My first thought was that something was wrong with the imported file, so I
started the procedure again, to see if I get the same error-message without
importing the data from DC1.

Regards
Stephan

Maybe Matching Threads

Search for more maybe matching threads

samba - May 2015 - Problems with joining a second DC to AD

[Samba] [SAMBA] Problems with joining a second DC to AD

[Samba] [SAMBA] Problems with joining a second DC to AD

[Samba] [SAMBA] Problems with joining a second DC to AD

Maybe Matching Threads