thr3ads.net - samba - [Samba] net ads info: failed to get server's current time [Oct 2015]

If this information is useful, please help other people find it:
Share via:

Guy-Laurent Subri

2015-Oct-28 10:09 UTC

[Samba] net ads info: failed to get server's current time

On Thu, Oct 22, 2015 at 10:53:30PM +0100, Rowland Penny
wrote:>On 22/10/15 22:33, Guy-Laurent Subri wrote:
>> On Thu, Oct 22, 2015 at 10:13:01PM +0100, Rowland Penny wrote:
>>> On 22/10/15 21:51, Guy-Laurent Subri wrote:
>>>> On Wed, Oct 21, 2015 at 07:06:33PM +0100, Rowland Penny wrote:
>>>>> On 21/10/15 18:35, Guy-Laurent Subri wrote:
>>>>>> Hi all,
>>>>>> We're having issues with Samba at work. I've
searched a bit and the
>>>>>> only
>>>>>> thing that have caught my eye is this: when I run the
'net ads info'
>>>>>> command on our DC --we have a Debian on which samba4 is
installed and
>>>>>> configured as a AD DC-- I have the message "Failed
to get server's
>>>>>> current time!", and "Server time: Thu, 01 Jan
1970 01:00:00 CET".
>>>>>
>>>>> It works for me on a Debian 4.1.17 DC, so you may have
something
>>>>> mis-configured, have you altered the smb.conf in any way ?
>>>>
>>>> I don't think the modifications I did to smb.conf are
relevant
>>>> enough to
>>>> cause problem, but here's our smb.conf, just in case:
>>>>
>>>> # Global parameters
>>>> [global]
>>>>    workgroup = TRS-CH
>>>>    realm = TRS-CH.COM
>>>>    netbios name = PDC
>>>>    server role = active directory domain controller
>>>>    server services = +s3fs, +rpc, +nbt, +wrepl, +ldap, +cldap,
+kdc,
>>>> +drepl,
>>>>                        +winbind, +ntp_signd, +kcc, +dnsupdate
>>>> [netlogon]
>>>>   path = /var/lib/samba/sysvol/trs-ch.com/scripts
>>>>   read only = No
>>>>
>>>> [sysvol]
>>>>   path = /var/lib/samba/sysvol
>>>>   read only = No
>>>>
>>>>> do you have ntp installed and configured correctly ?
>>>> Yes, I have it installed and everything works fine.
>>>>
>>>> I also already tested the DNS by running the commands described
here:
>>>>
https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller
>>>>
>>>>
>>>> Everything is reachable.
>>>>
>>>> I tested kerberos by doing:
>>>> 'kinit administrator at TRS-CH.COM'
>>>> It showed up when I did 'klist'.
>>>>
>>>> Do you need more information ?
>>>>
>>>> Thanks !
>>>> Cheers,
>>>> Guy-Laurent Subri
>>>
>>> Are you running with Bind9 ?
>>>
>>> I think you need to remove all the '+' signs you have added
to the
>>> 'server services' line, you normally only use the
'+' sign to add a
>>> service to the line, I think you may still be using the un-shown
'dns'
>>> option.
>>> I would also recommend that you use the new separate
'winbindd' instead
>>> of the 'winbind' that you are using. I think that before
long the old
>>> 'winbind' built into the samba daemon is going to
disappear, so you
>>> might as well get used to it now.
>> Yes, I'm running Bind9.
>> If I either remove the + sings or change 'windbind' to
'windbindd' I
>> cannot contact the server again. (The result of the command 'net
ads
>> info' is : no logon servers, didn't find the ldap server).
>>
>> Cheers,
>> Guy-Laurent Subri
>
>OK, I have just joined a new DC to my domain and I am using Bind9 and
>this is what I have in smb.conf:
>
>server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
>winbindd, ntp_signd, kcc, dnsupdate
>
>Note the lack of '+' signs
>
>This is with Samba 4.3.1My version of Samba is 4.1.17. I don't think this changes anything, but
I can try to upgrade if needed.>I have also checked and 'net ads info' works as well, so if yours
isn't
>working, then something else is wrong, can you post your ntp.conf and
>bind9 conf files, also your /etc/resolv.conf & /etc/krb5.conf
>
>Rowland
Here are the files:

/etc/ntp.conf
-------------
driftfile /var/lib/ntp/ntp.drift
ntpsigndsocket /var/lib/samba/ntp_signd

statsdir /var/log/ntpstats/

server 0.ch.pool.ntp.org
server 1.ch.pool.ntp.org
server 2.ch.pool.ntp.org
server 3.ch.pool.ntp.org

restrict -4 default kod notrap nomodify nopeer noquery mssntp
restrict -6 default kod notrap nomodify nopeer noquery mssntp

restrict 127.0.0.1
restrict ::1

restrict 0.ch.pool.ntp.org mask 255.255.255 nomodify notrap nopeer noquery

broadcast 192.168.123.255

/etc/bind/named.conf
--------------------
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/var/lib/samba/private/named.conf";

/etc/bind/named.conf.options
----------------------------
options {
    directory "/var/cache/bind";

    forwarders {
        192.168.1.185;
    };
    
    dnssec-validation auto;

    auth-nxdomain no;
    allow-query { localhost; any; };
    listen-on port 53 { 127.0.0.1; 192.168.1.17; };
    listen-on-v6 { any; };
};

/etc/bind/named.conf.local 
--------------------------
is empty

/etc/bind/named.conf.default-zones
----------------------------------
zone "." {
    type hint;
    file "/etc/bind/db.root";
};

zone "localhost" {
    type master;
    file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";
};

/var/lib/samba/private/named.conf
---------------------------------
zone "trs-ch.com." IN {
    type master;
    file "/var/lib/samba/private/dns/trs-ch.com.zone";
    include "/var/lib/samba/private/named.conf.update";
    check-names ignore;
};

resolv.conf
-----------
search trs-ch.com
nameserver 192.168.1.17
nameserver 192.168.1.7

krb5.conf
---------
[libdefaults]
default_realm = TRS-CH.COM
dns_lookup_realm = false
dns_lookup_kdc = true
[realms]
TRS-CH.COM = {
    kdc = 192.168.1.17
        admin_server = 192.168.1.17
        default_domain = trs-ch.com
}
[TRS-CH.COM]
.trs-ch.com = TRS-CH.COM
trs.ch.com TRS-CH.COM

Thank you for your time!

Cheers,
Guy-Laurent

Rowland Penny

2015-Oct-28 10:32 UTC

head link

[Samba] net ads info: failed to get server's current time

On 28/10/15 10:09, Guy-Laurent Subri wrote:
> My version of Samba is 4.1.17. I don't think this changes anything, but
> I can try to upgrade if needed.
OK, looks like you are running Debian, either wheezy using backports or 
Jessie and my old DC is running wheezy and net ads info works on that.
> Here are the files:
>
> /etc/ntp.conf
> -------------
> driftfile /var/lib/ntp/ntp.drift
> ntpsigndsocket /var/lib/samba/ntp_signd
>
> statsdir /var/log/ntpstats/
>
> server 0.ch.pool.ntp.org
> server 1.ch.pool.ntp.org
> server 2.ch.pool.ntp.org
> server 3.ch.pool.ntp.org
>
> restrict -4 default kod notrap nomodify nopeer noquery mssntp
> restrict -6 default kod notrap nomodify nopeer noquery mssntp
>
> restrict 127.0.0.1
> restrict ::1
>
> restrict 0.ch.pool.ntp.org mask 255.255.255 nomodify notrap nopeer 
> noquery
>
> broadcast 192.168.123.255
>
I would suggest that you either remove the last 3 'server' lines or add 
another 3 'restrict' lines to cover them.
> /etc/bind/named.conf
> --------------------
> include "/etc/bind/named.conf.options";
> include "/etc/bind/named.conf.local";
> include "/etc/bind/named.conf.default-zones";
> include "/var/lib/samba/private/named.conf";
>
> /etc/bind/named.conf.options
> ----------------------------
> options {
>    directory "/var/cache/bind";
>
>    forwarders {
>        192.168.1.185;
>    };
What is the forwarder ?
>       dnssec-validation auto;
>
>    auth-nxdomain no;
>    allow-query { localhost; any; };
>    listen-on port 53 { 127.0.0.1; 192.168.1.17; };
>    listen-on-v6 { any; };
> };
>
> /etc/bind/named.conf.local --------------------------
> is empty
>
> /etc/bind/named.conf.default-zones
> ----------------------------------
> zone "." {
>    type hint;
>    file "/etc/bind/db.root";
> };
>
> zone "localhost" {
>    type master;
>    file "/etc/bind/db.local";
> };
>
> zone "127.in-addr.arpa" {
>    type master;
>    file "/etc/bind/db.127";
> };
>
> zone "0.in-addr.arpa" {
>    type master;
>    file "/etc/bind/db.0";
> };
>
> zone "255.in-addr.arpa" {
>    type master;
>    file "/etc/bind/db.255";
> };
>
> /var/lib/samba/private/named.conf
> ---------------------------------
> zone "trs-ch.com." IN {
>    type master;
>    file "/var/lib/samba/private/dns/trs-ch.com.zone";
>    include "/var/lib/samba/private/named.conf.update";
>    check-names ignore;
> };
This is wrong, /var/lib/samba/private/named.conf should be:

dlz "AD DNS Zone" {
     # For BIND 9.8.0
     #database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9.so";

     # For BIND 9.9.0
     database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_9.so";
};
>
> resolv.conf
> -----------
> search trs-ch.com
> nameserver 192.168.1.17
> nameserver 192.168.1.7
>
What is the second nameserver ? if it is a second DC, swap them around, 
otherwise remove it.
> krb5.conf
> ---------
> [libdefaults]
> default_realm = TRS-CH.COM
> dns_lookup_realm = false
> dns_lookup_kdc = true
> [realms]
> TRS-CH.COM = {
>    kdc = 192.168.1.17
>        admin_server = 192.168.1.17
>        default_domain = trs-ch.com
> }
> [TRS-CH.COM]
> .trs-ch.com = TRS-CH.COM
> trs.ch.com > TRS-CH.COM
>
You only need this in /etc/krb5.conf

[libdefaults]
default_realm = TRS-CH.COM
dns_lookup_realm = false
dns_lookup_kdc = true

Rowland

Guy-Laurent Subri

2015-Oct-28 13:03 UTC

head link

[Samba] net ads info: failed to get server's current time

On Wed, Oct 28, 2015 at 10:32:31AM +0000, Rowland Penny
wrote:>On 28/10/15 10:09, Guy-Laurent Subri wrote:
>
>> My version of Samba is 4.1.17. I don't think this changes anything,
but
>> I can try to upgrade if needed.
>
>OK, looks like you are running Debian, either wheezy using backports or
>Jessie and my old DC is running wheezy and net ads info works on that.
>
>> Here are the files:
>>
>> /etc/ntp.conf
>> -------------
>> driftfile /var/lib/ntp/ntp.drift
>> ntpsigndsocket /var/lib/samba/ntp_signd
>>
>> statsdir /var/log/ntpstats/
>>
>> server 0.ch.pool.ntp.org
>> server 1.ch.pool.ntp.org
>> server 2.ch.pool.ntp.org
>> server 3.ch.pool.ntp.org
>>
>> restrict -4 default kod notrap nomodify nopeer noquery mssntp
>> restrict -6 default kod notrap nomodify nopeer noquery mssntp
>>
>> restrict 127.0.0.1
>> restrict ::1
>>
>> restrict 0.ch.pool.ntp.org mask 255.255.255 nomodify notrap nopeer
>> noquery
>>
>> broadcast 192.168.123.255
>>
>
>I would suggest that you either remove the last 3 'server' lines or
add
>another 3 'restrict' lines to cover them.
>
>> /etc/bind/named.conf
>> --------------------
>> include "/etc/bind/named.conf.options";
>> include "/etc/bind/named.conf.local";
>> include "/etc/bind/named.conf.default-zones";
>> include "/var/lib/samba/private/named.conf";
>>
>> /etc/bind/named.conf.options
>> ----------------------------
>> options {
>>    directory "/var/cache/bind";
>>
>>    forwarders {
>>        192.168.1.185;
>>    };
>
>What is the forwarder ?I deleted the forwarder as we don't need it anymore. Thanks for
reminding me it was there!>>       dnssec-validation auto;
>>
>>    auth-nxdomain no;
>>    allow-query { localhost; any; };
>>    listen-on port 53 { 127.0.0.1; 192.168.1.17; };
>>    listen-on-v6 { any; };
>> };
>>
>> /etc/bind/named.conf.local --------------------------
>> is empty
>>
>> /etc/bind/named.conf.default-zones
>> ----------------------------------
>> zone "." {
>>    type hint;
>>    file "/etc/bind/db.root";
>> };
>>
>> zone "localhost" {
>>    type master;
>>    file "/etc/bind/db.local";
>> };
>>
>> zone "127.in-addr.arpa" {
>>    type master;
>>    file "/etc/bind/db.127";
>> };
>>
>> zone "0.in-addr.arpa" {
>>    type master;
>>    file "/etc/bind/db.0";
>> };
>>
>> zone "255.in-addr.arpa" {
>>    type master;
>>    file "/etc/bind/db.255";
>> };
>>
>> /var/lib/samba/private/named.conf
>> ---------------------------------
>> zone "trs-ch.com." IN {
>>    type master;
>>    file "/var/lib/samba/private/dns/trs-ch.com.zone";
>>    include "/var/lib/samba/private/named.conf.update";
>>    check-names ignore;
>> };
>
>This is wrong, /var/lib/samba/private/named.conf should be:
>
>dlz "AD DNS Zone" {
>     # For BIND 9.8.0
>     #database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9.so";
>
>     # For BIND 9.9.0
>     database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_9.so";
>};Ok. I tried this but I've got an error:
samba_dlz: Unable to get basedn for /var/lib/samba/private/dns/sam.ldb
- NULL Base DN invalid for a base search>>
>> resolv.conf
>> -----------
>> search trs-ch.com
>> nameserver 192.168.1.17
>> nameserver 192.168.1.7
>>
>
>What is the second nameserver ? if it is a second DC, swap them around,
>otherwise remove it.It's another DC, but not for the same realm. I swaped
them.>> krb5.conf
>> ---------
>> [libdefaults]
>> default_realm = TRS-CH.COM
>> dns_lookup_realm = false
>> dns_lookup_kdc = true
>> [realms]
>> TRS-CH.COM = {
>>    kdc = 192.168.1.17
>>        admin_server = 192.168.1.17
>>        default_domain = trs-ch.com
>> }
>> [TRS-CH.COM]
>> .trs-ch.com = TRS-CH.COM
>> trs.ch.com >> TRS-CH.COM
>>
>
>You only need this in /etc/krb5.conf
>
>[libdefaults]
>default_realm = TRS-CH.COM
>dns_lookup_realm = false
>dns_lookup_kdc = true
Ok, I modified it accordingly

Do you know why I have this error ? BTW, sam.ldb is owned by root:root
and is set to rw for user and none to group and world, is this ok ?

Thanks again, 
Guy-Laurent

Reasonably Related Threads

Search for more reasonably related threads

samba - Oct 2015 - net ads info: failed to get server's current time

[Samba] net ads info: failed to get server's current time

[Samba] net ads info: failed to get server's current time

[Samba] net ads info: failed to get server's current time

Reasonably Related Threads