atom feed5 messages in org.samba.lists.samba[Samba] net ads join : ads_connect: N...
FromSent OnAttachments
D G TeedJan 30, 2008 3:57 pm 
Douglas VanLeuvenJan 30, 2008 7:11 pm 
Douglas VanLeuvenJan 30, 2008 7:38 pm 
D G TeedJan 30, 2008 7:51 pm 
Douglas VanLeuvenJan 30, 2008 8:13 pm 
Subject:[Samba] net ads join : ads_connect: No logon servers
From:Douglas VanLeuven (roam@sonic.net)
Date:Jan 30, 2008 7:11:46 pm
List:org.samba.lists.samba

D G Teed wrote:

I've been able to use security = ads in smb.conf, and connect OK, but it must be falling back to domain. When I run net ads join I get the error (debug trace below):

ads_connect: No logon servers

Here is my krb5.conf:

[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = BEER [realms] BEER = { kdc = ADC1.AD.BEERU.CA } [domain_realm] beer.ca = BEER .beer.ca = BEER

This should be a mapping from DNS domain to Kerberos REALM. Going by the kdc name, what you probably want is: beer.ca = AD.BEERU.CA .beer.ca = AD.BEERU.CA www2.beer.ca = AD.BEERU.CA

Here is my rpc join status: # net rpc testjoin Join to 'BEER' is OK

Here is my attempt to graduate this to ADS levels, with debug:

# net ads join -Ubeeruser%beeruserpw -d3 [2008/01/30 11:06:08, 3] param/loadparm.c:lp_load(5033) lp_load: refreshing parameters [2008/01/30 11:06:08, 3] param/loadparm.c:init_globals(1424) Initialising global parameters [2008/01/30 11:06:08, 3] param/params.c:pm_process(572) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" [2008/01/30 11:06:08, 3] param/loadparm.c:do_section(3772) Processing section "[global]" [2008/01/30 11:06:08, 2] lib/interface.c:add_interface(81) added interface ip=111.111.200.8 bcast=111.111.207.255 nmask=255.255.248.0 [2008/01/30 11:06:08, 2] lib/interface.c:add_interface(81) added interface ip=111.111.202.39 bcast=111.111.207.255 nmask=255.255.248.0 [2008/01/30 11:06:08, 3] libsmb/namequery.c:get_dc_list(1489) get_dc_list: preferred server list: "ADC2, 111.111.200.67" [2008/01/30 11:06:08, 1] libads/cldap.c:recv_cldap_netlogon(247) Failed to parse cldap reply [2008/01/30 11:06:08, 3] libads/ldap.c:ads_try_connect(189) ads_try_connect: CLDAP request 111.111.200.66 failed. [2008/01/30 11:06:08, 1] libads/cldap.c:recv_cldap_netlogon(247) Failed to parse cldap reply [2008/01/30 11:06:08, 3] libads/ldap.c:ads_try_connect(189) ads_try_connect: CLDAP request 111.111.200.67 failed. [2008/01/30 11:06:08, 3] libsmb/namequery.c:get_dc_list(1489) get_dc_list: preferred server list: "ADC2, 111.111.200.67" [2008/01/30 11:06:08, 3] libsmb/namequery_dc.c:rpc_dc_name(154) Could not look up dc's for domain BEER [2008/01/30 11:06:08, 3] libsmb/namequery.c:get_dc_list(1489) get_dc_list: preferred server list: "ADC2, 111.111.200.67" [2008/01/30 11:06:08, 3] libsmb/namequery.c:get_dc_list(1489) get_dc_list: preferred server list: "ADC2, 111.111.200.67" [2008/01/30 11:06:08, 0] utils/net_ads.c:ads_startup_int(286) ads_connect: No logon servers [2008/01/30 11:06:08, 1] utils/net_ads.c:net_ads_join(1470) error on ads_startup: No logon servers Failed to join domain: No logon servers [2008/01/30 11:06:08, 2] utils/net.c:main(1032) return code = -1

Can this user achieve such a goal?

Here is beeruser's rights via rpc: net rpc rights list -Ubeeruser Password: SeMachineAccountPrivilege Add machines to domain SeTakeOwnershipPrivilege Take ownership of files or other objects SeBackupPrivilege Back up files and directories SeRestorePrivilege Restore files and directories SeRemoteShutdownPrivilege Force shutdown from a remote system SePrintOperatorPrivilege Manage printers SeAddUsersPrivilege Add users and groups to the domain SeDiskOperatorPrivilege Manage disk shares

I've had various toggles done to my smb.conf, but here is what the global section of smb.conf looks like at the moment, following the hints of someone else who solved this on the list...

[global] netbios name = www2 workgroup = BEER unix charset = LOCALE realm = BEER

Same here. realm = AD.BEERU.CA

server string = Web Server security = ADS password server = 111.111.200.67 idmap backend = rid:BEER=5000-100000000 idmap uid = 10000-10000000 idmap gid = 10000-10000000 template shell = /bin/bash winbind use default domain = Yes winbind enum users = Yes winbind enum groups = Yes allow trusted domains = No log level = 3 log file = /var/log/samba/%m.log max log size = 50 dns proxy = No winbind use default domain = Yes hosts allow = 111.111. encrypt passwords = yes

I had great results with the last question I put on the list. I hope someone can help us graduate to ads with kerberos level authentication.

It feels like there is something missing on the AD end, but I know nothing about this other than that it is Windows Server 2003 and it has been in production for awhile with good performance.

There may be something else, but the REALM is what jumped out at me.

Regards, Doug