search for: villacher

Today's episode of "why is AD break", brought to you by: > [2017/09/05 10:17:06.015617, 3] ../source4/auth/gensec/gensec_gssapi.c:613(gensec_gssapi_update) > Server GC/graz-dc-1b.ad.tao.at/ad.tao.at is not registered with our KDC: Miscellaneous failure (see text): Server (GC/graz-dc-1b.ad.tao.at/ad.tao.at at AD.TAO.AT) unknown > [2017/09/05 10:17:06.015717, 0]

Situation: Trying to upgrade Samba from 4.1 to 4.5 without disruption too much by adding new DCs and demoting old ones. After bringing online the first 4.5 DC, I ran `demote --remove-other-dead-server=` on that DC to remove one of the old 4.1 DCs (held no FSMO roles). That seemed to run fine (the DC had been offline for a few weeks at that point and I didn't want to restore it just for

/etc/hostname:villach-file /etc/hosts:# The following lines are desirable for IPv6 capable hosts /etc/hosts:::1 localhost ip6-localhost ip6-loopback /etc/hosts:ff02::1 ip6-allnodes /etc/hosts:ff02::2 ip6-allrouters /etc/hosts:127.0.0.1 localhost /etc/hosts:192.168.16.214 villach-file /etc/krb5.conf:[libdefaults] /etc/krb5.conf: default_realm = AD.TAO.AT /etc/krb5.conf: dns_lookup_realm = true

Hai Sven, > -----Oorspronkelijk bericht----- > Van: Sven Schwedas [mailto:sven.schwedas at tao.at] > Verzonden: dinsdag 5 september 2017 17:13 > Aan: L.P.H. van Belle > CC: samba at lists.samba.org > Onderwerp: Re: [Samba] Server GC/name.dom/dom is not > registered with our KDC: Miscellaneous failure (see text): > Server (GC/name/dom at DOM) unknown > > On

Hai, Well, good that your more relax and releaved in pressure.. Apoligies accepted. ;-), i know the fealing but do understand, we are trying to help out.. As you know, it very frustration to ask the same things again, and you showing them again But now as you showed with all the configs. It is needed.. (sorry) So I had a quick look, and you up to some changes. All are fixable, no worries,

On 2017-04-20 18:38, Rowland Penny wrote: > On Thu, 20 Apr 2017 18:00:24 +0200 > Sven Schwedas via samba <samba at lists.samba.org> wrote: > >> On 2017-04-07 13:44, Sven Schwedas via samba wrote: >>> In the end I just upgraded all DCs to 4.5 and remote-deleted the >>> broken ones. Seemed to work without a hitch, manual removal was >>> only necessary

Hai, > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Sven > Schwedas via samba > Verzonden: dinsdag 21 mei 2019 16:44 > Aan: samba at lists.samba.org > Onderwerp: Re: [Samba] Debugging Samba is a total PITA and > this needs to improve > > On 21.05.19 16:15, L.P.H. van Belle via samba wrote: > >> Since Cyrus

Once again, something with Samba thirty bazillion components broke. Once again, my choices for logging are "nothing" or "15 MB/s spread of ten different files, because 'client authentication failed' totally needs to be lower priority than malloc debug info". Once again, none of these messages is actually able to convey what broke, where, why. Why is it impossible for

Sven, Fist fix the smb.conf as i suggested, cap and non caps where it should be. Resolving settings based on the script output looks ok. Fix krb5.conf Then how many DC's are you having? > So, could somebody maybe help with the NT_STATUS_INTERNAL_DB_CORRUPTION > / DRS replication issue? Or will it be easier to just demote > the DC and provision a new one? Are all DC's

On 2017-09-08 13:02, Rowland Penny via samba wrote: > On Fri, 8 Sep 2017 12:43:40 +0200 > Sven Schwedas via samba <samba at lists.samba.org> wrote: > >> On 2017-09-08 12:26, Rowland Penny via samba wrote: >>> On Fri, 8 Sep 2017 12:03:53 +0200 >>> "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: >>> >>>>

Hai Sven, And still i see/think you should change some things to get a better base setup. And no its not bike shedding.... It is making a standard setup, work from there. [libdefaults] default_realm = AD.TAO.AT dns_lookup_realm = true < if you have multple REALM, else false. (default_realm = AD.TAO.AT) dns_lookup_kdc = true Checking file: /etc/nsswitch.conf passwd: files

> -----Oorspronkelijk bericht----- > Van: Sven Schwedas [mailto:sven.schwedas at tao.at] > Verzonden: vrijdag 8 september 2017 14:40 > Aan: L.P.H. van Belle; samba at lists.samba.org > Onderwerp: Re: [Samba] Server GC/name.dom/dom is not > registered with our KDC: Miscellaneous failure (see text): > Server (GC/name/dom at DOM) unknown > > On 2017-09-08 10:37, L.P.H.

With some slight delay, we did actually manage to get all our old wonky compatibility solutions nuked (turned out there were a few more lurking in the shadows than expected?). Mail servers are no longer domain joined, and unencrypted LDAP is finally gone, together with the terrible PHP scripts that needed it. Which allowed me to finally cleanup all the samba setups:

On 22.05.19 15:31, L.P.H. van Belle wrote: > Hai, > > Well, good that your more relax and releaved in pressure.. > Apoligies accepted. ;-), i know the fealing but do understand, we are trying to help out.. > > As you know, it very frustration to ask the same things again, and you showing them again > But now as you showed with all the configs. It is needed.. (sorry)

Hai Sven, Sorry for the long wait, i had some things todo first here. > -----Oorspronkelijk bericht----- > Van: Sven Schwedas [mailto:sven.schwedas at tao.at] > Verzonden: woensdag 6 september 2017 16:06 > Aan: L.P.H. van Belle; samba at lists.samba.org > Onderwerp: Re: [Samba] Server GC/name.dom/dom is not > registered with our KDC: Miscellaneous failure (see text): >

Okay, time to bring some order into this. == Keytab and replication == Editing servicePrincipalName cleaned up the keytab. Some things are even replicating correctly (modulo the missing host), others aren't. DNS replication (DC=ForestDnsZones and DC=DomainDnsZones) is still not working, at least one host is trying to connect to deleted servers for this. The other I cannot confirm because

Hi Sven, I had a quick look and its much better. Few small points. For the members. This might be a choice, but on the fileservers, the loggings is a bit difference still. And krb5-locales is on one but not the other. Last i see, there is no user mapping file for the members. Which normaly have !root = DOM\Administrator ( or BUILTIN\Administrator, depending on you setup )

On Fri, 8 Sep 2017 13:21:34 +0200 Sven Schwedas via samba <samba at lists.samba.org> wrote: > On 2017-09-08 13:02, Rowland Penny via samba wrote: > > On Fri, 8 Sep 2017 12:43:40 +0200 > > Sven Schwedas via samba <samba at lists.samba.org> wrote: > > > >> On 2017-09-08 12:26, Rowland Penny via samba wrote: > >>> On Fri, 8 Sep 2017 12:03:53

Hi Sven, Ok, before i back to my packaging, i reviewed the changes. You still missed a bit but it looks much better already, your completely there, but we will get there. And you really need to be more precise, why im telling that... Well the review. ( thats not all, im still reviewing the base only) ... https://up.tao.at/u/samba/graz-file.info2.txt Checking file:

On 2017-11-13 12:33, Rowland Penny via samba wrote: > On Mon, 13 Nov 2017 12:05:33 +0100 > Sven Schwedas <sven.schwedas at tao.at> wrote: > >> /etc/hostname:villach-file >> /etc/hosts:# The following lines are desirable for IPv6 capable hosts >> /etc/hosts:::1 localhost ip6-localhost ip6-loopback >> /etc/hosts:ff02::1 ip6-allnodes >>