samba - Oct 2021 - Unable to join domain

On 10/12/21 04:27, Rowland Penny via samba wrote:
> On Tue, 2021-10-12 at 11:14 +0200, L.P.H. van Belle via samba wrote:
>> Ow yes, this can work fine.
>>   
>> AD-DC, time is given to the pc's over the AD. (not NTP directly)..
>> sure you can configure that, but i didnt.
>>
>> Members, systemd-timedated used the AD-DC its NTP to sync.
>> Standalones ( i have 1, ) same.
>>
>> The members dont need SNTP to sync time, only the AD-DC <=>
Windows
>> And you can even overrule that, but im not doing that.
>>
>> timedatectl show-timesync
>> SystemNTPServers="192.168.1.1 192.168.1.2"
>>
> 
> I repeat, your clients are not using the DC's directly for time, you
> might be okay with this, but I am not, but hey, they are your clients :
> -)
> 
I'm not sure why this matters if the drift is less than the allowable 
kerberos time difference.  But in Louis's case, he appears to have 
configured systemd-timedated to use his DC as the time/date authority:


  $ timedatectl show-timesync
  SystemNTPServers="192.168.1.1 192.168.1.2"


I'm guessing 192.168.1.1 and 192.168.1.2 are his DC's.

Not sure why the output looks different, though.  On my workstation when 
I run 	`timedatectl show-timesync` I get:


[pgoetz at frog ~]$ timedatectl show-timesync
FallbackNTPServers=0.arch.pool.ntp.org 1.arch.pool.ntp.org 
2.arch.pool.ntp.org 3.arch.pool.ntp.org
ServerName=0.arch.pool.ntp.org
ServerAddress=192.48.105.15
RootDistanceMaxUSec=5s
PollIntervalMinUSec=32s
PollIntervalMaxUSec=34min 8s
PollIntervalUSec=34min 8s
NTPMessage={ Leap=0, Version=4, Mode=4, Stratum=2, Precision=-24, 
RootDelay=28.228ms, RootDispersion=33.508ms, Reference=81060F1D, 
OriginateTimestamp=Tue 2021-10-12 09:15:52 CDT, ReceiveTimestamp=Tue 
2021-10-12 09:15:52 CDT, TransmitTimestamp=Tue 2021-10-12 09:15:52 CDT, 
DestinationTimestamp=Tue 2021-10-12 09:15:52 CDT, Ignored=no 
PacketCount=507, Jitter=2.230ms }
Frequency=-1595833




> Rowland
> 
> 
>

On Tue, 2021-10-12 at 09:42 -0500, Patrick Goetz via samba
wrote:
> 
> On 10/12/21 04:27, Rowland Penny via samba wrote:
> > On Tue, 2021-10-12 at 11:14 +0200, L.P.H. van Belle via samba
> > wrote:
> > > Ow yes, this can work fine.
> > >   
> > > AD-DC, time is given to the pc's over the AD. (not NTP
> > > directly)..
> > > sure you can configure that, but i didnt.
> > > 
> > > Members, systemd-timedated used the AD-DC its NTP to sync.
> > > Standalones ( i have 1, ) same.
> > > 
> > > The members dont need SNTP to sync time, only the AD-DC <=>
> > > Windows
> > > And you can even overrule that, but im not doing that.
> > > 
> > > timedatectl show-timesync
> > > SystemNTPServers="192.168.1.1 192.168.1.2"
> > > 
> > 
> > I repeat, your clients are not using the DC's directly for time,
> > you
> > might be okay with this, but I am not, but hey, they are your
> > clients :
> > -)
> > 
> 
> I'm not sure why this matters if the drift is less than the
> allowable 
> kerberos time difference.  
It is this: People can and will do things their own way. I cannot know
or remember how they do things their way, I have a bad enough time
remembering the recommended way :-)

Just because I say don't do it that way, doesn't mean it will
definitely not work (it possibly will), but it is just not the Samba
recommended way of doing things and I cannot test everything (so I know
it does work, or not). If anyone feels that something does work and can
prove it, then register for the wiki and edit it to add that
information.

Rowland