David Masshardt
2019-Nov-24 12:36 UTC
[Samba] Problems setting up samba bind9_dlz on Ubuntu 18.04
Hi, I hope someone can help me with the following problem. I followed the following guides to setup samba as an additional active directory server to my windows server with bind9 dns: https://www.tecmint.com/join-additio...r-replication/<https://www.tecmint.com/join-additional-ubuntu-dc-to-samba4-ad-dc-failover-replication/> https://wiki.samba.org/index.php/BIN...roubleshooting<https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End#Troubleshooting> The active directory replication works, but the dns replication does not. When I'm running "samba_dnsupdate --all-names" I get the following output: ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure update failed: REFUSED ; TSIG error with server: tsig verify failure update failed: REFUSED ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure ; TSIG error with server: tsig verify failure Failed update of 19 entries Here is a list of versions: Ubuntu: 18.04 Samba: 4.7.6-Ubuntu bind9: 9.11.3-1ubuntu1.11-Ubuntu And this is my smb.conf: [global] netbios name = DC01 realm = DOMAIN.COM server role = active directory domain controller workgroup = DOMAIN.COM dns forwarder = 172.17.1.1 idmap_ldb:use rfc2307 = yes template shell = /bin/bash winbind use default domain = true winbind offline logon = false winbind nss info = rfc2307 winbind enum users = yes winbind enum groups = yes server services = -dns [netlogon] path = /var/lib/samba/sysvol/domain.com/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No I'm not really sure if samba is even using bind9. I've enabled the logging of bind9, but I cannot see any logs when running the dns update. Did I miss a step to activate the bind9 module?
Rowland penny
2019-Nov-24 13:29 UTC
[Samba] Problems setting up samba bind9_dlz on Ubuntu 18.04
On 24/11/2019 12:36, David Masshardt via samba wrote:> Hi, > > I hope someone can help me with the following problem. I followed the following guides to setup samba as an additional active directory server to my windows server with bind9 dns: > > https://www.tecmint.com/join-additio...r-replication/<https://www.tecmint.com/join-additional-ubuntu-dc-to-samba4-ad-dc-failover-replication/>You shouldn't need to add the first DCs data to /etc/resolv.conf, if you do need to, then your dns is broken. What you should ensure is there, is the data for the DC you are joining. Sorry, but ntpdate is insufficient for time synchronisation between DCs, see here for more info: https://wiki.samba.org/index.php/Time_Synchronisation I would also install libpam-krb5 After the join, you need to copy the krb5.conf file created by the join to /etc/krb5.conf, do not symlink it. At this point, you also need to edit /etc/resolv.conf so that the DC now points to itself as the nameserver, instead of the first DC. You can add the first DC as a secondary nameserver, if you wish, but if the DC goes down, there isn't much point.> https://wiki.samba.org/index.php/BIN...roubleshooting<https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End#Troubleshooting> > > The active directory replication works, but the dns replication does not. When I'm running "samba_dnsupdate --all-names" I get the following output: > > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > update failed: REFUSED > ; TSIG error with server: tsig verify failure > update failed: REFUSED > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > ; TSIG error with server: tsig verify failure > Failed update of 19 entriesThis is probably because you are trying to change the second DCs info on the first DC with the wrong ticket> > Here is a list of versions: > > Ubuntu: 18.04 > Samba: 4.7.6-Ubuntu4.7.6 is EOL from Samba's point of view, you can get later versions here: http://apt.van-belle.nl/> bind9: 9.11.3-1ubuntu1.11-Ubuntu > > And this is my smb.conf: > > [global] > netbios name = DC01 > realm = DOMAIN.COM > server role = active directory domain controller > workgroup = DOMAIN.COMThe workgroup CANNOT be the same as the realm> dns forwarder = 172.17.1.1 > idmap_ldb:use rfc2307 = yes > > template shell = /bin/bash > winbind use default domain = trueThe line above does nothing on a DC> winbind offline logon = falseThe line above is a default setting and hence isn't required> winbind nss info = rfc2307The line above should only be used on a Unix domain member> winbind enum users = yes > winbind enum groups = yesThe lines above are not required, they only make 'getent passwd' & 'getent group' work without specifying a user or group name, but they also slow things down.> server services = -dns > > [netlogon] > path = /var/lib/samba/sysvol/domain.com/scripts > read only = No > > [sysvol] > path = /var/lib/samba/sysvol > read only = No > > I'm not really sure if samba is even using bind9. I've enabled the logging of bind9, but I cannot see any logs when running the dns update.No, you see any logs> > Did I miss a step to activate the bind9 module?Probably not, but it might help if you post the named.conf files in /etc/bind Rowland
David Masshardt
2019-Nov-24 15:28 UTC
[Samba] FW: Problems setting up samba bind9_dlz on Ubuntu 18.04
Hi,
thanks for the quick reply. I've now installed libpam-krb5 and copied the
krb5.conf to /etc instead of the symlink.
I've also installed the ntp service, but I'm still getting the same
errors in the dns replication.
The /etc/resolv.conf is managed by netplan under Ubuntu 18:
nameserver 127.0.0.53
options edns0
search domain.com
I've now changed the nameserver to localhost. This is the netplan yaml
config behind this:
network:
ethernets:
ens18:
addresses: ['172.17.2.1/16']
gateway4: 172.17.1.1
nameservers:
addresses: [127.0.0.1]
search: [domain.com]
version: 2
And this is the content of the /etc/bind/named.conf:
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/var/lib/samba/private/named.conf";
Any other ideas what could cause this problem?
Regards
David
Am 24.11.19, 14:31 schrieb "samba im Auftrag von Rowland penny via
samba" <samba-bounces at lists.samba.org im Auftrag von samba at
lists.samba.org>:
On 24/11/2019 12:36, David Masshardt via samba wrote:
> Hi,
>
> I hope someone can help me with the following problem. I followed the
following guides to setup samba as an additional active directory server to my
windows server with bind9 dns:
>
>
https://www.tecmint.com/join-additio...r-replication/<https://www.tecmint.com/join-additional-ubuntu-dc-to-samba4-ad-dc-failover-replication/>
You shouldn't need to add the first DCs data to /etc/resolv.conf, if you
do need to, then your dns is broken. What you should ensure is there, is
the data for the DC you are joining.
Sorry, but ntpdate is insufficient for time synchronisation between DCs,
see here for more info:
https://wiki.samba.org/index.php/Time_Synchronisation
I would also install libpam-krb5
After the join, you need to copy the krb5.conf file created by the join
to /etc/krb5.conf, do not symlink it.
At this point, you also need to edit /etc/resolv.conf so that the DC now
points to itself as the nameserver, instead of the first DC. You can add
the first DC as a secondary nameserver, if you wish, but if the DC goes
down, there isn't much point.
>
https://wiki.samba.org/index.php/BIN...roubleshooting<https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End#Troubleshooting>
>
> The active directory replication works, but the dns replication does
not. When I'm running "samba_dnsupdate --all-names" I get the
following output:
>
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> update failed: REFUSED
> ; TSIG error with server: tsig verify failure
> update failed: REFUSED
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> ; TSIG error with server: tsig verify failure
> Failed update of 19 entries
This is probably because you are trying to change the second DCs info on
the first DC with the wrong ticket
>
> Here is a list of versions:
>
> Ubuntu: 18.04
> Samba: 4.7.6-Ubuntu
4.7.6 is EOL from Samba's point of view, you can get later versions
here: http://apt.van-belle.nl/
> bind9: 9.11.3-1ubuntu1.11-Ubuntu
>
> And this is my smb.conf:
>
> [global]
> netbios name = DC01
> realm = DOMAIN.COM
> server role = active directory domain controller
> workgroup = DOMAIN.COM
The workgroup CANNOT be the same as the realm
> dns forwarder = 172.17.1.1
> idmap_ldb:use rfc2307 = yes
>
> template shell = /bin/bash
> winbind use default domain = true
The line above does nothing on a DC
> winbind offline logon = false
The line above is a default setting and hence isn't required
> winbind nss info = rfc2307
The line above should only be used on a Unix domain member
> winbind enum users = yes
> winbind enum groups = yes
The lines above are not required, they only make 'getent passwd'
&
'getent group' work without specifying a user or group name, but
they
also slow things down.
> server services = -dns
>
> [netlogon]
> path = /var/lib/samba/sysvol/domain.com/scripts
> read only = No
>
> [sysvol]
> path = /var/lib/samba/sysvol
> read only = No
>
> I'm not really sure if samba is even using bind9. I've enabled
the logging of bind9, but I cannot see any logs when running the dns update.
No, you see any logs
>
> Did I miss a step to activate the bind9 module?
Probably not, but it might help if you post the named.conf files in
/etc/bind
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Rowland penny
2019-Nov-24 15:33 UTC
[Samba] Problems setting up samba bind9_dlz on Ubuntu 18.04
On 24/11/2019 14:53, David Masshardt wrote:> Hi, > > thanks for the quick reply. I've now installed libpam-krb5 and copied the krb5.conf to /etc instead of the symlink. > > I've also installed the ntp service, but I'm still getting the same errors in the dns replication. > > The /etc/resolv.conf is managed by netplan under Ubuntu 18:Perhaps I should have said that Samba has to be authoritative for the dns domain, so you really do not need anything else controlling anything to do with dns. I tested joining a Ubuntu DC to a domain and I had to do this: apt install ifupdown apt purge nplan Edit /etc/network/interfaces # The loopback network interface auto lo iface lo inet loopback auto enp0s3 iface enp0s3 inet static ??????? address 192.168.0.243 <-- replace this with your DCS IP ??????? netmask 255.255.255.0 ??????? gateway 192.168.0.1 <-- replace this with your gateways IP Replace 'enp0s3' with your interface name. service systemd-resolved stop systemctl disable systemd-resolved.service rm -f /etc/resolv.conf create new /etc/resolv.conf search domain.com nameserver 192.168.0.243 <-- replace this with your DCS IP edit /etc/hosts 127.0.0.1?????? localhost ::1???????????? localhost6 192.168.0.243? ubutestdc.domain.com ubutestdc <-- replace this with your DCS data # The following lines are desirable for IPv6 capable hosts ::1???? localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts reboot> > nameserver 127.0.0.53 > options edns0 > search domain.com > > I've now changed the nameserver to localhost. This is the netplan yaml config behind this:The 'nameserver' should be the DCs IP, see above> > network: > ethernets: > ens18: > addresses: ['172.17.2.1/16'] > gateway4: 172.17.1.1 > nameservers: > addresses: [127.0.0.1] > search: [domain.com] > version: 2 > > And this is the content of the /etc/bind/named.conf: > > include "/etc/bind/named.conf.options"; > include "/etc/bind/named.conf.local"; > include "/etc/bind/named.conf.default-zones"; > include "/var/lib/samba/private/named.conf";I actually wanted to see the contents of the files, especially 'named.conf.options' & 'named.conf.local' Rowland
David Masshardt
2019-Nov-24 16:17 UTC
[Samba] Problems setting up samba bind9_dlz on Ubuntu 18.04
Hi,
I guess this solved the problem! I now get no errors when replicating the dns. I
also created a test entry on my windows server and it was replicated to the
linux server.
I will now test if everything still works when the windows server is shutdown.
Thanks again for the quick help!
Regards
David
?Am 24.11.19, 16:36 schrieb "samba im Auftrag von Rowland penny via
samba" <samba-bounces at lists.samba.org im Auftrag von samba at
lists.samba.org>:
On 24/11/2019 14:53, David Masshardt wrote:
> Hi,
>
> thanks for the quick reply. I've now installed libpam-krb5 and
copied the krb5.conf to /etc instead of the symlink.
>
> I've also installed the ntp service, but I'm still getting the
same errors in the dns replication.
>
> The /etc/resolv.conf is managed by netplan under Ubuntu 18:
Perhaps I should have said that Samba has to be authoritative for the
dns domain, so you really do not need anything else controlling anything
to do with dns.
I tested joining a Ubuntu DC to a domain and I had to do this:
apt install ifupdown
apt purge nplan
Edit /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback
auto enp0s3
iface enp0s3 inet static
address 192.168.0.243 <-- replace this with your DCS IP
netmask 255.255.255.0
gateway 192.168.0.1 <-- replace this with your gateways IP
Replace 'enp0s3' with your interface name.
service systemd-resolved stop
systemctl disable systemd-resolved.service
rm -f /etc/resolv.conf
create new /etc/resolv.conf
search domain.com
nameserver 192.168.0.243 <-- replace this with your DCS IP
edit /etc/hosts
127.0.0.1 localhost
::1 localhost6
192.168.0.243 ubutestdc.domain.com ubutestdc <-- replace this with your
DCS data
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
reboot
>
> nameserver 127.0.0.53
> options edns0
> search domain.com
>
> I've now changed the nameserver to localhost. This is the netplan
yaml config behind this:
The 'nameserver' should be the DCs IP, see above
>
> network:
> ethernets:
> ens18:
> addresses: ['172.17.2.1/16']
> gateway4: 172.17.1.1
> nameservers:
> addresses: [127.0.0.1]
> search: [domain.com]
> version: 2
>
> And this is the content of the /etc/bind/named.conf:
>
> include "/etc/bind/named.conf.options";
> include "/etc/bind/named.conf.local";
> include "/etc/bind/named.conf.default-zones";
> include "/var/lib/samba/private/named.conf";
I actually wanted to see the contents of the files, especially
'named.conf.options' & 'named.conf.local'
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba