[Samba] Debugging Samba 4 AD Setup
L.P.H. van Belle
belle at bazuin.nl
Tue Mar 24 09:30:22 MDT 2015
Just read the dovecot kerberos wiki a bit..
Are you using cross-realm authentication..
then you really must read : http://wiki2.dovecot.org/Authentication/Kerberos
and i suggest checking out: http://wiki2.dovecot.org/PasswordDatabase/PAM
enable pam session and caching.
That would reduce possible problems.
But that to much out of the samba scope for me.
Greetz,
Louis
>-----Oorspronkelijk bericht-----
>Van: belle at bazuin.nl [mailto:samba-bounces at lists.samba.org]
>Namens L.P.H. van Belle
>Verzonden: dinsdag 24 maart 2015 16:23
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] Debugging Samba 4 AD Setup
>
>all looks ok sofar
>
>but can you give me the output,
>dig PTR the-ad-hostname.ourdomain.com
>
>just to be sure.
>
>whats your OS running?
>is dovecot running on the same server?
>is dovecot auth running as root?
>
>the output of :
>cat /etc/pamd.d/imap
>cat /etc/pamd.d/pop3
>cat /etc/pamd.d/mail
>
>and how may auth request are you getting, default is 100 .
>
>
>Greetz,
>
>Louis
>
>
>
>>-----Oorspronkelijk bericht-----
>>Van: johannesa at celluloid-vfx.com
>>[mailto:samba-bounces at lists.samba.org] Namens Johannes Amorosa
>>| Celluloid VFX
>>Verzonden: dinsdag 24 maart 2015 16:04
>>Aan: samba at lists.samba.org
>>Onderwerp: Re: [Samba] Debugging Samba 4 AD Setup
>>
>>Hi Louis,
>>answers are inline ...
>>
>>On 03/24/2015 03:48 PM, L.P.H. van Belle wrote:
>>> Realm is advices to use UPPERCASE.. not obligated. ( but
>>very advices yes )
>>I changed the config to uppercase and rebooted, no change in
>>the logfiles.
>>>
>>> check the following outputs and post them back in the list (
>>if needed anonymized )
>>>
>>> hostname -i
>>192.168.1.235
>>> hostname -s
>>the-ad-hostname
>>> hostname -f
>>the-ad-hostname.ourdomain.com
>>> hostname -d
>>ourdomain.com
>>>
>>> cat /etc/resolv.conf
>>nameserver 192.168.1.236
>>nameserver 192.168.1.235
>>search ourdomain.com
>>
>>> cat /etc/hosts
>>127.0.0.1 localhost
>>192.168.1.235 the-ad-hostname.ourdomain.com the-ad-hostname
>><snip>
>>> cat /etc/mailname
>>cat: /etc/mailname: No such file or directory
>>
>>>
>>> dig MX ourdomain.com @127.0.0.1
>>; <<>> DiG 9.8.1-P1 <<>> MX ourdomain.com @127.0.0.1
>>;; global options: +cmd
>>;; Got answer:
>>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3733
>>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
>ADDITIONAL: 0
>>
>>;; QUESTION SECTION:
>>;ourdomain.com. IN MX
>>
>>;; Query time: 0 msec
>>;; SERVER: 127.0.0.1#53(127.0.0.1)
>>;; WHEN: Tue Mar 24 15:58:44 2015
>>;; MSG SIZE rcvd: 34
>>
>>> dig MX ourdomain.com @192.168.1.254
>>; <<>> DiG 9.8.1-P1 <<>> MX ourdomain.com @192.168.1.254
>>;; global options: +cmd
>>;; Got answer:
>>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1156
>>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
>>
>>;; QUESTION SECTION:
>>;ourdomain.com. IN MX
>>
>>;; AUTHORITY SECTION:
>>. 10800 IN SOA a.root-servers.net.
>>nstld.verisign-grs.com. 2015032400 1800 900 604800 86400
>>
>>;; Query time: 73 msec
>>;; SERVER: 192.168.1.254#53(192.168.1.254)
>>;; WHEN: Tue Mar 24 16:00:07 2015
>>;; MSG SIZE rcvd: 109
>>
>>> dig PTR IP_OF_DC
>>; <<>> DiG 9.8.1-P1 <<>> PTR the-ad-hostname
>>;; global options: +cmd
>>;; Got answer:
>>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6806
>>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
>>
>>;; OPT PSEUDOSECTION:
>>; EDNS: version: 0, flags:; udp: 4000
>>;; QUESTION SECTION:
>>;the-ad-hostname. IN PTR
>>
>>;; Query time: 43 msec
>>;; SERVER: 192.168.1.236#53(192.168.1.236)
>>;; WHEN: Tue Mar 24 16:00:57 2015
>>;; MSG SIZE rcvd: 39
>>
>>>
>>> Greetz,
>>>
>>> Louis
>>>
>>>
>>Thank you for your time.
>>
>>>
>>>> -----Oorspronkelijk bericht-----
>>>> Van: kable at abv.bg [mailto:samba-bounces at lists.samba.org]
>>>> Namens Georg Georgiev
>>>> Verzonden: dinsdag 24 maart 2015 14:27
>>>> Aan: samba at lists.samba.org
>>>> Onderwerp: Re: [Samba] Debugging Samba 4 AD Setup
>>>>
>>>> Hello Johannes,
>>>> Please check your kerberos realm, wiki says: _Realm:_ . It
>will also
>>>> automatically be used as the Active Directory DNS domain name.
>>>> The Realm
>>>> always has to be in uppercase.
>>>> I see that your is realm = ourdomain.com
>>>> Regards,
>>>> George
>>>>
>>>> On 24.3.2015 ??. 14:29 ??., Johannes Amorosa | Celluloid VFX wrote:
>>>>> We're using quite successfully a samba 4.1 AD setup authenticating
>>>>> user. We have on an unregular basis
>>>>> mails that can't be delivered because dovecot-pam fails to
>>>> verify the
>>>>> credentials. I'm trying to debug
>>>>> this and set the loglevel up to 3.
>>>>>
>>>>> I can see an error message being spammed in the log files
>and can't
>>>>> figure out what causes this. I expect a configuration
>>error somewhere
>>>>> although everything else seems to work. Can someone shed
>>>> some light on
>>>>> this error.
>>>>>
>>>>> Invalid domain! Expected name in domain [ourdomain.com]. But
>>>> received
>>>>> [THE-AD-HOSTNAME]!
>>>>>
>>>> ../source4/rpc_server/netlogon/dcerpc_netlogon.c:2330(dcesrv_ne
>>>> tr_DsrEnumerateDomainTrusts)
>>>>>
>>>>> I don't believe this has anything to do with the initial
>>>> problem, but
>>>>> I would like to resolve this one aswell.
>>>>> Thank you for your time.
>>>>> Joe
>>>>>
>>>>> Setup:
>>>>> Two identical servers with this samba.conf.
>>>>>
>>>>> # Global parameters
>>>>> [global]
>>>>> workgroup = OURDOMAIN
>>>>> realm = ourdomain.com
>>>>> netbios name = THE-AD-HOSTNAME
>>>>> netbios aliases = SOMETHINGELSE
>>>>> log level = 3
>>>>>
>>>>> server role = active directory domain controller
>>>>> dns forwarder = 192.168.1.254
>>>>> [netlogon]
>>>>> path = /var/lib/samba/sysvol/ourdomain.com/scripts
>>>>> read only = No
>>>>>
>>>>> [sysvol]
>>>>> path = /var/lib/samba/sysvol
>>>>> read only = No
>>>>>
>>>>>
>>>> --
>>>> To unsubscribe from this list go to the following URL and read the
>>>> instructions: https://lists.samba.org/mailman/options/samba
>>>>
>>
>>--
>>Johannes Amorosa | Celluloid VFX
>>
>>--
>>To unsubscribe from this list go to the following URL and read the
>>instructions: https://lists.samba.org/mailman/options/samba
>>
>>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions: https://lists.samba.org/mailman/options/samba
>
>
More information about the samba
mailing list