samba - Aug 2019 - Problems joining station in domain

On 28/08/2019 19:51, Marcio Demetrio Bacci wrote:
> Hi,
>
> I am setting up Bind_DLZ on a new DC that isn't in the domain yet.
>
> I have followed Louis's guidelines for setting up Bind9_DLZ, but the 
> above files must be passed in the settings, however they do not exist 
> in my installation.
I see, as you haven't started bind9 yet, this doesn't matter, just 
create the bind conf files, join to the domain with 
'--dns-backend=BIND9_DLZ' and the required files will be created, you 
can start Bind9 now.
>
> After I join the new server as DC with Bind9_DLZ, I intend to migrate 
> from Samba Internal DNS Server to the BIND9_DLZ.
>
If you join as above, you will have migrated ;-)

Rowland

Hi,

When I restarted my DNS Bind I noticed that it isn't working, as follows:

/etc/init.d/bind9 status
? bind9.service - BIND Domain Name Server
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor
preset: enabled)
  Drop-In: /etc/systemd/system/bind9.service.d
           ??override.conf
   Active: failed (Result: exit-code) since Wed 2019-08-28 17:25:59 -03;
21min ago
     Docs: man:named(8)
  Process: 776 ExecStop=/usr/sbin/rndc stop (code=exited, status=1/FAILURE)
  Process: 752 ExecStart=/usr/sbin/named -f $OPTIONS (code=exited,
status=1/FAILURE)
 Main PID: 752 (code=exited, status=1/FAILURE)

ago 28 17:25:59 samba4-dc3 named[752]: using up to 4096 sockets
ago 28 17:25:59 samba4-dc3 named[752]: loading configuration from
'/etc/bind/named.conf'
ago 28 17:25:59 samba4-dc3 named[752]: /etc/bind/named.conf.local:12: open:
/var/lib/samba/private/named.conf: file not found
ago 28 17:25:59 samba4-dc3 named[752]: loading configuration: file not found
ago 28 17:25:59 samba4-dc3 named[752]: exiting (due to fatal error)
ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Main process exited,
code=exited, status=1/FAILURE
ago 28 17:25:59 samba4-dc3 rndc[776]: rndc: connect failed: 127.0.0.1#953:
connection refused
ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Control process
exited, code=exited status=1
ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Unit entered failed
state.
ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Failed with result
'exit-code'.

Should I join DC in the domain now, or I have to correct these issues
before?

Regards,

M?rcio Bacci

Em qua, 28 de ago de 2019 ?s 16:09, Rowland penny via samba <
samba at lists.samba.org> escreveu:
> On 28/08/2019 19:51, Marcio Demetrio Bacci wrote:
> > Hi,
> >
> > I am setting up Bind_DLZ on a new DC that isn't in the domain yet.
> >
> > I have followed Louis's guidelines for setting up Bind9_DLZ, but
the
> > above files must be passed in the settings, however they do not exist
> > in my installation.
> I see, as you haven't started bind9 yet, this doesn't matter, just
> create the bind conf files, join to the domain with
> '--dns-backend=BIND9_DLZ' and the required files will be created,
you
> can start Bind9 now.
> >
> > After I join the new server as DC with Bind9_DLZ, I intend to migrate
> > from Samba Internal DNS Server to the BIND9_DLZ.
> >
> If you join as above, you will have migrated ;-)
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Hai Marcio,

I looks like your now at to point you can try to join yes. 

Disable this line : /etc/bind/named.conf.local 
Now you are able to join.

I dont know the version your using now, but you can find the file named.conf 
After the join or here 
/var/lib/samba/bind-dns/
Or here
/var/lib/samba/private/


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Marcio Demetrio Bacci via samba
> Verzonden: woensdag 28 augustus 2019 22:58
> Aan: Rowland penny
> CC: sambalist
> Onderwerp: Re: [Samba] Problems joining station in domain
> 
> Hi,
> 
> When I restarted my DNS Bind I noticed that it isn't working, 
> as follows:
> 
> /etc/init.d/bind9 status
> ??? bind9.service - BIND Domain Name Server
>    Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor
> preset: enabled)
>   Drop-In: /etc/systemd/system/bind9.service.d
>            ??????override.conf
>    Active: failed (Result: exit-code) since Wed 2019-08-28 
> 17:25:59 -03;
> 21min ago
>      Docs: man:named(8)
>   Process: 776 ExecStop=/usr/sbin/rndc stop (code=exited, 
> status=1/FAILURE)
>   Process: 752 ExecStart=/usr/sbin/named -f $OPTIONS (code=exited,
> status=1/FAILURE)
>  Main PID: 752 (code=exited, status=1/FAILURE)
> 
> ago 28 17:25:59 samba4-dc3 named[752]: using up to 4096 sockets
> ago 28 17:25:59 samba4-dc3 named[752]: loading configuration from
> '/etc/bind/named.conf'
> ago 28 17:25:59 samba4-dc3 named[752]: 
> /etc/bind/named.conf.local:12: open:
> /var/lib/samba/private/named.conf: file not found
> ago 28 17:25:59 samba4-dc3 named[752]: loading configuration: 
> file not found
> ago 28 17:25:59 samba4-dc3 named[752]: exiting (due to fatal error)
> ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Main 
> process exited,
> code=exited, status=1/FAILURE
> ago 28 17:25:59 samba4-dc3 rndc[776]: rndc: connect failed: 
> 127.0.0.1#953:
> connection refused
> ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Control process
> exited, code=exited status=1
> ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Unit 
> entered failed
> state.
> ago 28 17:25:59 samba4-dc3 systemd[1]: bind9.service: Failed 
> with result
> 'exit-code'.
> 
> Should I join DC in the domain now, or I have to correct these issues
> before?
> 
> Regards,
> 
> M?rcio Bacci
> 
> Em qua, 28 de ago de 2019 ?s 16:09, Rowland penny via samba <
> samba at lists.samba.org> escreveu:
> 
> > On 28/08/2019 19:51, Marcio Demetrio Bacci wrote:
> > > Hi,
> > >
> > > I am setting up Bind_DLZ on a new DC that isn't in the domain
yet.
> > >
> > > I have followed Louis's guidelines for setting up 
> Bind9_DLZ, but the
> > > above files must be passed in the settings, however they 
> do not exist
> > > in my installation.
> > I see, as you haven't started bind9 yet, this doesn't matter,
just
> > create the bind conf files, join to the domain with
> > '--dns-backend=BIND9_DLZ' and the required files will be 
> created, you
> > can start Bind9 now.
> > >
> > > After I join the new server as DC with Bind9_DLZ, I 
> intend to migrate
> > > from Samba Internal DNS Server to the BIND9_DLZ.
> > >
> > If you join as above, you will have migrated ;-)
> >
> > Rowland
> >
> >
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On 28/08/2019 21:58, Marcio Demetrio Bacci wrote:
> Hi,
>
> When I restarted my DNS Bind I noticed that it isn't working, as
follows:
>
> /etc/init.d/bind9 status
> ? bind9.service - BIND Domain Name Server
> ? ?Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor 
> preset: enabled)
> ? Drop-In: /etc/systemd/system/bind9.service.d
> ? ? ? ? ? ???override.conf
> ? ?Active: failed (Result: exit-code) since Wed 2019-08-28 17:25:59 
> -03; 21min ago
> ? ? ?Docs: man:named(8)
> ? Process: 776 ExecStop=/usr/sbin/rndc stop (code=exited, 
> status=1/FAILURE)
> ? Process: 752 ExecStart=/usr/sbin/named -f $OPTIONS (code=exited, 
> status=1/FAILURE)
> ?Main PID: 752 (code=exited, status=1/FAILURE)
>
> ago 28 17:25:59 samba4-dc3 named[752]: using up to 4096 sockets
> ago 28 17:25:59 samba4-dc3 named[752]: loading configuration from 
> '/etc/bind/named.conf'
> ago 28 17:25:59 samba4-dc3 named[752]: /etc/bind/named.conf.local:12: 
> open: /var/lib/samba/private/named.conf: file not found
Excuse me, but what part of 'join the domain and then start Bind9' do 
you not understand ?

Of course the file doesn't exist, it is created by the join.

Rowland

Hi,

Attempting to join the domain Bind9_DLZ error occurred again.

root at samba4-dc3:~# samba-tool domain join empresa.com.br DC -k yes
--serversamba4-dc1.empresa.com.br --dns-backend=BIND9_DLZ --verbose -d3
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
INFO 2019-08-29 17:48:28,466 pid:1723
/usr/lib/python3/dist-packages/samba/join.py #1528: workgroup is EMPRESA
INFO 2019-08-29 17:48:28,467 pid:1723
/usr/lib/python3/dist-packages/samba/join.py #1531: realm is empresa.com.br
INFO 2019-08-29 17:48:33,068 pid:1723
/usr/lib/python3/dist-packages/samba/provision/__init__.py #1302:
Pre-loading the Samba 4 and AD schema
partition_metadata: Migrating partition metadata: open of metadata.tdb
gave: (null)
Unable to determine the DomainSID, can not enforce uniqueness constraint on
local domainSIDs

INFO 2019-08-29 17:48:33,258 pid:1723
/usr/lib/python3/dist-packages/samba/provision/__init__.py #2351: A
Kerberos configuration suitable for Samba AD has been generated at
/var/lib/samba/private/krb5.conf
INFO 2019-08-29 17:48:33,258 pid:1723
/usr/lib/python3/dist-packages/samba/provision/__init__.py #2352: Merge the
contents of this file with your system krb5.conf or replace it with this
one. Do not create a symlink!
Provision OK for domain DN DC=empresa,DC=com,DC=br
Starting replication
Using binding ncacn_ip_tcp:samba4-dc1.empresa.com.br[,seal]
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
########

Failed to commit objects: DOS code 0x000021bf
Missing target object - retrying with DRS_GET_TGT
#######

Replicated 402 objects (0 linked attributes) for
CN=Configuration,DC=empresa,DC=com,DC=br
Partition[CN=Configuration,DC=empresa,DC=com,DC=br] objects[2013/2013]
linked_values[46/0]
Missing target while attempting to apply records: Deleted target CN=NTDS
Settings\0ADEL:7bdcf175-407d-40ec-8c67-65c32e1deffc,CN=SAMBA4-DC3\0ADEL:328ea345-9eef-4902-8eb6-fe2868803170,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=empresa,DC=com,DC=br
GUID 7bdcf175-407d-40ec-8c67-65c32e1deffc linked from
CN=4a80917f-fd8f-414f-8964-997114a73df3,CN=Partitions,CN=Configuration,DC=empresa,DC=com,DC=br
#####################

Replicated 40 objects (0 linked attributes) for
DC=ForestDnsZones,DC=empresa,DC=com,DC=br
Exop on[CN=RID Manager$,CN=System,DC=empresa,DC=com,DC=br] objects[3]
linked_values[0]
Discarding older DRS attribute update to objectClass on CN=RID
Manager$,CN=System,DC=empresa,DC=com,DC=br from
032a8fdc-a9b8-425a-88c3-5125986fc59d
####################

Failed to commit objects: DOS code 0x000021bf
Missing target object - retrying with DRS_GET_TGT
#####################

Discarding older DRS linked attribute update to member on CN=Group Policy
Creator Owners,CN=Users,DC=empresa,DC=com,DC=br from
a20c8ed0-c72a-4e57-9e59-2236f127d0b8
Discarding older DRS linked attribute update to member on CN=Group Policy
Creator Owners,CN=Users,DC=empresa,DC=com,DC=br from
71c305c7-564f-44dc-bdc7-c03ee501bd52
Discarding older DRS linked attribute update to member on CN=Schema
Admins,CN=Users,DC=empresa,DC=com,DC=br from
a20c8ed0-c72a-4e57-9e59-2236f127d0b8
Discarding older DRS linked attribute update to member on CN=Schema
Admins,CN=Users,DC=empresa,DC=com,DC=br from
71c305c7-564f-44dc-bdc7-c03ee501bd52
Discarding older DRS linked attribute update to member on CN=Schema
Admins,CN=Users,DC=empresa,DC=com,DC=br from
71c305c7-564f-44dc-bdc7-c03ee501bd52
INFO 2019-08-29 17:48:54,310 pid:1723
/usr/lib/python3/dist-packages/samba/join.py #1106: Adding 1 remote DNS
records for SAMBA4-DC3.empresa.com.br
Using binding ncacn_ip_tcp:samba4-dc1.empresa.com.br[,sign]
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name
samba4-dc1.empresa.com.br<0x20>
INFO 2019-08-29 17:48:54,438 pid:1723
/usr/lib/python3/dist-packages/samba/join.py #1169: Adding DNS A record
SAMBA4-DC3.empresa.com.br for IPv4 IP: 192.168.1.19
INFO 2019-08-29 17:48:54,559 pid:1723
/usr/lib/python3/dist-packages/samba/join.py #1197: Adding DNS CNAME record
a005a39c-b5d8-466c-ab1f-45f7a37013f2._msdcs.empresa.com.br for
SAMBA4-DC3.empresa.com.br
Join failed - cleaning up
ldb_wrap open of secrets.ldb
Could not find machine account in secrets database: Failed to fetch machine
account password for EMPRESA from both secrets.ldb (Could not find entry to
match filter: '(&(flatname=EMPRESA)(objectclass=primaryDomain))'
base:
'cn=Primary Domains': No such object: dsdb_search at
../../source4/dsdb/common/util.c:4712) and from
/var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Deleted CN=RID Set,CN=SAMBA4-DC3,OU=Domain
Controllers,DC=empresa,DC=com,DC=br
Deleted CN=SAMBA4-DC3,OU=Domain Controllers,DC=empresa,DC=com,DC=br
Deleted CN=dns-SAMBA4-DC3,CN=Users,DC=empresa,DC=com,DC=br
Deleted CN=NTDS
Settings,CN=SAMBA4-DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=empresa,DC=com,DC=br
Deleted
CN=SAMBA4-DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=empresa,DC=com,DC=br
Deleted DC=SAMBA4-DC3,DC=empresa.com.br
,CN=MicrosoftDNS,DC=DomainDnsZones,DC=empresa,DC=com,DC=br
ERROR(runtime): uncaught exception - (9003,
'WERR_DNS_ERROR_RCODE_NAME_ERROR')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line
185,
in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/domain.py", line
700,
in run
    backend_store=backend_store)
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1544, in
join_DC
    ctx.do_join()
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1445, in
do_join
    ctx.join_add_dns_records()
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1213, in
join_add_dns_records
    dns_partition=forestdns_zone_dn)
  File "/usr/lib/python3/dist-packages/samba/samdb.py", line 1069, in
dns_lookup
    dns_partition=dns_partition)

Would it be better to try to upgrade production DCs first?

Regards,

M?rcio Bacci

Em qui, 29 de ago de 2019 ?s 06:29, Marcio Demetrio Bacci <
marciobacci at gmail.com> escreveu:
> Hi Rowland
>
> >Excuse me, but what part of 'join the domain and then start
Bind9' do
> >you not understand ?
>
> >Of course the file doesn't exist, it is created by the join.
>
> I have never worked with Bind DLZ, only with Internal, so I needed to make
> sure what I am doing, as my servers are in production and working at my
> organization's headquarters, with a network of 800 users.
>
> I will join the new DC in the domain, so get my office hour and give
> feedback to you.
>
> Regards,
>
> M?rcio Bacci
>
>
> Em qui, 29 de ago de 2019 ?s 04:51, Rowland penny via samba <
> samba at lists.samba.org> escreveu:
>
>> On 28/08/2019 21:58, Marcio Demetrio Bacci wrote:
>> > Hi,
>> >
>> > When I restarted my DNS Bind I noticed that it isn't working,
as
>> follows:
>> >
>> > /etc/init.d/bind9 status
>> > ? bind9.service - BIND Domain Name Server
>> >    Loaded: loaded (/lib/systemd/system/bind9.service; enabled;
vendor
>> > preset: enabled)
>> >   Drop-In: /etc/systemd/system/bind9.service.d
>> >            ??override.conf
>> >    Active: failed (Result: exit-code) since Wed 2019-08-28
17:25:59
>> > -03; 21min ago
>> >      Docs: man:named(8)
>> >   Process: 776 ExecStop=/usr/sbin/rndc stop (code=exited,
>> > status=1/FAILURE)
>> >   Process: 752 ExecStart=/usr/sbin/named -f $OPTIONS (code=exited,
>> > status=1/FAILURE)
>> >  Main PID: 752 (code=exited, status=1/FAILURE)
>> >
>> > ago 28 17:25:59 samba4-dc3 named[752]: using up to 4096 sockets
>> > ago 28 17:25:59 samba4-dc3 named[752]: loading configuration from
>> > '/etc/bind/named.conf'
>> > ago 28 17:25:59 samba4-dc3 named[752]:
/etc/bind/named.conf.local:12:
>> > open: /var/lib/samba/private/named.conf: file not found
>>
>> Excuse me, but what part of 'join the domain and then start
Bind9' do
>> you not understand ?
>>
>> Of course the file doesn't exist, it is created by the join.
>>
>> Rowland
>>
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
>