[Samba] Samba Migration and AD integration

Praveen Ghimire PGhimire at sundata.com.au
Wed Feb 7 11:51:35 UTC 2018

Hi Rowland,

The computer indeed is in the same IP range. The /etc/resolv.conf points to it's IP and not the loopback

Had to use the --use-samba-tool as it errored out

29 DNS updates and 0 DNS deletes needed
Successfully obtained Kerberos ticket to DNS/server1.realmname as SERVER1$

ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/dns.py", line 1098, in run
    raise e
Failed 'samba-tool dns' based update: A server1.realmname : local variable 'estr' referenced before assignment
Traceback (most recent call last):
  File "/usr/sbin/samba_dnsupdate", line 834, in <module>
    call_samba_tool(d, zone=d.zone)
  File "/usr/sbin/samba_dnsupdate", line 563, in call_samba_tool
    print("Failed 'samba-tool dns' based update: %s : %s" % (str(d), estr))
UnboundLocalError: local variable 'estr' referenced before assignment

After that I did the combination of the following which allowed me to add the machine to the domain
- disabled ufw
- flushed and re-registered dns on the machine, rebooted the machine
- added search realmname in the /etc/resolv.conf

The next issue is that the machine I added to the domain is a Server2008R2. When I tried to DCPROMO it , the DNS server option was greyed out with 
DNS cannot be installed on this domain controller because this domain does not host DNS.


Praveen Ghimire

-----Original Message-----
From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland Penny via samba
Sent: Wednesday, 7 February 2018 8:56 PM
To: samba at lists.samba.org
Subject: Re: [Samba] Samba Migration and AD integration

On Wed, 7 Feb 2018 10:02:10 +0000
Praveen Ghimire <PGhimire at sundata.com.au> wrote:

> Hi Rowland,
> Following the
> https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_
> AD_DC, ran some tests migrating from Bind9 to Samba Internal with the 
> following results
> Stopped the BIND, Samba-AD-DC services
> samba_upgradedns --dns-backend=SAMBA_INTERNAL Reading domain 
> information DNS accounts already exist Reading records from zone file 
> /var/lib/samba/private/dns/<REALMNAME>.zone DNS partitions already 
> exist Finished upgrading DNS You have switched to using SAMBA_INTERNAL 
> as your dns backend, but you still have samba starting looking for a 
> BIND backend. Please remove the -dns from your server services line.

Did you remove the 'server services' line ?

> Started the Samba-AD-DC service and left the Bind9 stopped.
> The .zone file had the all the SOA records for the REALM. The issue 
> (after the change from Bind9 to Samba and also from Samba Internal to
> Bind9) we get the following when trying to add a machine to the 
> domain.
> The error was: "This operation returned because the timeout period 
> expired." (error code 0x000005B4 ERROR_TIMEOUT) The query was for the 
> SRV record for _ldap._tcp.dc._msdcs.<realmname> The DNS servers used 
> by this computer for name resolution are not responding. This computer 
> is configured to use DNS servers with the following IP addresses: 
> Verify that this computer is connected to the network, 
> that these are the correct DNS server IP addresses, and that at least 
> one of the DNS servers is running.

Does the computer you are trying to join have an ipaddress in the 172.16.24.x range ?

Does the nameserver in /etc/resolv.conf point to the Samba DCs ipaddress or '' ?

try running this:

samba_dnsupdate --verbose --all-names

This should try to create/update all the required dns records, if it errors out add '--use-samba-tool'

> The SRV records are missing by the looks of it.
> service --status-all
> [ + ]  apparmor

Have you tried turning apparmor off ?

> [ + ]  isc-dhcp-server

I could never get isc-dhcp-server to update the server records in AD when using the internal dns server.

> [ + ]  ufw

Are all the required ports open ?

> Also, does the Realm name needs to be something like abcd.local 
> instead of abcdef?

It would probably better if it had a TLD (just don't use .local), but should work without one.

To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com ______________________________________________________________________

More information about the samba mailing list