[Samba] Getent doesn't show AD users/groups
Alex Orlov
ooo_saturn7 at mail.ru
Tue Dec 15 13:58:00 UTC 2020
This is the result of that script
Collected config --- 2020-12-15-16:39 -----------
Hostname: server1
DNS Domain: example.com
FQDN: server1.example.com
ipaddress: 172.16.0.1 X.X.X.X 10.8.0.1
-----------
Kerberos SRV _kerberos._tcp.example.com record verified ok, sample output:
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
*** Can't find _kerberos._tcp.example.com: No answer
Authoritative answers can be found from:
example.com
origin = sbx8.hosting.reg.ru
mail addr = root.sbx8.hosting.reg.ru
serial = 2016052254
refresh = 10800
retry = 3600
expire = 604800
minimum = 86400
Samba is running as an AD DC
-----------
Checking file: /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
-----------
This computer is running Debian 8.5 x86_64
-----------
running command : ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether
inet 172.16.0.1/24 brd 172.16.0.255 scope global eth0
inet6
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether
inet X.X.X.X/30 brd X.X.X.X scope global eth1
inet6
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
-----------
Checking file: /etc/hosts
127.0.0.1 localhost
127.0.1.1 server0
172.16.0.1 server1.example.com
172.16.0.1 fileserver1.server1.example.com
172.16.0.1 server1.server1.example.com
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
-----------
Checking file: /etc/resolv.conf
# Generated by NetworkManager
domain server1.example.com
search server1.example.com
nameserver 127.0.0.1
-----------
Checking file: /etc/krb5.conf
[libdefaults]
default_realm = SERVER1.EXAMPLE.COM
# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
dns_lookup_realm = false
dns_lookup_kdc = true
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[realms]
SERVER1.EXAMPLE.COM = {
kdc = server1.example.com
admin_server = server1.example.com
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu:88
kdc = kerberos-1.mit.edu:88
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
}
MEDIA-LAB.MIT.EDU = {
kdc = kerberos.media.mit.edu
admin_server = kerberos.media.mit.edu
}
ZONE.MIT.EDU = {
kdc = casio.mit.edu
kdc = seiko.mit.edu
admin_server = casio.mit.edu
}
MOOF.MIT.EDU = {
kdc = three-headed-dogcow.mit.edu:88
kdc = three-headed-dogcow-1.mit.edu:88
admin_server = three-headed-dogcow.mit.edu
}
CSAIL.MIT.EDU = {
kdc = kerberos-1.csail.mit.edu
kdc = kerberos-2.csail.mit.edu
admin_server = kerberos.csail.mit.edu
default_domain = csail.mit.edu
krb524_server = krb524.csail.mit.edu
}
IHTFP.ORG = {
kdc = kerberos.ihtfp.org
admin_server = kerberos.ihtfp.org
}
GNU.ORG = {
kdc = kerberos.gnu.org
kdc = kerberos-2.gnu.org
kdc = kerberos-3.gnu.org
admin_server = kerberos.gnu.org
}
1TS.ORG = {
kdc = kerberos.1ts.org
admin_server = kerberos.1ts.org
}
GRATUITOUS.ORG = {
kdc = kerberos.gratuitous.org
admin_server = kerberos.gratuitous.org
}
DOOMCOM.ORG = {
kdc = kerberos.doomcom.org
admin_server = kerberos.doomcom.org
}
ANDREW.CMU.EDU = {
kdc = kerberos.andrew.cmu.edu
kdc = kerberos2.andrew.cmu.edu
kdc = kerberos3.andrew.cmu.edu
admin_server = kerberos.andrew.cmu.edu
default_domain = andrew.cmu.edu
}
CS.CMU.EDU = {
kdc = kerberos.cs.cmu.edu
kdc = kerberos-2.srv.cs.cmu.edu
admin_server = kerberos.cs.cmu.edu
}
DEMENTIA.ORG = {
kdc = kerberos.dementix.org
kdc = kerberos2.dementix.org
admin_server = kerberos.dementix.org
}
stanford.edu = {
kdc = krb5auth1.stanford.edu
kdc = krb5auth2.stanford.edu
kdc = krb5auth3.stanford.edu
master_kdc = krb5auth1.stanford.edu
admin_server = krb5-admin.stanford.edu
default_domain = stanford.edu
}
UTORONTO.CA = {
kdc = kerberos1.utoronto.ca
kdc = kerberos2.utoronto.ca
kdc = kerberos3.utoronto.ca
admin_server = kerberos1.utoronto.ca
default_domain = utoronto.ca
}
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
[login]
krb4_convert = true
krb4_get_tickets = false
-----------
Checking file: /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat winbind
group: compat winbind
shadow: compat
gshadow: files
hosts: files myhostname dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
-----------
Checking file: /etc/samba/smb.conf
# Global parameters
[global]
workgroup = FILESERVER1
realm = SERVER1.EXAMPLE.COM
netbios name = SERVER1
server role = active directory domain controller
dns forwarder = 87.249.16.250
idmap_ldb:use rfc2307 = yes
# bind interfaces only = yes
# interfaces = eth0,lo
hosts allow = 127.0.0.1 172.16.0.0/24 10.8.0.0/24
hosts deny = 0.0.0.0/0
log level = 3 passdb:5 auth:5
# log level = 4
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
[netlogon]
path = /var/lib/samba/sysvol/server1.example.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
[TestData]
comment = TestData
browseable = yes
writable = yes
path = /test_data
public = yes
-----------
BIND_DLZ not detected in smb.conf
-----------
Installed packages:
ii acl 2.2.52-2 amd64 Access control list utilities
ii attr 1:2.4.47-2 amd64 Utilities for manipulating filesystem extended attributes
ii krb5-config 2.3 all Configuration files for Kerberos Version 5
ii krb5-locales 1.12.1+dfsg-19+deb8u2 all Internationalization support for MIT Kerberos
ii krb5-user 1.12.1+dfsg-19+deb8u5 amd64 Basic programs to authenticate using MIT Kerberos
ii libacl1:amd64 2.2.52-2 amd64 Access control list shared library
ii libattr1:amd64 1:2.4.47-2 amd64 Extended attribute shared library
ii libgssapi-krb5-2:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
ii libkrb5-26-heimdal:amd64 1.6~rc2+dfsg-9+deb8u1 amd64 Heimdal Kerberos - libraries
ii libkrb5-3:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime libraries
ii libkrb5support0:amd64 1.12.1+dfsg-19+deb8u5 amd64 MIT Kerberos runtime libraries - Support library
ii libnss-winbind:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba nameservice integration plugins
ii libpam-winbind:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Windows domain authentication integration plugin
ii libsmbclient:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 shared library for communication with SMB/CIFS servers
ii libwbclient0:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba winbind client library
ii oracle-java8-jdk 8u101 amd64 Java™ Platform, Standard Edition 8 Development Kit
ii python-samba 2:4.2.14+dfsg-0+deb8u13 amd64 Python bindings for Samba
ii samba 2:4.2.14+dfsg-0+deb8u13 amd64 SMB/CIFS file, print, and login server for Unix
ii samba-common 2:4.2.14+dfsg-0+deb8u13 all common files used by both the Samba server and client
ii samba-common-bin 2:4.2.14+dfsg-0+deb8u13 amd64 Samba common files used by both the server and the client
ii samba-dsdb-modules 2:4.2.14+dfsg-0+deb8u13 amd64 Samba Directory Services Database
ii samba-libs:amd64 2:4.2.14+dfsg-0+deb8u13 amd64 Samba core libraries
ii samba-vfs-modules 2:4.2.14+dfsg-0+deb8u13 amd64 Samba Virtual FileSystem plugins
ii spice-client-glib-usb-acl-helper 0.25-1+b1 amd64 Spice client glib usb acl helper
ii winbind 2:4.2.14+dfsg-0+deb8u13 amd64 service to resolve user and group information from Windows NT servers
-----------
--
Best regards, Alex Orlov
More information about the samba
mailing list