[Samba] After some time 4.3.9 Member Server in different Subnet than ADS controller loses trust
L.P.H. van Belle
belle at bazuin.nl
Tue May 24 07:55:18 UTC 2016
Upgrade to 4.4.3 that fixes a lot, like.
> - net ads testjoin
> > ads_connect: No logon servers
> > Join to domain is not valid: No logon servers
>
> - wbinfo -g and wbinfo -u
> > provide no output anymore.
And dont forget to setup the ldap certificate part as described in the change log of 4.4.2.
Anyone should avoid the version 4.2.9-4.2.11 4.3.7-4.3.9 4.4.2 and lower.
That helps, after the big upgrade, some new bug entered.
Most of them are fixed in the latest version 4.4.3.
I cant tell about the 4.2/4.3 versions.
Greetz,
Louis
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Thomas Burger
> (tburger at eritron.de)
> Verzonden: dinsdag 24 mei 2016 9:26
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] After some time 4.3.9 Member Server in different Subnet
> than ADS controller loses trust
>
> Hello everybody,
>
> I hope someone can help me with this or point me into the right
> direction since I am not being able to solve it since weeks.
>
> Since last year I was running Samba 4.1.6 on Ubuntu 14.04 LTS without
> issues as a active directory domain controller as well as member
> servers. Trouble started with the upgrade to Samba 4.3.8 (now 4.3.9).
>
> The ADS controller and most member servers are sharing the same subnet.
> For
> security reasons I pushed one of the member servers into a DMZ. I am
> using Kerberos, Winbind and Samba to integrate to the ADS.
> What has worked with 4.1.6 seems not to work anymore with 4.3.8 and
> 4.3.9. While all member servers on the same subnet work fine the machine
> in the DMZ looses connection to the ADS after some time.
>
> On the member server in the DMZ, from a shell I can successfully
> - obtain Kerberos tickets
> - join to the domain via (net ads join ...)
> - After join do a testjoin
> - obtain domain information
> - get users via >wbinfo -u< and groups via >wbinfo -g<
> - create a keytab file for kerberos ticket update
>
> After some time (several hours, I found it hard to track) I experience
> the following issues:
> - net ads testjoin
> > ads_connect: No logon servers
> > Join to domain is not valid: No logon servers
> - wbinfo -g and wbinfo -u
> > provide no output anymore.
>
> What I checked and did not change situation:
> - name resolution (forward, backward, all ok to ADS controller as well
> as domain name)
> - disabled ALL firewall rules between the systems (ADS controller and
> member server)
>
>
>
>
> My kerberos configuration on the client looks like this:
> [libdefaults]
> default_realm = DOMAIN.DE
> dns_lookup_realm = false # also tried this to set to true
> dns_lookup_kdc = true
>
> [realms]
> DOMAIN.DE = {
> kdc = dc.domain.de
> admin_server = dc.domain.de
> master_kdc = dc.domain.de
> }
>
> [domain_realm]
> domain.de = DOMAIN.DE
>
>
> This is the smb.conf:
> ######## GLOBAL
> [global]
> #### GLOBAL SETTINGS
> netbios name = HOSTNAME
> server string = HOSTNAME
> workgroup = DOMAIN
> realm = DOMAIN.DE
> server role = MEMBER SERVER
> name resolve order = hosts wins bcast
>
> #### SECURITY SETTINGS
> security = ads
> allow trusted domains = Yes
> map untrusted to domain = Yes
> encrypt passwords = yes
> client use spnego = yes
> client ntlmv2 auth = yes
> client ldap sasl wrapping = sign
> restrict anonymous = 2
> acl map full control = yes
>
> #### SERVER SETTINGS
> dns proxy = yes
> domain master = no
> local master = no
> preferred master = no
> os level = 0
> follow symlinks = yes
> veto files =
> /.AppleDouble/.DS_Store/._.DS_Store/.fseventsd/.notfirsttime/.Spotlight-
> V100/.TemporaryItems/.Trash/.Trashes/Thumbs.db/thumbs.db/._*/~$*/System\
>
> Volume\ Information/
> delete veto files = yes
> server min protocol = SMB2
> server max protocol = SMB3
>
> #### KERBEROS
> dedicated keytab file = /etc/krb5.keytab
> kerberos method = secrets and keytab
>
> #### WINBIND CONFIGURATION
> winbind enum users = yes
> winbind enum groups = yes
> winbind offline logon = no
> winbind reconnect delay = 30
> winbind refresh tickets = yes
> winbind nested groups = yes
> idmap config *:backend = tdb
> idmap config *:range = 70001-80000
> idmap config DOMAIN:backend = rid
> idmap config DOMAIN:schema_mode = rfc2307
> idmap config DOMAIN:range = 20000-40000
> idmap cache time = 604800
> winbind separator = /
> winbind use default domain = no
> #### HOME DIRECTORIES
> template shell = /bin/bash
> template homedir = /home/%U
>
> #### PRINTING
> disable spoolss = yes
> load printers = no
> idmap_ldb:use rfc2307 = yes
>
> #### LOGGING
> log level = 2
> username level = 3
> log file = /var/log/samba/log.%m
> max log size = 50
> syslog only = no
> syslog = 2
> panic action = /usr/share/samba/panic-action %d
>
>
> the resolv.conf:
> nameserver 10.14.11.5 # This is the ADS Controller
> nameserver 10.14.12.1 # This is an alternate nameserver
> search domain.de
>
>
>
>
> In /var/log/syslog I can see various messages that caught my attention
> but neither of those helped me in my research. Don´t give to much about
> date/time. I just copied them as I found them:
>
> 1. "Could not receive Trustdoms".
> May 16 06:58:43 hostname winbindd[820]: [2016/05/16 06:58:43.776831, 1]
> ../source3/winbindd/winbindd_util.c:351(trustdom_list_done)
> May 16 06:58:43 hostname winbindd[820]: Could not receive trustdoms
>
> 2. "Check connection to trusted domain"
> May 22 06:10:23 hostname winbindd[840]: [2016/05/22 06:10:23.784860, 0]
> ../source3/winbindd/winbindd_group.c:45(fill_grent)
> May 22 06:10:23 hostname winbindd[840]: Failed to find domain 'Unix
> Group'. Check connection to trusted domains!
>
> 3. This is indicating a name resolution issue but I have checked that
> already:
> May 22 06:44:52 hostname winbindd[24623]: ads_find_dc: name resolution
> for realm 'domain.de' (domain 'DOMAIN') failed: NT_STATUS_NO_LOGON_SERVERS
>
> 4. "failed to reconnect (No logon servers)"
> May 22 21:09:51 hostname winbindd[971]: [2016/05/22 21:09:51.487192, 1]
> ../source3/libads/ldap_utils.c:107(ads_do_search_retry_internal)
> May 22 21:09:51 hostname winbindd[971]: ads_search_retry: failed to
> reconnect (No logon servers)
>
> 5. "ads_connect for domain DOMAIN failed: No logon servers"
> May 22 21:10:07 hostname winbindd[971]: [2016/05/22 21:10:07.493461, 1]
> ../source3/winbindd/winbindd_ads.c:136(ads_cached_connection_connect)
> May 22 21:10:07 hostname winbindd[971]: ads_connect for domain DOMAIN
> failed: No logon servers
>
>
>
>
> Any pointers are greatly appreciated.
> Best regards
>
> Thomas
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
More information about the samba
mailing list