[Samba] Joining Windows 10 Domain Member to Samba AD/DC

Sat Feb 10 20:17:18 UTC 2024

On Sat Feb 10 14:48:04 2024 Kees van Vloten via samba <samba at lists.samba.org> wrote:
>
> On 10-02-2024 20:19, Mark Foley via samba wrote:
> > On Sat Feb 10 04:36:35 2024 Peter Milesson via samba <samba at lists.samba.org> wrote:
> >> Hi Mark,
> >>
> >> The NTP requests from linux hosts to time servers do not contain extra
> >> fields, just the basic fields that are required. Windows clients tack
> >> another 20 bytes to the NTP request. See the following article from M$:
> >>
> >> https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sntp/824d0b97-59e7-405c-8e0d-7b18b6304d10
> >>
> >> chrony should work without any problems. Below, I have listed the
> >> contents of my chrony.conf file, just for comparison. This configuration
> >> works in several domains at the moment. I do not use any chrony keys,
> >> though there is an empty file. The file is owned by root:_chrony 0640.
> >>
> >> You will probably need to assign user _chrony and group _chrony.
> >> /var/lib/chrony is owned by _chrony:_chrony 0750. There is also
> >> /var/run/chrony owned by _chrony:_chrony 0700.
> >>
> >> Hope that you sort it out.
> >>
> >> Peter
> >>
> >>
> >> # Welcome to the chrony configuration file. See chrony.conf(5) for more
> >> # information about usable directives.
> >>
> >> # Include configuration files found in /etc/chrony/conf.d.
> >> confdir /etc/chrony/conf.d
> >>
> >> # Use Debian vendor zone.
> >> pool 2.debian.pool.ntp.org iburst
> >>
> >> # Use time sources from DHCP.
> >> sourcedir /run/chrony-dhcp
> >>
> >> # Use NTP sources found in /etc/chrony/sources.d.
> >> sourcedir /etc/chrony/sources.d
> >>
> >> # This directive specify the location of the file containing ID/key
> >> pairs for
> >> # NTP authentication.
> >> keyfile /etc/chrony/chrony.keys
> >>
> >> # This directive specify the file into which chronyd will store the rate
> >> # information.
> >> driftfile /var/lib/chrony/chrony.drift
> >>
> >> # Save NTS keys and cookies.
> >> ntsdumpdir /var/lib/chrony
> >>
> >> # Uncomment the following line to turn logging on.
> >> #log tracking measurements statistics
> >>
> >> # Log files location.
> >> logdir /var/log/chrony
> >>
> >> # Stop bad estimates upsetting machine clock.
> >> maxupdateskew 100.0
> >>
> >> # This directive enables kernel synchronisation (every 11 minutes) of the
> >> # real-time clock. Note that it can't be used along with the 'rtcfile'
> >> directive.
> >> rtcsync
> >>
> >> # Step the system clock instead of slewing it if the adjustment is
> >> larger than
> >> # one second, but only in the first three clock updates.
> >> makestep 1 3
> >>
> >> # Get TAI-UTC offset and leap seconds from the system tz database.
> >> # This directive must be commented out when using time sources serving
> >> # leap-smeared time.
> >> leapsectz right/UTC
> >>
> >> bindcmdaddress 172.16.0.100
> >>
> >> allow 172.16.0.0/24
> >>
> >> ntpsigndsocket  /var/lib/samba/ntp_signd
> >>
> > Thanks Peter. It's clear that ntpd is not responding to the signing requests from
> > the Windows computers, though I am certain I built it with --enable-ntp-signd.
> > Unfortnately, there is no way to verify it was built that way.
> >
> > However, chrony just isn't working for me. Here's my /etc/chrony/chrony.conf:
> >
> > ----------------------------
> > bindcmdaddress 192.168.0.2
> >
> > server 0.pool.ntp.org     iburst
> > server 1.pool.ntp.org     iburst
> > server 2.pool.ntp.org     iburst
> >
> > allow 192.168.0.0/24
> > logdir /var/log/chrony
> > keyfile /etc/chrony/chrony.keys
> > makestep 1 3
> > hwclockfile /etc/adjtime
> > ntpsigndsocket  /var/lib/samba/ntp_signd
> > -----------------------------
> >
> > /var/lib/samba/ntp_signd is owned by group chrony. It's timestamp is unchanged
> > after starting chrony.
> >
> > /var/lib/chrony is owned by chrony.chrony.
> > /var/run/chrony owned by chrony.chrony.
> >
> > I start chrony with:
> >
> > /usr/sbin/chronyd -f /etc/chrony/chrony.conf
> >
> > chrony responds fine to the pool.ntp.org servers, but running tcpdump, shows
> > that chrony simply doesn't respond to queries from the Windows domain members:
> >
> > # tcpdump -v -l -i eth0 port 123
> > 13:37:05.687333 IP (tos 0x0, ttl 128, id 13312, offset 0, flags [none], proto UDP (17), length 96)
> >      192.168.0.52.ntp > mail.hprs.local.ntp: NTPv3, Client, length 68
> >          Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 7 (128s), precision -23
> >          Root Delay: 0.000000, Root dispersion: 1.000000, Reference-ID: (unspec)
> >            Reference Timestamp:  3916134665.288999699 (2024-02-05T15:11:05Z)
> >            Originator Timestamp: 0.000000000
> >            Receive Timestamp:    0.000000000
> >            Transmit Timestamp:   3916579000.023001399 (2024-02-10T18:36:40Z)
> >              Originator - Receive Timestamp:  0.000000000
> >              Originator - Transmit Timestamp: 3916579000.023001399 (2024-02-10T18:36:40Z)
> >          Key id: 1694760960
> >          Authentication: 00000000000000000000000000000000
> >
> > The "Key id:" and "Authentication:" fields have to do with the ntp-signd
> > authentication. chrony sends no response back to 192.168.0.52 or any other
> > Windows computer.
> >
> > Is there something wrong with my config?
> >
> > Does chrony have to be built in some special way to enable ntp-signd?
> >
> > If you run 'tcpdump -v -l -i ethX port 123' on your DC, does it show sending a
> > response back to your Windows computers?
> >
> > Thanks --Mark
> >
> You can check ntp on windows with: w32tm /monitor
>
> It should list one or more DCs as source
>
> - Kees.

Yes, I know. It doesn't. It lists either "Local CMOS Clock" or "Free-running
System Clock".

--Mark