thr3ads.net - samba - [Samba] Internal DNS migrate to Bind9

If this information is useful, please help other people find it:
Share via:

Eben Victor

2018-Jul-30 13:42 UTC

[Samba] Internal DNS migrate to Bind9_DLZ

Hello Rowland,

selinux has been disabled, I also ran th follow

# systemctl stop sernet-samba-ad
# samba_upgradedns --dns-backend=BIND9_DLZ
# named -d3 -f -g -u named

Which then still fails, see below smb.conf

[global]
        workgroup = DOMAIN
        realm = DOMAIN.CORP
        netbios name = PDC
        server role = active directory domain controller
        idmap_ldb:use rfc2307 = yes
        idmap config * : range = 3000-7999
        winbind offline logon = Yes
        guest account = nobody
        restrict anonymous = 1
        winbind max clients = 2000
        log level = 2
        ldap server require strong auth = no
        ntlm auth = mschapv2-and-ntlmv2-only
        template homedir = /home/%D/%U
        template shell = /bin/bash
        interfaces = lo ens192
        bind interfaces only = yes
       server services = -dns
        max xmit = 65535
        dead time = 15

# Disable printer share
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes

# Enable domain TLS
        tls enabled  = yes
        tls keyfile  = tls/key.pem
        tls certfile = tls/cert.pem
        tls cafile   = tls/ca.pem

[netlogon]
        path = /var/lib/samba/sysvol/domain.corp/scripts
        read only = Yes

[sysvol]
        path = /var/lib/samba/sysvol
        read only = Yes


On Mon, Jul 30, 2018 at 11:43 AM Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Mon, 30 Jul 2018 11:25:11 +0200
> Eben Victor <eben.victor at gmail.com> wrote:
>
> > Yes I have added "server services = -dns"  to my smb.conf
file and
> > also removed "dns forwarder ="
> > I've done the same setup but on Samba 4.7.7, RHEL6, named 9.8 and
this
> > works perfect.
> >
>
> OK, but have you run 'samba_upgradedns' ?
>
> If you have, then all that seems to be left is selinux, is this getting
> in the way ?
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

-- 
Eben Victor
Cell:  +27 82 759 5266
Email: eben.victor at gmail.com

Christian Naumer

2018-Jul-30 13:50 UTC

head link

[Samba] Internal DNS migrate to Bind9_DLZ

Is the file (/var/lib/samba/bind-dns/named.conf)  and the directory
readable by named?

We also have the packages vom Sernet and after a fresh install named is
not able to read the file.

Regards

Christian



Am 30.07.2018 um 15:42 schrieb Eben Victor via samba:> Hello Rowland,
> 
> selinux has been disabled, I also ran th follow
> 
> # systemctl stop sernet-samba-ad
> # samba_upgradedns --dns-backend=BIND9_DLZ
> # named -d3 -f -g -u named
> 
> Which then still fails, see below smb.conf
> 
> [global]
>         workgroup = DOMAIN
>         realm = DOMAIN.CORP
>         netbios name = PDC
>         server role = active directory domain controller
>         idmap_ldb:use rfc2307 = yes
>         idmap config * : range = 3000-7999
>         winbind offline logon = Yes
>         guest account = nobody
>         restrict anonymous = 1
>         winbind max clients = 2000
>         log level = 2
>         ldap server require strong auth = no
>         ntlm auth = mschapv2-and-ntlmv2-only
>         template homedir = /home/%D/%U
>         template shell = /bin/bash
>         interfaces = lo ens192
>         bind interfaces only = yes
>        server services = -dns
>         max xmit = 65535
>         dead time = 15
> 
> # Disable printer share
>         load printers = No
>         printcap name = /dev/null
>         disable spoolss = Yes
> 
> # Enable domain TLS
>         tls enabled  = yes
>         tls keyfile  = tls/key.pem
>         tls certfile = tls/cert.pem
>         tls cafile   = tls/ca.pem
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/domain.corp/scripts
>         read only = Yes
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = Yes
> 
> 
> On Mon, Jul 30, 2018 at 11:43 AM Rowland Penny via samba <
> samba at lists.samba.org> wrote:
> 
>> On Mon, 30 Jul 2018 11:25:11 +0200
>> Eben Victor <eben.victor at gmail.com> wrote:
>>
>>> Yes I have added "server services = -dns"  to my smb.conf
file and
>>> also removed "dns forwarder ="
>>> I've done the same setup but on Samba 4.7.7, RHEL6, named 9.8
and this
>>> works perfect.
>>>
>>
>> OK, but have you run 'samba_upgradedns' ?
>>
>> If you have, then all that seems to be left is selinux, is this getting
>> in the way ?
>>
>> Rowland
>>
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
> 
> 
-- 
Dr. Christian Naumer
Research Scientist
Plattform-Koordinator Bioprozesstechnik

B.R.A.I.N Aktiengesellschaft
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.de, homepage www.brain-biotech.de
fon +49-6251-9331-30  /   fax +49-6251-9331-11

Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Dr. Juergen Eck (Vorsitzender), Frank Goebel
Aufsichtsratsvorsitzender: Dr. Ludger Mueller

Rowland Penny

2018-Jul-30 14:15 UTC

head link

[Samba] Internal DNS migrate to Bind9_DLZ

On Mon, 30 Jul 2018 15:42:45 +0200
Eben Victor <eben.victor at gmail.com> wrote:
> Hello Rowland,
> 
> selinux has been disabled, I also ran th follow
> 
> # systemctl stop sernet-samba-ad
> # samba_upgradedns --dns-backend=BIND9_DLZ
> # named -d3 -f -g -u named
> 
> Which then still fails, see below smb.conf
> 
> [global]
>         workgroup = DOMAIN
>         realm = DOMAIN.CORP
>         netbios name = PDC
>         server role = active directory domain controller
>         idmap_ldb:use rfc2307 = yes
>         idmap config * : range = 3000-7999
>         winbind offline logon = Yes
>         guest account = nobody
>         restrict anonymous = 1
>         winbind max clients = 2000
>         log level = 2
>         ldap server require strong auth = no
>         ntlm auth = mschapv2-and-ntlmv2-only
>         template homedir = /home/%D/%U
>         template shell = /bin/bash
>         interfaces = lo ens192
>         bind interfaces only = yes
>        server services = -dns
>         max xmit = 65535
>         dead time = 15
> 
> # Disable printer share
>         load printers = No
>         printcap name = /dev/null
>         disable spoolss = Yes
> 
> # Enable domain TLS
>         tls enabled  = yes
>         tls keyfile  = tls/key.pem
>         tls certfile = tls/cert.pem
>         tls cafile   = tls/ca.pem
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/domain.corp/scripts
>         read only = Yes
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = Yes
>
Before I comment, can I ask a general question ?

Does anybody read the Samba wiki and/or man smb.conf ????

If I remove all the default options and lines that shouldn't be there
(as in 'winbind offline logon = Yes', really, on a DC ?), I get this:

[global]
        workgroup = DOMAIN
        realm = DOMAIN.CORP
        netbios name = PDC
        server role = active directory domain controller
        idmap_ldb:use rfc2307 = yes
        log level = 2
        ldap server require strong auth = no
        ntlm auth = mschapv2-and-ntlmv2-only
        template shell = /bin/bash
        interfaces = lo ens192
        bind interfaces only = yes
        server services = -dns

# Disable printer share
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes

[netlogon]
        path = /var/lib/samba/sysvol/domain.corp/scripts
        read only = Yes

[sysvol]
        path = /var/lib/samba/sysvol
        read only = Yes

However, even with the smb.conf that is in use, there doesn't seem to
be any reason why it isn't working. The only other thing I can think of
is, what version of ldb is installed ?

Rowland

L.P.H. van Belle

2018-Jul-30 15:12 UTC

head link

[Samba] Internal DNS migrate to Bind9_DLZ

> > > 30-Jul-2018 10:26:40.027 samba_dlz: starting configure
> > > 30-Jul-2018 10:26:40.049 dns_rdata_fromtext:
buffer-0x7facd1f60dc0:1:
> > > near eof: unexpected end of input
> > > 30-Jul-2018 10:26:40.049 Failed to put rr
> > > 30-Jul-2018 10:26:40.269 zone domain.corp/NONE: has 0 SOA records
> > > 30-Jul-2018 10:26:40.269 zone domain.corp/NONE: has no NS records
> > > 30-Jul-2018 10:26:40.270 samba_dlz: Failed to configure zone
> > > 'domain.corp' 30-Jul-2018 10:26:40.270 loading
configuration: bad zone
> > > 30-Jul-2018 10:26:40.270 exiting (due to fatal error)

I've seen this before, but long ago. 
What is happening here is that for some reason, domain.corp is loaded ( and as
said, this not the primary domain )
But its loaded before the primary domain and that causes the crash. 

Check the search or domain order of resolv.conf, and make sure your primary
domain is set first.
If thats already the case. 

It is fixable, but pff, i cant remember how i fixed that. 

Main couse.
Your.domain.tld ( primary )
You created the alias, err. 

Beter is. 
Your.domain.tld ( primary )
Extra zone: domain.tld 
And alais the hosts not the domain. 

If i can recall more tonight, i'll post that tomorrow. 


Greetz, 

Louis



> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: maandag 30 juli 2018 16:15
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Internal DNS migrate to Bind9_DLZ
> 
> On Mon, 30 Jul 2018 15:42:45 +0200
> Eben Victor <eben.victor at gmail.com> wrote:
> 
> > Hello Rowland,
> > 
> > selinux has been disabled, I also ran th follow
> > 
> > # systemctl stop sernet-samba-ad
> > # samba_upgradedns --dns-backend=BIND9_DLZ
> > # named -d3 -f -g -u named
> > 
> > Which then still fails, see below smb.conf
> > 
> > [global]
> >         workgroup = DOMAIN
> >         realm = DOMAIN.CORP
> >         netbios name = PDC
> >         server role = active directory domain controller
> >         idmap_ldb:use rfc2307 = yes
> >         idmap config * : range = 3000-7999
> >         winbind offline logon = Yes
> >         guest account = nobody
> >         restrict anonymous = 1
> >         winbind max clients = 2000
> >         log level = 2
> >         ldap server require strong auth = no
> >         ntlm auth = mschapv2-and-ntlmv2-only
> >         template homedir = /home/%D/%U
> >         template shell = /bin/bash
> >         interfaces = lo ens192
> >         bind interfaces only = yes
> >        server services = -dns
> >         max xmit = 65535
> >         dead time = 15
> > 
> > # Disable printer share
> >         load printers = No
> >         printcap name = /dev/null
> >         disable spoolss = Yes
> > 
> > # Enable domain TLS
> >         tls enabled  = yes
> >         tls keyfile  = tls/key.pem
> >         tls certfile = tls/cert.pem
> >         tls cafile   = tls/ca.pem
> > 
> > [netlogon]
> >         path = /var/lib/samba/sysvol/domain.corp/scripts
> >         read only = Yes
> > 
> > [sysvol]
> >         path = /var/lib/samba/sysvol
> >         read only = Yes
> >
> 
> Before I comment, can I ask a general question ?
> 
> Does anybody read the Samba wiki and/or man smb.conf ????
> 
> If I remove all the default options and lines that shouldn't be there
> (as in 'winbind offline logon = Yes', really, on a DC ?), I get
this:
> 
> [global]
>         workgroup = DOMAIN
>         realm = DOMAIN.CORP
>         netbios name = PDC
>         server role = active directory domain controller
>         idmap_ldb:use rfc2307 = yes
>         log level = 2
>         ldap server require strong auth = no
>         ntlm auth = mschapv2-and-ntlmv2-only
>         template shell = /bin/bash
>         interfaces = lo ens192
>         bind interfaces only = yes
>         server services = -dns
> 
> # Disable printer share
>         load printers = No
>         printcap name = /dev/null
>         disable spoolss = Yes
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/domain.corp/scripts
>         read only = Yes
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = Yes
> 
> However, even with the smb.conf that is in use, there doesn't seem to
> be any reason why it isn't working. The only other thing I 
> can think of
> is, what version of ldb is installed ?
> 
> Rowland
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Eben Victor

2018-Jul-30 20:46 UTC

head link

[Samba] Internal DNS migrate to Bind9_DLZ

Hello Louis,

My search order is correct, I have even tried shifting around and it's
still failing with the same errors.

Kind Regards

On Mon, Jul 30, 2018 at 5:13 PM L.P.H. van Belle via samba <
samba at lists.samba.org> wrote:
> > > > 30-Jul-2018 10:26:40.027 samba_dlz: starting configure
> > > > 30-Jul-2018 10:26:40.049 dns_rdata_fromtext:
buffer-0x7facd1f60dc0:1:
> > > > near eof: unexpected end of input
> > > > 30-Jul-2018 10:26:40.049 Failed to put rr
> > > > 30-Jul-2018 10:26:40.269 zone domain.corp/NONE: has 0 SOA
records
> > > > 30-Jul-2018 10:26:40.269 zone domain.corp/NONE: has no NS
records
> > > > 30-Jul-2018 10:26:40.270 samba_dlz: Failed to configure zone
> > > > 'domain.corp' 30-Jul-2018 10:26:40.270 loading
configuration: bad
> zone
> > > > 30-Jul-2018 10:26:40.270 exiting (due to fatal error)
>
>
> I've seen this before, but long ago.
> What is happening here is that for some reason, domain.corp is loaded (
> and as said, this not the primary domain )
> But its loaded before the primary domain and that causes the crash.
>
> Check the search or domain order of resolv.conf, and make sure your
> primary domain is set first.
> If thats already the case.
>
> It is fixable, but pff, i cant remember how i fixed that.
>
> Main couse.
> Your.domain.tld ( primary )
> You created the alias, err.
>
> Beter is.
> Your.domain.tld ( primary )
> Extra zone: domain.tld
> And alais the hosts not the domain.
>
> If i can recall more tonight, i'll post that tomorrow.
>
>
> Greetz,
>
> Louis
>
>
>
>
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens
> > Rowland Penny via samba
> > Verzonden: maandag 30 juli 2018 16:15
> > Aan: samba at lists.samba.org
> > Onderwerp: Re: [Samba] Internal DNS migrate to Bind9_DLZ
> >
> > On Mon, 30 Jul 2018 15:42:45 +0200
> > Eben Victor <eben.victor at gmail.com> wrote:
> >
> > > Hello Rowland,
> > >
> > > selinux has been disabled, I also ran th follow
> > >
> > > # systemctl stop sernet-samba-ad
> > > # samba_upgradedns --dns-backend=BIND9_DLZ
> > > # named -d3 -f -g -u named
> > >
> > > Which then still fails, see below smb.conf
> > >
> > > [global]
> > >         workgroup = DOMAIN
> > >         realm = DOMAIN.CORP
> > >         netbios name = PDC
> > >         server role = active directory domain controller
> > >         idmap_ldb:use rfc2307 = yes
> > >         idmap config * : range = 3000-7999
> > >         winbind offline logon = Yes
> > >         guest account = nobody
> > >         restrict anonymous = 1
> > >         winbind max clients = 2000
> > >         log level = 2
> > >         ldap server require strong auth = no
> > >         ntlm auth = mschapv2-and-ntlmv2-only
> > >         template homedir = /home/%D/%U
> > >         template shell = /bin/bash
> > >         interfaces = lo ens192
> > >         bind interfaces only = yes
> > >        server services = -dns
> > >         max xmit = 65535
> > >         dead time = 15
> > >
> > > # Disable printer share
> > >         load printers = No
> > >         printcap name = /dev/null
> > >         disable spoolss = Yes
> > >
> > > # Enable domain TLS
> > >         tls enabled  = yes
> > >         tls keyfile  = tls/key.pem
> > >         tls certfile = tls/cert.pem
> > >         tls cafile   = tls/ca.pem
> > >
> > > [netlogon]
> > >         path = /var/lib/samba/sysvol/domain.corp/scripts
> > >         read only = Yes
> > >
> > > [sysvol]
> > >         path = /var/lib/samba/sysvol
> > >         read only = Yes
> > >
> >
> > Before I comment, can I ask a general question ?
> >
> > Does anybody read the Samba wiki and/or man smb.conf ????
> >
> > If I remove all the default options and lines that shouldn't be
there
> > (as in 'winbind offline logon = Yes', really, on a DC ?), I
get this:
> >
> > [global]
> >         workgroup = DOMAIN
> >         realm = DOMAIN.CORP
> >         netbios name = PDC
> >         server role = active directory domain controller
> >         idmap_ldb:use rfc2307 = yes
> >         log level = 2
> >         ldap server require strong auth = no
> >         ntlm auth = mschapv2-and-ntlmv2-only
> >         template shell = /bin/bash
> >         interfaces = lo ens192
> >         bind interfaces only = yes
> >         server services = -dns
> >
> > # Disable printer share
> >         load printers = No
> >         printcap name = /dev/null
> >         disable spoolss = Yes
> >
> > [netlogon]
> >         path = /var/lib/samba/sysvol/domain.corp/scripts
> >         read only = Yes
> >
> > [sysvol]
> >         path = /var/lib/samba/sysvol
> >         read only = Yes
> >
> > However, even with the smb.conf that is in use, there doesn't seem
to
> > be any reason why it isn't working. The only other thing I
> > can think of
> > is, what version of ldb is installed ?
> >
> > Rowland
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
> >
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

-- 
Eben Victor
Cell:  +27 82 759 5266
Email: eben.victor at gmail.com

Eben Victor

2018-Jul-30 20:50 UTC

head link

[Samba] Internal DNS migrate to Bind9_DLZ

Hello Rowland,

Please see below installed samba packages.

# rpm -qa | grep samba
sernet-samba-client-4.8.3-11.el7.x86_64
sernet-samba-common-4.8.3-11.el7.x86_64
sernet-samba-libsmbclient0-4.8.3-11.el7.x86_64
sernet-samba-4.8.3-11.el7.x86_64
sernet-samba-ad-4.8.3-11.el7.x86_64
sernet-samba-libs-4.8.3-11.el7.x86_64
sernet-samba-winbind-4.8.3-11.el7.x86_64

ldb is installed with the samba packages.

Kind Regards

On Mon, Jul 30, 2018 at 4:16 PM Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Mon, 30 Jul 2018 15:42:45 +0200
> Eben Victor <eben.victor at gmail.com> wrote:
>
> > Hello Rowland,
> >
> > selinux has been disabled, I also ran th follow
> >
> > # systemctl stop sernet-samba-ad
> > # samba_upgradedns --dns-backend=BIND9_DLZ
> > # named -d3 -f -g -u named
> >
> > Which then still fails, see below smb.conf
> >
> > [global]
> >         workgroup = DOMAIN
> >         realm = DOMAIN.CORP
> >         netbios name = PDC
> >         server role = active directory domain controller
> >         idmap_ldb:use rfc2307 = yes
> >         idmap config * : range = 3000-7999
> >         winbind offline logon = Yes
> >         guest account = nobody
> >         restrict anonymous = 1
> >         winbind max clients = 2000
> >         log level = 2
> >         ldap server require strong auth = no
> >         ntlm auth = mschapv2-and-ntlmv2-only
> >         template homedir = /home/%D/%U
> >         template shell = /bin/bash
> >         interfaces = lo ens192
> >         bind interfaces only = yes
> >        server services = -dns
> >         max xmit = 65535
> >         dead time = 15
> >
> > # Disable printer share
> >         load printers = No
> >         printcap name = /dev/null
> >         disable spoolss = Yes
> >
> > # Enable domain TLS
> >         tls enabled  = yes
> >         tls keyfile  = tls/key.pem
> >         tls certfile = tls/cert.pem
> >         tls cafile   = tls/ca.pem
> >
> > [netlogon]
> >         path = /var/lib/samba/sysvol/domain.corp/scripts
> >         read only = Yes
> >
> > [sysvol]
> >         path = /var/lib/samba/sysvol
> >         read only = Yes
> >
>
> Before I comment, can I ask a general question ?
>
> Does anybody read the Samba wiki and/or man smb.conf ????
>
> If I remove all the default options and lines that shouldn't be there
> (as in 'winbind offline logon = Yes', really, on a DC ?), I get
this:
>
> [global]
>         workgroup = DOMAIN
>         realm = DOMAIN.CORP
>         netbios name = PDC
>         server role = active directory domain controller
>         idmap_ldb:use rfc2307 = yes
>         log level = 2
>         ldap server require strong auth = no
>         ntlm auth = mschapv2-and-ntlmv2-only
>         template shell = /bin/bash
>         interfaces = lo ens192
>         bind interfaces only = yes
>         server services = -dns
>
> # Disable printer share
>         load printers = No
>         printcap name = /dev/null
>         disable spoolss = Yes
>
> [netlogon]
>         path = /var/lib/samba/sysvol/domain.corp/scripts
>         read only = Yes
>
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = Yes
>
> However, even with the smb.conf that is in use, there doesn't seem to
> be any reason why it isn't working. The only other thing I can think of
> is, what version of ldb is installed ?
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

-- 
Eben Victor
Cell:  +27 82 759 5266
Email: eben.victor at gmail.com

Maybe Matching Threads

Search for more maybe matching threads

samba - Jul 2018 - Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

[Samba] Internal DNS migrate to Bind9_DLZ

Maybe Matching Threads