[Samba] Samba internal dns problem / No domain service

Fri Nov 7 05:54:30 MST 2014

Le 07/11/2014 13:18, Rowland Penny a écrit :
> On 07/11/14 10:49, sr wrote:
>>
>> Le 07/11/2014 11:40, Rowland Penny a écrit :
>>> On 07/11/14 10:17, sr wrote:
>>>>
>>>> Le 07/11/2014 10:11, Rowland Penny a écrit :
>>>>> On 07/11/14 08:27, sr wrote:
>>>>>> All seems ok because I have only "1341/samba" listenning process. 
>>>>>> But I don't have the 953 port line...
>>>>>> If I read the /etc/service file I have for the port 953 tcp and 
>>>>>> udp "rndc control sockets (BIND9)"
>>>>>> Should I remove this lines since I don't have named installed?
>>>>>> ( and manualy add this line? Or restart samba install... )
>>>>>> thanks.
>>>>>>
>>>>>>
>>>>>> Le 06/11/2014 17:38, Rowland Penny a écrit :
>>>>>>> On 06/11/14 16:27, sr wrote:
>>>>>>>> Does this problem could come from a port occupied by another 
>>>>>>>> program in the / etc / services file? And which one?
>>>>>>>
>>>>>>> If something else is listening on port 53, then yes, as you are 
>>>>>>> using the internal DNS server, you shouldn't have any other DNS 
>>>>>>> program running on the same server, i.e. dnsmasq, bind etc
>>>>>>>
>>>>>>> Try running 'netstat -tulpn | grep 53 | grep LISTEN' on the 
>>>>>>> samba4 AD DC
>>>>>>>
>>>>>>> I use Bind9 and get:
>>>>>>>
>>>>>>> tcp        0      0 192.168.0.2:53          0.0.0.0:* LISTEN 
>>>>>>> 2346/named
>>>>>>> tcp        0      0 127.0.0.1:53            0.0.0.0:* LISTEN 
>>>>>>> 2346/named
>>>>>>> tcp        0      0 127.0.0.1:953           0.0.0.0:* LISTEN 
>>>>>>> 2346/named
>>>>>>>
>>>>>>> Rowland
>>>>>>>
>>>>>>>>
>>>>>>>> Samuel
>>>>>>>>
>>>>>>>> Le 06/11/2014 13:41, sr a écrit :
>>>>>>>>>
>>>>>>>>> Le 06/11/2014 12:25, Rowland Penny a écrit :
>>>>>>>>>> On 06/11/14 10:59, sr wrote:
>>>>>>>>>>>
>>>>>>>>>>> Le 06/11/2014 11:23, Rowland Penny a écrit :
>>>>>>>>>>>> On 06/11/14 10:16, sr wrote:
>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>
>>>>>>>>>>>>> I'm trying to move from a windows 2008R2 domain controler 
>>>>>>>>>>>>> to samba4 ( centos 6.5 x64 + samba v 4.1.13 )
>>>>>>>>>>>>> For now, both of server are working as AD controlers.
>>>>>>>>>>>>
>>>>>>>>>>>> How did you join the Samba4 DC to the windows domain ?
>>>>>>>>>>> I followed the wiki guide "Join a domain as a DC" with no 
>>>>>>>>>>> problem unless for the msdcs CNAME entry of the new dc, 
>>>>>>>>>>> which return error ( I did it with the win2000 graphical 
>>>>>>>>>>> interface, like others guys in the same situation )
>>>>>>>>>>
>>>>>>>>>> SO, 'host -t CNAME YOUR_objectGUID._msdcs.samba4.domain.com.' 
>>>>>>>>>> does not return a CNAME, have you run:
>>>>>>>>>>
>>>>>>>>>> samba-tool dns add IP-of-your-DNS _msdcs.samba4.domain.com 
>>>>>>>>>> YOUR_objectGUID CNAME DC2.samba4.domain.com -Uadministrator
>>>>>>>>>>
>>>>>>>>>> Also, I see that you mention 'the win2000 graphical 
>>>>>>>>>> interface' , I wonder if this is the problem, the lowest 
>>>>>>>>>> function level of Samba4 AD is 2003 ?
>>>>>>>>>>
>>>>>>>>>> Rowland
>>>>>>>>> No, the command 'host -t CNAME 
>>>>>>>>> YOUR_objectGUID._msdcs.samba4.domain.com.' return 'host -t 
>>>>>>>>> CNAME YOUR_objectGUID._msdcs.samba4.domain.com is an alias for 
>>>>>>>>> samba4.domain.com'.
>>>>>>>>> whops! I would says "win2008 graphical interface. ;)
>>>>>>>>> I tryed a first install with domain and forest with a 2008 
>>>>>>>>> functional level with the same problem... ( now it's a 2003 
>>>>>>>>> domain and forest functional level )
>>>>>>>>> Thanks.
>>>>>>>>>
>>>>>>>>> Samuel
>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> But I can't manage DNS from a windows client with the 
>>>>>>>>>>>>> graphical tool... ( it says "active directory not 
>>>>>>>>>>>>> available, ..." )
>>>>>>>>>>>>>
>>>>>>>>>>>>> On samba server if I try the following command
>>>>>>>>>>>>> "samba-tool dns zonelist samba4.domain.com"
>>>>>>>>>>>>>
>>>>>>>>>>>> Is 'samba4.domain.com' your dns domain on both DC's ? also 
>>>>>>>>>>>> I take that you are adding '-UAdministrator' to the above 
>>>>>>>>>>>> command.
>>>>>>>>>>> Yes. Like the W2008 server
>>>>>>>>>>>>
>>>>>>>>>>>> Rowland
>>>>>>>>>>>>
>>>>>>>>>>>>> the following message appears
>>>>>>>>>>>>> "9717, 'WERR_DNS_ERROR_DS_UNAVAILABLE"
>>>>>>>>>>>>>
>>>>>>>>>>>>> and if I shutdown the win2008 server the message is 
>>>>>>>>>>>>> "NT_STATUS_IO_TIMEOUT"
>>>>>>>>>>>>>
>>>>>>>>>>>>> any help will be fully appreciate! :)
>>>>>>>>>>>>> Thanks! :)
>>>>>>>>>>>>>
>>>>>>>>>>>>> Samuel
>>>>>>>>>>>>
>>>>>>>>>>> thanks
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>> You can ignore the lack of the '953' line, it is, as you say, the 
>>>>> bind command port.
>>>>> Do you by any chance have selinux running, I have spent time in 
>>>>> the past, trying to find out just why a program wouldn't work and 
>>>>> it turned out that Selinux was stopping something happening.
>>>>>
>>>>> I wonder if the directory structure is ok? try running this on the 
>>>>> samba4 DC:
>>>>>
>>>>> ldbedit -e nano -H /var/lib/samba/private/sam.ldb --cross-ncs -b 
>>>>> "CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com"
>>>>>
>>>>> You may have to alter the path to sam.ldb.
>>>>>
>>>>> Rowland
>>>>>
>>>> Selinux is disabled and iptables is flushed...
>>>> Here is the result of the command :
>>>> ldbedit -e nano -H /usr/local/samba/private/sam.ldb --cross-ncs -b 
>>>> "CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com"
>>>> search failed - No such Base DN: 
>>>> CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>>>> What does it mean?
>>>> Thanks!
>>>>
>>> You did change 'DC=example,DC=com' for your rootdse, didn't you ?
>>>
>>> Rowland
>>>
>> Sorry, I did it! :)
>> Here is the result:
>>
>> # editing 3 records
>> # record 1
>> dn: CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>>
>> # record 2
>> dn: 
>> DC=..TrustAnchors,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>>
>>
>> # record 3
>> dn: 
>> DC=@,DC=..TrustAnchors,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>>
>>
>> Thanks
>> Samuel
>
> OK, you seem to have a few records missing, I have these on my test 
> domain:
>
> dn: CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=b2bd6040-6e58-48bb-b3fa-7d980f14dc24,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_kerberos._tcp.Default-First-Site-Name._sites.dc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.Default-First-Site-Name._sites.gc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=@,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.gc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=d768be2e-0072-4500-bb62-6fdabb14d995,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.Default-First-Site-Name._sites.dc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=gc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.pdc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.dc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_kerberos._tcp.dc,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
> dn: 
> DC=_ldap._tcp.82fb0000-060f-44f3-a6fb-b2a40c00d764.domains,DC=_msdcs.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=example,DC=com
>
>
> Could you check the domain level of the windows AD DC.
>
> Rowland
>
The domain functional level and the forest functional level are Windows 
server 2003.
Thanks.

Samuel