thr3ads.net - samba - [Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC [Aug 2024]

If this information is useful, please help other people find it:
Share via:

Mitja Tavčar

2024-Aug-09 15:51 UTC

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

Il giorno ven, 09/08/2024 alle 15.09 +0100, Rowland Penny via samba ha
scritto:> On Fri, 9 Aug 2024 13:38:35 +0200
> Mitja Tav?ar via samba <samba at lists.samba.org> wrote:
> 
> > Hi,
> > 
> > I'm trying to join a debian bookworm running samba (Version
> > 4.17.12-Debian) as an additional DC to a Active Directory Domain. The
> > domain is already running on 2 windows 2019 DC's (hostnames
> > vmw2srvdc1 and vmw2srvdc2) and the functional level of the AD domain
> > is 2008 R2.
> > 
> > I followed the samba wiki instructions at:
> >
https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory
> > 
> > I also made another Site in AD to which i want the new samba domain
> > controller to join to. So in the command i also used the --site
> > option.
> > 
> > This is command i used for my last attempt:
> > samba-tool domain join intra.comune.trento.it DC --site PSN --server
> > vmw2srvdc2.intra.comune.trento.it --use-kerberos=desired -d 3
> > 
> > Join always fails after adding the DNS records for
> > LVSRVDC.intra.comune.trento.it (my new domain controller)
> > 
> > I tried varying some options (authentication via Username/password
> > instead of kerberos and also switching between BIND9_DLZ to
> > SAMBA_INTERNAL dns backend) but the join process always fail
> > apparently in the same point. From the logs the error would appear in
> > adding the DNS record for the new domain controller, but i also
> > noticed the "Could not find machine account in secrets database:
> > Failed to fetch machine account password for INTRA from both
> > secrets.ldb" error which could be the problem.
> > 
> > The samba server is a new debian bookworm setup that was not used for
> > other purpose, and between the various attempts i also deleted all
> > .ldb and .tdb databases from /var/lib/samba/ /var/cache/samba and
> > /run/samba and subfolders and the /etc/samba/smb.conf. as suggested
> > in the wiki above for a cleaner start.
> > 
> > 
> 
> Can you please try again with Samba from Bookworm backports, that will
> get you 4.20.2 , there has been better support for Windows domains 
> added.
Ok, I installed samba from bookworm-backports.

root at lvsrvdc:~# samba -V
Version 4.20.2-Debian-4.20.2+dfsg-6~bpo12+1

> As you are using kerberos for the join, I take it you are running
> samba-tool as root, so have you also run 'kinit Administrator' as
root ?
Yes, I issued all commands as root:

root at lvsrvdc:~# kinit administrator at INTRA.COMUNE.TRENTO.IT
Password for administrator at INTRA.COMUNE.TRENTO.IT: 
root at lvsrvdc:~# klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator at INTRA.COMUNE.TRENTO.IT

Valid starting       Expires              Service principal
08/09/2024 17:22:51  08/10/2024 03:22:51  krbtgt/INTRA.COMUNE.TRENTO.IT at
INTRA.COMUNE.TRENTO.IT
	renew until 08/10/2024 17:22:45


and 

root at lvsrvdc:~# samba-tool domain join intra.comune.trento.it DC --site PSN
--use-kerberos=desired --server vmw2srvdc2.intra.comune.trento.it


But even with the 4.20.2 version the error seems always at the same point.

I was thinking if I forgot to check some permission in my domain. For example on
DNS. Something that would prevent the new controller's DNS Records?

The original domain was not deployed as 2008R2 but as Windows2000 and then
upgraded to 2003 and subsequently to 2008R2 level. But we have not
encountered any problems so far.


So here is the final part of the log from the last run with 4.20.2 version
I see no other errors along the log just some warning.


(....)

Repacking database from v1 to v2 format (first record
CN=Infrastructure,DC=ForestDnsZones,DC=intra,DC=comune,DC=trento,DC=it)
Repacking database from v1 to v2 format (first record
DC=108,DC=12.168.192.in-addr.arpa,CN=MicrosoftDNS,CN=System,DC=intra,DC=comune,DC=trento,DC=it)
Repack: re-packed 10000 records so far
Repack: re-packed 20000 records so far
Repack: re-packed 30000 records so far
Repack: re-packed 40000 records so far
Repack: re-packed 50000 records so far
Repack: re-packed 60000 records so far
Repack: re-packed 70000 records so far
Repack: re-packed 80000 records so far
Repack: re-packed 90000 records so far
Repack: re-packed 100000 records so far
Repack: re-packed 110000 records so far
Repack: re-packed 120000 records so far
Repack: re-packed 130000 records so far
Repack: re-packed 140000 records so far
Repack: re-packed 150000 records so far
Repack: re-packed 160000 records so far
Repack: re-packed 170000 records so far
INFO 2024-08-09 17:25:03,269 pid:4149
/usr/lib/python3/dist-packages/samba/join.py #1104: Committed SAM database
INFO 2024-08-09 17:25:03,290 pid:4149
/usr/lib/python3/dist-packages/samba/join.py #1180: Adding 1 remote DNS records
for
LVSRVDC.intra.comune.trento.it
Join failed - cleaning up
Deleted CN=RID Set,CN=LVSRVDC,OU=Domain
Controllers,DC=intra,DC=comune,DC=trento,DC=it
Deleted CN=LVSRVDC,OU=Domain Controllers,DC=intra,DC=comune,DC=trento,DC=it
Deleted CN=NTDS
Settings,CN=LVSRVDC,CN=Servers,CN=PSN,CN=Sites,CN=Configuration,DC=intra,DC=comune,DC=trento,DC=it
Deleted
CN=LVSRVDC,CN=Servers,CN=PSN,CN=Sites,CN=Configuration,DC=intra,DC=comune,DC=trento,DC=it
ERROR(<class 'UnboundLocalError'>): uncaught exception - cannot
access local variable 'res' where it is not associated with a value
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line
285, in _run
    return self.run(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/netcmd/domain/join.py",
line 128, in run
    join_DC(logger=logger, server=server, creds=creds, lp=lp, domain=domain,
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1621, in
join_DC
    ctx.do_join()
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1518, in
do_join
    ctx.join_add_dns_records()
  File "/usr/lib/python3/dist-packages/samba/join.py", line 1215, in
join_add_dns_records
    for rec in res.rec:
               ^^^


Mitja Tav?ar

Rowland Penny

2024-Aug-09 16:32 UTC

head link

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

On Fri, 09 Aug 2024 17:51:22 +0200
Mitja Tav?ar via samba <samba at lists.samba.org> wrote:
> 
> The original domain was not deployed as 2008R2 but as Windows2000 and
> then upgraded to 2003 and subsequently to 2008R2 level. But we have
> not encountered any problems so far.
The DNS on a W2k is very different from what is used now, so when it
was updated was the DNS updated as well ?

If it wasn't, then the base NC will not be there to put the dns record
into.

Rowland

Douglas Bagnall

2024-Aug-09 22:44 UTC

head link

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

On 10/08/24 03:51, Mitja Tav?ar via samba wrote:
> So here is the final part of the log from the last run with 4.20.2 version
> I see no other errors along the log just some warning.
> 
> Deleted CN=NTDS
Settings,CN=LVSRVDC,CN=Servers,CN=PSN,CN=Sites,CN=Configuration,DC=intra,DC=comune,DC=trento,DC=it
> Deleted
CN=LVSRVDC,CN=Servers,CN=PSN,CN=Sites,CN=Configuration,DC=intra,DC=comune,DC=trento,DC=it
> ERROR(<class 'UnboundLocalError'>): uncaught exception -
cannot access local variable 'res' where it is not associated with a
value
>   File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py",
line 285, in _run
>     return self.run(*args, **kwargs)
>            ^^^^^^^^^^^^^^^^^^^^^^^^^
>   File
"/usr/lib/python3/dist-packages/samba/netcmd/domain/join.py", line
128, in run
>     join_DC(logger=logger, server=server, creds=creds, lp=lp,
domain=domain,
>   File "/usr/lib/python3/dist-packages/samba/join.py", line 1621,
in join_DC
>     ctx.do_join()
>   File "/usr/lib/python3/dist-packages/samba/join.py", line 1518,
in do_join
>     ctx.join_add_dns_records()
>   File "/usr/lib/python3/dist-packages/samba/join.py", line 1215,
in join_add_dns_records
>     for rec in res.rec:
>                ^^^
There is a bug here that is suppressing the real source of the problem.

If you can change that part of /usr/lib/python3/dist-packages/samba/join.py
to read:

        except WERRORError as e:
            if e.args[0] == werror.WERR_DNS_ERROR_NAME_DOES_NOT_EXIST:
                name_found = False
            else:
                print(e)
                raise

        if name_found:

(for example, by applying the attached patch), we might see what is
going wrong.

cheers,
Douglas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-python-join-do-not-suppress-unexpected-DNS-enum-erro.patch
Type: text/x-patch
Size: 853 bytes
Desc: not available
URL:
<http://lists.samba.org/pipermail/samba/attachments/20240810/4033f785/0001-python-join-do-not-suppress-unexpected-DNS-enum-erro.bin>

samba - Aug 2024 - Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC

[Samba] Problems on joining samba DC to a Windows Domain while adding DNS record for new DC