I have written one more article with the steps to configure FreeIPA server and client which can also act as an alternate to Microsoft Active Directory. And since FreeIPA is a GUI based, it can be a better alternative then Samba4.
I started reading Samba4 Join a DC article with a belief that it shows the steps required to configure a backup domain controller for our PDC in Samba 4. (Please correct me if I am wrong).
But when I studied in depth I came to the conclusion that it was guiding us to create a secondary domain controller and not a backup dc.
Still I tried to configure the same using the steps as provided on that article and as to my belief I ended up configuring a secondary dc rather than a backup dc.
NOTE: This article guides you to configure secondary domain controller rather than a primary domain controller.
But still I would like to show the steps which I followed and the fix to errors which I faced while configuring the same.
Primary DC: 192.168.1.6
Hostname: test.example.com
Secondary DC: 192.168.1.5
Hostname: test1.example.com
So let me assume that you already have a working primary dc. It can be Samba 4 or Windows Server 2008 AD.
Before you start always make sure to check the pre-requisites
On the primary domain controller (test.example.com)
Verify the entry of kerberos config file is as shown below on your PDC
[root@test ~]# cat /etc/krb5.conf
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
Update your resolv.conf with the address of your DNS server which should be your PDC as for me
[root@test ~]# cat /etc/resolv.conf
search example.com
nameserver 192.168.1.6
On the secondary domain controller (test1.example.com)
Update your resolv.conf with the DNS server as used in your PDC (Primary Domain Controller)
[root@test1 ~]# cat /etc/resolv.conf
search example.com
nameserver 192.168.1.6
To prepare a SDC(Secondary Domain Controller) you will have to configure Samba 4.1 in your current server as well. These are the steps you need to do. You can follow the below article for configuring Samba 4.1
Samba 4.1 as Active Directory
|
IMPORTANT NOTE:
|
|
Do not run the provision step for Samba 4.1
|
Run the below command as root
[root@test1 samba-4.1.4]# samba-tool domain join example.com DC -Uadministrator --realm=example.com Finding a writeable DC for domain 'example.com' Found DC test.example.com Password for [EXAMPLEadministrator]: [Give your PDC password] NO DNS zone information found in source domain, not replicating DNS workgroup is EXAMPLE realm is example.com checking sAMAccountName Adding CN=TEST1,OU=Domain Controllers,DC=example,DC=com Adding CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com Adding CN=NTDS Settings,CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com Adding SPNs to CN=TEST1,OU=Domain Controllers,DC=example,DC=com Setting account password for TEST1$ Enabling account Calling bare provision No IPv6 address will be assigned ldb: module schema_load initialization failed : No such object ldb: module rootdse initialization failed : No such object ldb: module samba_dsdb initialization failed : No such object ldb: Unable to load modules for /usr/local/samba/private/sam.ldb: (null) samdb_connect failed VFS connect failed! Join failed - cleaning up checking sAMAccountName Deleted CN=TEST1,OU=Domain Controllers,DC=example,DC=com Deleted CN=NTDS Settings,CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com Deleted CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception -ProvisioningError: Your filesystem or build does not support posix ACLs, which s3fs requires. Try the mounting the filesystem with the 'acl' option. File "/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs) File "/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/domain.py", line 552, in run machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend) File "/usr/local/samba/lib/python2.6/site-packages/samba/join.py", line 1172, in join_DC ctx.do_join() File "/usr/local/samba/lib/python2.6/site-packages/samba/join.py", line 1076, in do_join ctx.join_provision() File "/usr/local/samba/lib/python2.6/site-packages/samba/join.py", line 727, in join_provision use_ntvfs=ctx.use_ntvfs, dns_backend=ctx.dns_backend) File "/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py", line 2052, in provision raise ProvisioningError("Your filesystem or build does not support posix ACLs, which s3fs requires. Try the mounting the filesystem with the 'acl' option.")
In the first attempt I got the above error
There are two solutions for this
Solution 1:
Your filesystem does not supports acl so you will have to remount your fs with acl, user_xattr parameter
Make sure these two rpms are installed in your server
[root@test ~]# rpm -qa|grep libattr
libattr-2.4.44-7.el6.i686
libattr-devel-2.4.44-7.el6.i686
[root@test ~]# rpm -qa|grep libacl
libacl-2.2.49-6.el6.i686
libacl-devel-2.2.49-6.el6.i686
# mount -o remount,acl,user_xattr /dev/mapper/VolGroup-root
For making permanent changes update your fstab file
# cat /etc/fstab
/dev/mapper/VolGroup-root / ext4 defaults,acl,user_xattr 1 1
Solution 2:
Use an extra parameter --use-ntvfs to skip the above work in case it is a production server as you will not be allowed to reboot a prod server.
[root@test1 ~]# samba-tool domain join example.com DC -Uadministrator --realm=example.com --use-ntvfs Finding a writeable DC for domain 'example.com' Found DC test.example.com Password for [EXAMPLEadministrator]: [Give your PDC password] NO DNS zone information found in source domain, not replicating DNS workgroup is EXAMPLE realm is example.com checking sAMAccountName Adding CN=TEST1,OU=Domain Controllers,DC=example,DC=com Adding CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com Adding CN=NTDS Settings,CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com Adding SPNs to CN=TEST1,OU=Domain Controllers,DC=example,DC=com Setting account password for TEST1$ Enabling account Calling bare provision No IPv6 address will be assigned Provision OK for domain DN DC=example,DC=com Starting replication Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com] objects[402/1550] linked_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com] objects[804/1550] linked_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com] objects[1206/1550] linked_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com] objects[1550/1550] linked_values[0/0] Analyze and apply schema objects Partition[CN=Configuration,DC=example,DC=com] objects[402/1653] linked_values[0/0] Partition[CN=Configuration,DC=example,DC=com] objects[804/1653] linked_values[0/0] Partition[CN=Configuration,DC=example,DC=com] objects[1206/1653] linked_values[0/0] Partition[CN=Configuration,DC=example,DC=com] objects[1608/1653] linked_values[0/0] Partition[CN=Configuration,DC=example,DC=com] objects[1653/1653] linked_values[20/0] Replicating critical objects from the base DN of the domain Partition[DC=example,DC=com] objects[98/98] linked_values[23/0] Partition[DC=example,DC=com] objects[394/296] linked_values[23/0] Done with always replicated NC (base, config, schema) Committing SAM database Sending DsReplicateUpdateRefs for all the replicated partitions Setting isSynchronized and dsServiceName Setting up secrets database Joined domain EXAMPLE (SID S-1-5-21-2036099725-333104617-2937475635) as a DC
Now next step is to make sure your hostname for SDC is resolvable on the DNS
On DNS server (192.168.1.6)
[root@test ~]# nslookup test1.example.con
Server: 192.168.1.6
Address: 192.168.1.6#53
** server can't find test1.example.con: NXDOMAIN
(Make an entry in last line)
test1 IN A 192.168.1.5
Restart the named services
Stopping named: . [ OK ]
Starting named: [ OK ]
Now retry to resolve the hostname
[root@test1 ~]# nslookup test1.example.com
Server: 192.168.1.6
Address: 192.168.1.6#53
Name: test1.example.com
Address: 192.168.1.5
Verify if the objectGUID is resolvable to the new hostname, Run the below command
# record 1
dn: CN=NTDS Settings,CN=TEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
objectGUID: 74b975bc-c25c-4ce7-9773-fe3f6eb1b903
# record 2
dn: CN=NTDS Settings,CN=TEST1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
objectGUID: 607bc2dc-0754-49e3-aa37-9be403d0cc33
[root@test ~]# host -t CNAME 607bc2dc-0754-49e3-aa37-9be403d0cc33._msdcs.example.com.
Host 607bc2dc-0754-49e3-aa37-9be403d0cc33._msdcs.example.com. not found: 3(NXDOMAIN)
You can update your DNS record using the below command
# samba-tool dns add IP-of-your-DNS _msdcs.samdom.example.com 607bc2dc-0754-49e3-aa37-9be403d0cc33 CNAME test1.example.com -Uadministrator
So In case you are also facing the same issue follow the below steps to manually update your zone file in DNS
[root@test ~]# vi /usr/local/samba/private/dns/example.com.zone
Make a new entry at the last line of the file
607bc2dc-0754-49e3-aa37-9be403d0cc33._msdcs.example.com. IN CNAME test1
Stopping named: . [ OK ]
Starting named: [ OK ]
Now again retry to run the below command
[root@test1 ~]# cat /etc/resolv.conf
search example.com
nameserver 192.168.1.6
nameserver 192.168.1.5
Starting Samba
You have to follow the same step to start samba as used in PDC
Password for administrator@EXAMPLE.COM: [Give password for Administrator]
Warning: Your password will expire in 41 days on Mon Mar 31 13:44:36 2014
Failed to connect host 192.168.1.5 on port 135 - NT_STATUS_CONNECTION_REFUSED
Failed to connect host 192.168.1.5 (test1.example.com) on port 135 - NT_STATUS_CONNECTION_REFUSED.
ERROR(<class 'samba.drs_utils.drsException'>): DRS connection to test1.example.com failed - drsException: DRS connection to test1.example.com failed: (-1073741258, 'The connection was refused')
File "/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/drs.py", line 39, in drsuapi_connect
(ctx.drsuapi, ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_utils.drsuapi_connect(ctx.server, ctx.lp, ctx.creds)
File "/usr/local/samba/lib/python2.6/site-packages/samba/drs_utils.py", line 54, in drsuapi_connect
raise drsException("DRS connection to %s failed: %s" % (server, e))
[root@test1 ~]# cat /var/log/messages | grep 135
Feb 17 15:15:58 test samba[1207]: Failed to connect host 192.168.1.6 on port 135 - NT_STATUS_CONNECTION_REFUSED
Feb 17 15:15:58 test samba[1207]: Failed to connect host 192.168.1.6 (74b975bc-c25c-4ce7-9773-fe3f6eb1b903._msdcs.example.com) on port 135 - NT_STATUS_CONNECTION_REFUSED.
Then just to be sure
[root@test1 ~]# telnet localhost 135
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
Change it to disabled state and reboot the system
Now retry the same
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
Default-First-Site-NameTEST1
DSA Options: 0x00000001
DSA object GUID: 607bc2dc-0754-49e3-aa37-9be403d0cc33
DSA invocationId: 7899d780-9c0c-4cfc-adae-ba8c63790cf0
==== INBOUND NEIGHBORS ====
ERROR(runtime): DsReplicaGetInfo of type 0 failed - (-1073610723, 'NT_STATUS_RPC_PROTOCOL_ERROR')
Solution:
[root@test1 ~]# samba-tool drs showrepl Default-First-Site-NameTEST1 DSA Options: 0x00000001 DSA object GUID: 607bc2dc-0754-49e3-aa37-9be403d0cc33 DSA invocationId: 7899d780-9c0c-4cfc-adae-ba8c63790cf0 ==== INBOUND NEIGHBORS ==== DC=example,DC=com Default-First-Site-NameTEST via RPC DSA object GUID: 74b975bc-c25c-4ce7-9773-fe3f6eb1b903 Last attempt @ Tue Feb 18 10:59:58 2014 IST failed, result 2 (WERR_BADFILE) 1 consecutive failure(s). Last success @ Tue Feb 18 10:35:58 2014 IST CN=Configuration,DC=example,DC=com Default-First-Site-NameTEST via RPC DSA object GUID: 74b975bc-c25c-4ce7-9773-fe3f6eb1b903 Last attempt @ Tue Feb 18 10:59:58 2014 IST failed, result 2 (WERR_BADFILE) 1 consecutive failure(s). Last success @ Tue Feb 18 10:35:57 2014 IST CN=Schema,CN=Configuration,DC=example,DC=com Default-First-Site-NameTEST via RPC DSA object GUID: 74b975bc-c25c-4ce7-9773-fe3f6eb1b903 Last attempt @ Tue Feb 18 10:59:58 2014 IST failed, result 2 (WERR_BADFILE) 1 consecutive failure(s). Last success @ Tue Feb 18 10:35:53 2014 IST ==== OUTBOUND NEIGHBORS ==== ==== KCC CONNECTION OBJECTS ==== Connection -- Connection name: 77f4ad2e-ddca-4584-8d8c-7efbd1f7d93c Enabled : TRUE Server DNS name : test.example.com Server DN name : CN=NTDS Settings,CN=TEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com TransportType: RPC options: 0x00000001
On Windows client machine
You can switch to either dc using these steps
New Password:
Retype Password:
User 'test' created successfully
[root@test1 ~]# samba-tool user list
Administrator
dns-test
krbtgt
Guest
test
On PDC (test.example.com)
Administrator
dns-test
krbtgt
Guest
test