thr3ads.net - samba - [Samba] Samba 4.8 RODC not working [May 2018]

If this information is useful, please help other people find it:
Share via:

L.P.H. van Belle

2018-May-29 15:08 UTC

[Samba] Samba 4.8 RODC not working

I think you missed these in the firewall, if you allowed the "in" for
the DC, you also need the OUT.

 49152:65535/tcp ALLOW OUT  


Greetz, 

Louis

 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Gaetan SLONGO via samba
> Verzonden: dinsdag 29 mei 2018 16:40
> Aan: Rowland Penny
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] Samba 4.8 RODC not working
> 
> Hi Rowland, 
> 
> 
> As said into the reply sent to Andrew, Winbind is installed, 
> but not started by samba (this is sernet packages) 
> 
> 
> Thanks 
> 
> ----- Mail original -----
> 
> De: "Rowland Penny via samba" <samba at lists.samba.org> 
> À: samba at lists.samba.org 
> Envoyé: Jeudi 24 Mai 2018 20:48:22 
> Objet : Re: [Samba] Samba 4.8 RODC not working 
> 
> On Thu, 24 May 2018 11:30:40 +0200 (CEST) 
> Gaetan SLONGO via samba <samba at lists.samba.org> wrote: 
> 
> > Hi, 
> > 
> > 
> > 
> > 
> > It's my first try to setup RODC using Samba 4.8. We have 
> latest Samba 
> > 4.7 environnement with 2 DC and some file servers. Joining 
> the DC to 
> > the domain is OK using samba-tool domain join command. The domain 
> > controller appears in the DC list (MMC) 
> > 
> > 
> > However, users cannot be authenticated. Samba is running but these 
> > ports are closed : 
> > 
> > 
> > netbios-ssn 139/tcp # NETBIOS session service 
> > netbios-ssn 139/udp 
> > microsoft-ds 445/tcp 
> > microsoft-ds 445/udp 
> > 
> > Some other ports are available : 
> > 
> > 
> > 
> > [root at dmzrodc ~]# netstat -tlpn 
> > Connexions Internet actives (seulement serveurs) 
> > Proto Recv-Q Send-Q Adresse locale Adresse distante Etat 
> PID/Program 
> > name tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:49152 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49153 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49154 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 23624/samba 
> > tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 23632/samba 
> > tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 23624/samba 
> > 
> > 
> > Winbind is not working : 
> > 
> > [root at dmzrodc ~]# wbinfo -u 
> > could not obtain winbind interface details: 
> > WBC_ERR_WINBIND_NOT_AVAILABLE could not obtain winbind domain name! 
> > Error looking up domain users 
> 
> Is winbind actually installed ?? 
> 
> Rowland 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 
> 
> -- 
> 
> 
> 
> 
> www.it-optics.com 
> 	
> Gaëtan SLONGO | Head of Infrastructure Department 
> Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
> Company : 	+32 (0)65 84 23 85 
> Direct : 	+32 (0)65 32 85 88 
> Fax : 	+32 (0)65 84 66 76 
> Skype ID : 	gslongo.pro 
> GPG Key : 	gslongo-gpg_key.asc 
> 	
> 
> - Please consider your environmental responsibility before 
> printing this e-mail - 
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Gaetan SLONGO

2018-May-30 10:13 UTC

head link

[Samba] Samba 4.8 RODC not working

Hi Louis ! 


Thanks for suggestion ! 
What are these ports ? 


Thanks ! 

----- Mail original -----

De: "L.P.H. van Belle via samba" <samba at lists.samba.org> 
À: samba at lists.samba.org 
Envoyé: Mardi 29 Mai 2018 17:08:21 
Objet : Re: [Samba] Samba 4.8 RODC not working 

I think you missed these in the firewall, if you allowed the "in" for
the DC, you also need the OUT.

49152:65535/tcp ALLOW OUT 


Greetz, 

Louis 


> -----Oorspronkelijk bericht----- 
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Gaetan SLONGO via samba 
> Verzonden: dinsdag 29 mei 2018 16:40 
> Aan: Rowland Penny 
> CC: samba at lists.samba.org 
> Onderwerp: Re: [Samba] Samba 4.8 RODC not working 
> 
> Hi Rowland, 
> 
> 
> As said into the reply sent to Andrew, Winbind is installed, 
> but not started by samba (this is sernet packages) 
> 
> 
> Thanks 
> 
> ----- Mail original ----- 
> 
> De: "Rowland Penny via samba" <samba at lists.samba.org> 
> À: samba at lists.samba.org 
> Envoyé: Jeudi 24 Mai 2018 20:48:22 
> Objet : Re: [Samba] Samba 4.8 RODC not working 
> 
> On Thu, 24 May 2018 11:30:40 +0200 (CEST) 
> Gaetan SLONGO via samba <samba at lists.samba.org> wrote: 
> 
> > Hi, 
> > 
> > 
> > 
> > 
> > It's my first try to setup RODC using Samba 4.8. We have 
> latest Samba 
> > 4.7 environnement with 2 DC and some file servers. Joining 
> the DC to 
> > the domain is OK using samba-tool domain join command. The domain 
> > controller appears in the DC list (MMC) 
> > 
> > 
> > However, users cannot be authenticated. Samba is running but these 
> > ports are closed : 
> > 
> > 
> > netbios-ssn 139/tcp # NETBIOS session service 
> > netbios-ssn 139/udp 
> > microsoft-ds 445/tcp 
> > microsoft-ds 445/udp 
> > 
> > Some other ports are available : 
> > 
> > 
> > 
> > [root at dmzrodc ~]# netstat -tlpn 
> > Connexions Internet actives (seulement serveurs) 
> > Proto Recv-Q Send-Q Adresse locale Adresse distante Etat 
> PID/Program 
> > name tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:49152 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49153 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49154 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 23624/samba 
> > tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 23632/samba 
> > tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 23624/samba 
> > 
> > 
> > Winbind is not working : 
> > 
> > [root at dmzrodc ~]# wbinfo -u 
> > could not obtain winbind interface details: 
> > WBC_ERR_WINBIND_NOT_AVAILABLE could not obtain winbind domain name! 
> > Error looking up domain users 
> 
> Is winbind actually installed ?? 
> 
> Rowland 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 
> 
> -- 
> 
> 
> 
> 
> www.it-optics.com 
> 
> Gaëtan SLONGO | Head of Infrastructure Department 
> Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
> Company : +32 (0)65 84 23 85 
> Direct : +32 (0)65 32 85 88 
> Fax : +32 (0)65 84 66 76 
> Skype ID : gslongo.pro 
> GPG Key : gslongo-gpg_key.asc 
> 
> 
> - Please consider your environmental responsibility before 
> printing this e-mail - 
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 

-- 
To unsubscribe from this list go to the following URL and read the 
instructions: https://lists.samba.org/mailman/options/samba 



-- 




www.it-optics.com 
	
Gaëtan SLONGO | Head of Infrastructure Department 
Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
Company : 	+32 (0)65 84 23 85 
Direct : 	+32 (0)65 32 85 88 
Fax : 	+32 (0)65 84 66 76 
Skype ID : 	gslongo.pro 
GPG Key : 	gslongo-gpg_key.asc 
	

- Please consider your environmental responsibility before printing this e-mail
-

L.P.H. van Belle

2018-May-30 10:24 UTC

head link

[Samba] Samba 4.8 RODC not working

That are port you need : 
https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage  
from the site :  
*** The range matches the port range used by Windows Server 2008 and later. 
Samba versions before 4.7 used the TCP ports 1024 to 1300 instead. To manually
set the port range in Samba 4.7 and later,
set the rpc server port parameter in your smb.conf file. 
 
For details, see the parameter description in the smb.conf(5) man page. 
 
What i'll do, go lunching first, then i'll post my rule for ufw for my
member server, that is set to
Default: deny (incoming), deny (outgoing), disabled (routed)
if people want them. 

Greetz, 
 
Louis
 


 
 


Van: Gaetan SLONGO [mailto:gslongo at it-optics.com] 
Verzonden: woensdag 30 mei 2018 12:13
Aan: L.P.H. van Belle
CC: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4.8 RODC not working



Hi Louis ! 
Thanks for suggestion ! What are these ports ?


Thanks !

De: "L.P.H. van Belle via samba" <samba at lists.samba.org>
À: samba at lists.samba.org
Envoyé: Mardi 29 Mai 2018 17:08:21
Objet : Re: [Samba] Samba 4.8 RODC not working

I think you missed these in the firewall, if you allowed the "in" for
the DC, you also need the OUT.

 49152:65535/tcp ALLOW OUT  


Greetz, 

Louis

 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Gaetan SLONGO via samba
> Verzonden: dinsdag 29 mei 2018 16:40
> Aan: Rowland Penny
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] Samba 4.8 RODC not working
> 
> Hi Rowland, 
> 
> 
> As said into the reply sent to Andrew, Winbind is installed, 
> but not started by samba (this is sernet packages) 
> 
> 
> Thanks 
> 
> ----- Mail original -----
> 
> De: "Rowland Penny via samba" <samba at lists.samba.org> 
> À: samba at lists.samba.org 
> Envoyé: Jeudi 24 Mai 2018 20:48:22 
> Objet : Re: [Samba] Samba 4.8 RODC not working 
> 
> On Thu, 24 May 2018 11:30:40 +0200 (CEST) 
> Gaetan SLONGO via samba <samba at lists.samba.org> wrote: 
> 
> > Hi, 
> > 
> > 
> > 
> > 
> > It's my first try to setup RODC using Samba 4.8. We have 
> latest Samba 
> > 4.7 environnement with 2 DC and some file servers. Joining 
> the DC to 
> > the domain is OK using samba-tool domain join command. The domain 
> > controller appears in the DC list (MMC) 
> > 
> > 
> > However, users cannot be authenticated. Samba is running but these 
> > ports are closed : 
> > 
> > 
> > netbios-ssn 139/tcp # NETBIOS session service 
> > netbios-ssn 139/udp 
> > microsoft-ds 445/tcp 
> > microsoft-ds 445/udp 
> > 
> > Some other ports are available : 
> > 
> > 
> > 
> > [root at dmzrodc ~]# netstat -tlpn 
> > Connexions Internet actives (seulement serveurs) 
> > Proto Recv-Q Send-Q Adresse locale Adresse distante Etat 
> PID/Program 
> > name tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:49152 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49153 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49154 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 23624/samba 
> > tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 23632/samba 
> > tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 23624/samba 
> > 
> > 
> > Winbind is not working : 
> > 
> > [root at dmzrodc ~]# wbinfo -u 
> > could not obtain winbind interface details: 
> > WBC_ERR_WINBIND_NOT_AVAILABLE could not obtain winbind domain name! 
> > Error looking up domain users 
> 
> Is winbind actually installed ?? 
> 
> Rowland 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 
> 
> -- 
> 
> 
> 
> 
> www.it-optics.com 
>         
> Gaëtan SLONGO | Head of Infrastructure Department 
> Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
> Company :         +32 (0)65 84 23 85 
> Direct :         +32 (0)65 32 85 88 
> Fax :         +32 (0)65 84 66 76 
> Skype ID :         gslongo.pro 
> GPG Key :         gslongo-gpg_key.asc 
>         
> 
> - Please consider your environmental responsibility before 
> printing this e-mail - 
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba




-- 


www.it-optics.com 

	Gaëtan SLONGO | Head of Infrastructure Department
Boulevard Initialis, 28 - 7000 Mons, BELGIUM
Company : 	+32 (0)65 84 23 85 
Direct : 	+32 (0)65 32 85 88 
Fax : 	+32 (0)65 84 66 76 
Skype ID : 	gslongo.pro 
GPG Key : 	gslongo-gpg_key.asc 

	

- Please consider your environmental responsibility before printing this e-mail
-

Gaetan SLONGO

2018-May-31 09:00 UTC

head link

[Samba] Samba 4.8 RODC not working

Hi Louis ! 


Thank you for your time. OK I see. 
But I checked, for testing I set an allow all rule, which doesnt have any effect
:-/


Thanks ;-) 

----- Mail original -----

De: "L.P.H. van Belle via samba" <samba at lists.samba.org> 
À: samba at lists.samba.org 
Envoyé: Mercredi 30 Mai 2018 12:24:06 
Objet : Re: [Samba] Samba 4.8 RODC not working 

That are port you need : 
https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage 
from the site : 
*** The range matches the port range used by Windows Server 2008 and later. 
Samba versions before 4.7 used the TCP ports 1024 to 1300 instead. To manually
set the port range in Samba 4.7 and later,
set the rpc server port parameter in your smb.conf file. 

For details, see the parameter description in the smb.conf(5) man page. 

What i'll do, go lunching first, then i'll post my rule for ufw for my
member server, that is set to
Default: deny (incoming), deny (outgoing), disabled (routed) 
if people want them. 

Greetz, 

Louis 







Van: Gaetan SLONGO [mailto:gslongo at it-optics.com] 
Verzonden: woensdag 30 mei 2018 12:13 
Aan: L.P.H. van Belle 
CC: samba at lists.samba.org 
Onderwerp: Re: [Samba] Samba 4.8 RODC not working 



Hi Louis ! 
Thanks for suggestion ! What are these ports ? 


Thanks ! 

De: "L.P.H. van Belle via samba" <samba at lists.samba.org> 
À: samba at lists.samba.org 
Envoyé: Mardi 29 Mai 2018 17:08:21 
Objet : Re: [Samba] Samba 4.8 RODC not working 

I think you missed these in the firewall, if you allowed the "in" for
the DC, you also need the OUT.

49152:65535/tcp ALLOW OUT 


Greetz, 

Louis 


> -----Oorspronkelijk bericht----- 
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Gaetan SLONGO via samba 
> Verzonden: dinsdag 29 mei 2018 16:40 
> Aan: Rowland Penny 
> CC: samba at lists.samba.org 
> Onderwerp: Re: [Samba] Samba 4.8 RODC not working 
> 
> Hi Rowland, 
> 
> 
> As said into the reply sent to Andrew, Winbind is installed, 
> but not started by samba (this is sernet packages) 
> 
> 
> Thanks 
> 
> ----- Mail original ----- 
> 
> De: "Rowland Penny via samba" <samba at lists.samba.org> 
> À: samba at lists.samba.org 
> Envoyé: Jeudi 24 Mai 2018 20:48:22 
> Objet : Re: [Samba] Samba 4.8 RODC not working 
> 
> On Thu, 24 May 2018 11:30:40 +0200 (CEST) 
> Gaetan SLONGO via samba <samba at lists.samba.org> wrote: 
> 
> > Hi, 
> > 
> > 
> > 
> > 
> > It's my first try to setup RODC using Samba 4.8. We have 
> latest Samba 
> > 4.7 environnement with 2 DC and some file servers. Joining 
> the DC to 
> > the domain is OK using samba-tool domain join command. The domain 
> > controller appears in the DC list (MMC) 
> > 
> > 
> > However, users cannot be authenticated. Samba is running but these 
> > ports are closed : 
> > 
> > 
> > netbios-ssn 139/tcp # NETBIOS session service 
> > netbios-ssn 139/udp 
> > microsoft-ds 445/tcp 
> > microsoft-ds 445/udp 
> > 
> > Some other ports are available : 
> > 
> > 
> > 
> > [root at dmzrodc ~]# netstat -tlpn 
> > Connexions Internet actives (seulement serveurs) 
> > Proto Recv-Q Send-Q Adresse locale Adresse distante Etat 
> PID/Program 
> > name tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:49152 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49153 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49154 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 23624/samba 
> > tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 23632/samba 
> > tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 23624/samba 
> > 
> > 
> > Winbind is not working : 
> > 
> > [root at dmzrodc ~]# wbinfo -u 
> > could not obtain winbind interface details: 
> > WBC_ERR_WINBIND_NOT_AVAILABLE could not obtain winbind domain name! 
> > Error looking up domain users 
> 
> Is winbind actually installed ?? 
> 
> Rowland 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 
> 
> -- 
> 
> 
> 
> 
> www.it-optics.com 
> 
> Gaëtan SLONGO | Head of Infrastructure Department 
> Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
> Company : +32 (0)65 84 23 85 
> Direct : +32 (0)65 32 85 88 
> Fax : +32 (0)65 84 66 76 
> Skype ID : gslongo.pro 
> GPG Key : gslongo-gpg_key.asc 
> 
> 
> - Please consider your environmental responsibility before 
> printing this e-mail - 
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 

-- 
To unsubscribe from this list go to the following URL and read the 
instructions: https://lists.samba.org/mailman/options/samba 




-- 


www.it-optics.com 

Gaëtan SLONGO | Head of Infrastructure Department 
Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
Company : +32 (0)65 84 23 85 
Direct : +32 (0)65 32 85 88 
Fax : +32 (0)65 84 66 76 
Skype ID : gslongo.pro 
GPG Key : gslongo-gpg_key.asc 



- Please consider your environmental responsibility before printing this e-mail
-















-- 
To unsubscribe from this list go to the following URL and read the 
instructions: https://lists.samba.org/mailman/options/samba 



-- 




www.it-optics.com 
	
Gaëtan SLONGO | Head of Infrastructure Department 
Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
Company : 	+32 (0)65 84 23 85 
Direct : 	+32 (0)65 32 85 88 
Fax : 	+32 (0)65 84 66 76 
Skype ID : 	gslongo.pro 
GPG Key : 	gslongo-gpg_key.asc 
	

- Please consider your environmental responsibility before printing this e-mail
-

L.P.H. van Belle

2018-May-31 10:47 UTC

head link

[Samba] Samba 4.8 RODC not working

Hai Gaetan, 
 
Can you post the output this this command : netstat -plaunt | egrep
"ntp|bind|named|samba|?mbd"
and iptables -S 
 
 
@Rowland, https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage 
might need a smal change.  test as followed
The wiki line:  netstat -tulpn | egrep "samba|smbd|nmbd|winbind"  
Now test my line and see the changes. this catches everything a DC might be
running.
netstat -plaunt | egrep "ntp|bind|named|samba|?mbd"
 
 
Greetz, 
 
Louis
 

Van: Gaetan SLONGO [mailto:gslongo at it-optics.com] 
Verzonden: donderdag 31 mei 2018 11:01
Aan: L.P.H. van Belle
CC: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4.8 RODC not working



Hi Louis ! 

Thank you for your time. OK I see.
But I checked, for testing I set an allow all rule,  which doesnt have any
effect :-/


Thanks ;-)

De: "L.P.H. van Belle via samba" <samba at lists.samba.org>
À: samba at lists.samba.org
Envoyé: Mercredi 30 Mai 2018 12:24:06
Objet : Re: [Samba] Samba 4.8 RODC not working

That are port you need : 
https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage  
from the site :  
*** The range matches the port range used by Windows Server 2008 and later. 
Samba versions before 4.7 used the TCP ports 1024 to 1300 instead. To manually
set the port range in Samba 4.7 and later,
set the rpc server port parameter in your smb.conf file. 
 
For details, see the parameter description in the smb.conf(5) man page. 
 
What i'll do, go lunching first, then i'll post my rule for ufw for my
member server, that is set to
Default: deny (incoming), deny (outgoing), disabled (routed)
if people want them. 

Greetz, 
 
Louis
 


 
 


Van: Gaetan SLONGO [mailto:gslongo at it-optics.com] 
Verzonden: woensdag 30 mei 2018 12:13
Aan: L.P.H. van Belle
CC: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4.8 RODC not working



Hi Louis ! 
Thanks for suggestion ! What are these ports ?


Thanks !

De: "L.P.H. van Belle via samba" <samba at lists.samba.org>
À: samba at lists.samba.org
Envoyé: Mardi 29 Mai 2018 17:08:21
Objet : Re: [Samba] Samba 4.8 RODC not working

I think you missed these in the firewall, if you allowed the "in" for
the DC, you also need the OUT.

 49152:65535/tcp ALLOW OUT  


Greetz, 

Louis

 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Gaetan SLONGO via samba
> Verzonden: dinsdag 29 mei 2018 16:40
> Aan: Rowland Penny
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] Samba 4.8 RODC not working
> 
> Hi Rowland, 
> 
> 
> As said into the reply sent to Andrew, Winbind is installed, 
> but not started by samba (this is sernet packages) 
> 
> 
> Thanks 
> 
> ----- Mail original -----
> 
> De: "Rowland Penny via samba" <samba at lists.samba.org> 
> À: samba at lists.samba.org 
> Envoyé: Jeudi 24 Mai 2018 20:48:22 
> Objet : Re: [Samba] Samba 4.8 RODC not working 
> 
> On Thu, 24 May 2018 11:30:40 +0200 (CEST) 
> Gaetan SLONGO via samba <samba at lists.samba.org> wrote: 
> 
> > Hi, 
> > 
> > 
> > 
> > 
> > It's my first try to setup RODC using Samba 4.8. We have 
> latest Samba 
> > 4.7 environnement with 2 DC and some file servers. Joining 
> the DC to 
> > the domain is OK using samba-tool domain join command. The domain 
> > controller appears in the DC list (MMC) 
> > 
> > 
> > However, users cannot be authenticated. Samba is running but these 
> > ports are closed : 
> > 
> > 
> > netbios-ssn 139/tcp # NETBIOS session service 
> > netbios-ssn 139/udp 
> > microsoft-ds 445/tcp 
> > microsoft-ds 445/udp 
> > 
> > Some other ports are available : 
> > 
> > 
> > 
> > [root at dmzrodc ~]# netstat -tlpn 
> > Connexions Internet actives (seulement serveurs) 
> > Proto Recv-Q Send-Q Adresse locale Adresse distante Etat 
> PID/Program 
> > name tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:49152 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49153 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:49154 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 23622/samba 
> > tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 23619/samba 
> > tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 23624/samba 
> > tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 23632/samba 
> > tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 23624/samba 
> > 
> > 
> > Winbind is not working : 
> > 
> > [root at dmzrodc ~]# wbinfo -u 
> > could not obtain winbind interface details: 
> > WBC_ERR_WINBIND_NOT_AVAILABLE could not obtain winbind domain name! 
> > Error looking up domain users 
> 
> Is winbind actually installed ?? 
> 
> Rowland 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the 
> instructions: https://lists.samba.org/mailman/options/samba 
> 
> 
> 
> -- 
> 
> 
> 
> 
> www.it-optics.com 
>         
> Gaëtan SLONGO | Head of Infrastructure Department 
> Boulevard Initialis, 28 - 7000 Mons, BELGIUM 
> Company :         +32 (0)65 84 23 85 
> Direct :         +32 (0)65 32 85 88 
> Fax :         +32 (0)65 84 66 76 
> Skype ID :         gslongo.pro 
> GPG Key :         gslongo-gpg_key.asc 
>         
> 
> - Please consider your environmental responsibility before 
> printing this e-mail - 
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba




-- 


www.it-optics.com 

        Gaëtan SLONGO | Head of Infrastructure Department
Boulevard Initialis, 28 - 7000 Mons, BELGIUM
Company :         +32 (0)65 84 23 85 
Direct :         +32 (0)65 32 85 88 
Fax :         +32 (0)65 84 66 76 
Skype ID :         gslongo.pro 
GPG Key :         gslongo-gpg_key.asc 

        

- Please consider your environmental responsibility before printing this e-mail
-















-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba




-- 


www.it-optics.com 

	Gaëtan SLONGO | Head of Infrastructure Department
Boulevard Initialis, 28 - 7000 Mons, BELGIUM
Company : 	+32 (0)65 84 23 85 
Direct : 	+32 (0)65 32 85 88 
Fax : 	+32 (0)65 84 66 76 
Skype ID : 	gslongo.pro 
GPG Key : 	gslongo-gpg_key.asc 

	

- Please consider your environmental responsibility before printing this e-mail
-

Reasonably Related Threads

Search for more seemingly similar threads

samba - May 2018 - Samba 4.8 RODC not working

[Samba] Samba 4.8 RODC not working

[Samba] Samba 4.8 RODC not working

[Samba] Samba 4.8 RODC not working

[Samba] Samba 4.8 RODC not working

[Samba] Samba 4.8 RODC not working

Reasonably Related Threads