Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[Samba] Unable to join the domain, problem with DNS records

1,971 views
Skip to first unread message

Luka Goltnik

unread,
Jan 8, 2014, 9:00:05 AM1/8/14
to
Dear Samba users and gurus,

I'm currently setting up a data server for our company, since the old one
is slowly dying of age. At the company we bought new server and decided to
put Linux on it and use Samba for file sharing. Now, The installation went
fine, and I'm currently running Gentoo Linux with Samba 4.1.3. Setting up
the Samba was no problem at all, up to the point where I want to join
client pc into domain.

I have Windows 7 client machine and when I'm in the process of joining
domain, I get this error on my client machine:
---
DNS was successfully queried for the service location (SRV) resource record
used to locate a domain controller for domain "O.M.S":
The query was for the SRV record for _ldap._tcp.dc._msdcs.O.M.S
The following domain controllers were identified by the query:
o.o.m.s

However no domain controllers could be contacted.

Common causes of this error include:

- Host (A) or (AAAA) records that map the names of the domain controllers
to their IP addresses are missing or contain incorrect addresses.
- Domain controllers registered in DNS are not connected to the network or
are not running.
---

Now, as far as I have gotten is, that the problem lies in (internal) DNS.
If I query for _ldap.tcp.dc_msdcs.O.M.S I get the SRV record o.o.m.s
instead of o.m.s

$ host -t SRV _ldap._tcp.dc._msdcs.O.M.S
_ldap._tcp.dc._msdcs.O.M.S has SRV record 0 100 389 o.o.m.s.

Does anyone have any idea what is there for me to do, to get this working?
I've searched the internet for solution and haven't found one, so I turn to
you for help.

Any help or tip would be greatly appreciated.

Kind regards,
Luka
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Werthmuller, Derek

unread,
Jan 8, 2014, 5:30:02 PM1/8/14
to
Assuming that O.M.S is the full name of the domain.
Try running this command on the samba server to verify that clients will be able to find the DC via DNS.
#host -t SRV _ldap._tcp.dc._msdcs.O.M.S
The results should return the IP and name of the DC.

1) verify that the server isn't blocking the DNS port (53)
2) Make sure that the windows client has its DNS server set to the IP address of your DC.
3) Make sure that on the windows system in the name of the domain you are trying to become a member of is O.M.S not just O.

Hope this helps.

Cheers
Derek

Luka Goltnik

unread,
Jan 9, 2014, 5:10:03 AM1/9/14
to
Dear Derek,

thank you for your reply.


On Wed, Jan 8, 2014 at 11:28 PM, Werthmuller, Derek <dwer...@ctg.albany.edu
> wrote:

> Assuming that O.M.S is the full name of the domain.
>
Your assumption is correct.
Also, I don't know if this is a problem, but my server's hostname is also o.


> Try running this command on the samba server to verify that clients will
> be able to find the DC via DNS.
> #host -t SRV _ldap._tcp.dc._msdcs.O.M.S
> The results should return the IP and name of the DC.
>

As you suggested, I issued the command #host -t SRV
_ldap._tcp.dc._msdcs.O.M.S, and this is the reply I got:
_ldap._tcp.dc._msdcs.o.m.s
has SRV record 0 100 389 *o.o.m.s*.

Now I don't have the record in DNS server for o.o.m.s and I think this is
where the problem lies but I have no clue as how to solve this issue. Also
you probably noticed, in reply there was no IP address.


>
> 1) verify that the server isn't blocking the DNS port (53)
>
On the server DNS port 53 is accessible from my whole network and I'm
currently not running any firewall as the server is behind firewall and is
not accessible from outside world.


> 2) Make sure that the windows client has its DNS server set to the IP
> address of your DC.
>
Made sure twice. ;-)


> 3) Make sure that on the windows system in the name of the domain you are
> trying to become a member of is O.M.S not just O.
>
I made sure about that, but the problem is, when joining a windows client
into domain I get this error:
"
DNS was successfully queried for the service location (SRV) resource record
used to locate a domain controller for domain "OFFICE.MAVE.SI":

The query was for the SRV record for _ldap._tcp.dc._msdcs.OFFICE.MAVE.SI

The following domain controllers were identified by the query:
office.office.mave.si


However no domain controllers could be contacted.
"
Which (at least I think so) implies, that the client managed to contact the
DNS server on o.m.s, but got the reply *o.o.m.s* instead of *o.m.s* or IP
address alone.

Any thoughts?


Thanks for your help.

Regards,

Rowland Penny

unread,
Jan 9, 2014, 5:20:02 AM1/9/14
to
On 09/01/14 09:59, Luka Goltnik wrote:
> Dear Derek,
>
> thank you for your reply.
>
>
> On Wed, Jan 8, 2014 at 11:28 PM, Werthmuller, Derek <dwer...@ctg.albany.edu
>> wrote:
>> Assuming that O.M.S is the full name of the domain.
>>
> Your assumption is correct.
> Also, I don't know if this is a problem, but my server's hostname is also o.
>
>
>> Try running this command on the samba server to verify that clients will
>> be able to find the DC via DNS.
>> #host -t SRV _ldap._tcp.dc._msdcs.O.M.S
>> The results should return the IP and name of the DC.
>>
> As you suggested, I issued the command #host -t SRV
> _ldap._tcp.dc._msdcs.O.M.S, and this is the reply I got:
> _ldap._tcp.dc._msdcs.o.m.s
> has SRV record 0 100 389 *o.o.m.s*.
>
> Now I don't have the record in DNS server for o.o.m.s and I think this is
> where the problem lies but I have no clue as how to solve this issue. Also
> you probably noticed, in reply there was no IP address.
>
o.o.m.s is the FQDN of your server, if I run the command you ran
(altered to match my dns) I get a similar answer.

>> 1) verify that the server isn't blocking the DNS port (53)
>>
> On the server DNS port 53 is accessible from my whole network and I'm
> currently not running any firewall as the server is behind firewall and is
> not accessible from outside world.
>
>
>> 2) Make sure that the windows client has its DNS server set to the IP
>> address of your DC.
>>
> Made sure twice. ;-)
>
>
>> 3) Make sure that on the windows system in the name of the domain you are
>> trying to become a member of is O.M.S not just O.
>>
> I made sure about that, but the problem is, when joining a windows client
> into domain I get this error:
> "
> DNS was successfully queried for the service location (SRV) resource record
> used to locate a domain controller for domain "OFFICE.MAVE.SI":
>
> The query was for the SRV record for _ldap._tcp.dc._msdcs.OFFICE.MAVE.SI
>
> The following domain controllers were identified by the query:
> office.office.mave.si
Could you please post your krb5.conf, smb.conf, /etc/hostname,
/etc/hosts and /etc/resolv.conf files.
The problem, as I see it, is that samba seems to be trying to contact
'OFFICE.MAVE.SI' but you keep referring to 'o.m.s' which appears to be
the initial letters of the domain name.

Rowland

Luka Goltnik

unread,
Jan 9, 2014, 5:40:01 AM1/9/14
to
Rowland hello,

o.m.s was just my attempt to try and shorten the whole thing o stands for
office m stands for mave and s stands for si.
As for files, here they are:

/etc/samba/smb.conf
# Global parameters
[global]
workgroup = MAVE.SI
realm = OFFICE.MAVE.SI
netbios name = OFFICE
server role = active directory domain controller
dns forwarder = 193.2.1.66
idmap_ldb:use rfc2307 = yes
server services = smb,dns,kdc
local master = yes
preferred master = yes


[netlogon]
path = /var/lib/samba/sysvol/office.mave.si/scripts
read only = No

[sysvol]
path = /var/lib/samba/sysvol
read only = No

------
/etc/krb5.conf
[libdefaults]
default_realm = OFFICE.MAVE.SI
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[kdc]
check-ticket-addresses = false

[realms]
OFFICE.MAVE.SI = {
kdc = office.mave.si:88
admin_server = office.mave.si:749
default_domain = office.mave.si
}

[default_realm]
.office.mave.si = OFFICE.MAVE.SI
office.mave.si = OFFICE.MAVE.SI

[logging]
default = FILE:/var/log/krb5/libs.log
kdc = FILE:/var/log/krb5/kdc.log
admin_server = FILE:/var/log/krb5/admin.log


----
/etc/hosts
# /etc/hosts: Local Host Database
#
# This file describes a number of aliases-to-address mappings for the for
# local hosts that share this file.
#
# In the presence of the domain name service or NIS, this file may not be
# consulted at all; see /etc/host.conf for the resolution order.
#

# IPv4 and IPv6 localhost aliases
127.0.0.1 localhost
::1 localhost
127.0.0.1 office
127.0.0.1 office.mave.si

192.168.1.16 office.mave.si office

----
cat /etc/resolv.conf
# Generated by net-scripts for interface lo
domain mave.si


Regards,
Luka



On Thu, Jan 9, 2014 at 11:17 AM, Rowland Penny
<rowlan...@googlemail.com>wrote:
Luka Goltnik

Mave d.o.o.

E-mail: luka.g...@mave.si

Tel.: + 386 59 951 844

GSM: + 386 40 602 834

www.mave.si

Rowland Penny

unread,
Jan 9, 2014, 5:50:02 AM1/9/14
to
On 09/01/14 10:31, Luka Goltnik wrote:
> Rowland hello,
>
> o.m.s was just my attempt to try and shorten the whole thing o stands
> for office m stands for mave and s stands for si.

So, lets be clear here, where you have posted o.m.s, we should read
office.mave.si ??

When you attempt to join from a windows 7 client, just what are you
entering as the realm/workgroup ??

> As for files, here they are:
>
> /etc/samba/smb.conf
> # Global parameters
> [global]
> workgroup = MAVE.SI <http://MAVE.SI>

I have a feeling that you cannot use a dot in the workgroup name, i.e.
MAVE_SI would be ok, but MAVE.SI as you have it wouldn't.

> realm = OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
> netbios name = OFFICE
> server role = active directory domain controller
> dns forwarder = 193.2.1.66
> idmap_ldb:use rfc2307 = yes
> server services = smb,dns,kdc
> local master = yes
> preferred master = yes
>
>
> [netlogon]
> path = /var/lib/samba/sysvol/office.mave.si/scripts
> <http://office.mave.si/scripts>
> read only = No
>
> [sysvol]
> path = /var/lib/samba/sysvol
> read only = No
>
> ------
> /etc/krb5.conf
> [libdefaults]
> default_realm = OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
> dns_lookup_realm = false
> dns_lookup_kdc = true
> ticket_lifetime = 24h
> forwardable = yes
>
> [kdc]
> check-ticket-addresses = false
>
> [realms]
> OFFICE.MAVE.SI <http://OFFICE.MAVE.SI> = {
> kdc = office.mave.si:88 <http://office.mave.si:88>
> admin_server = office.mave.si:749
> <http://office.mave.si:749>
> default_domain = office.mave.si <http://office.mave.si>
> }
>
> [default_realm]
> .office.mave.si <http://office.mave.si> = OFFICE.MAVE.SI
> <http://OFFICE.MAVE.SI>
> office.mave.si <http://office.mave.si> = OFFICE.MAVE.SI
> <http://OFFICE.MAVE.SI>
>
> [logging]
> default = FILE:/var/log/krb5/libs.log
> kdc = FILE:/var/log/krb5/kdc.log
> admin_server = FILE:/var/log/krb5/admin.log
>
>
Try changing the above file to this: (the default samba4 one)

[libdefaults]
default_realm = OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
dns_lookup_realm = false
dns_lookup_kdc = true

> ----
> /etc/hosts
> # /etc/hosts: Local Host Database
> #
> # This file describes a number of aliases-to-address mappings for the for
> # local hosts that share this file.
> #
> # In the presence of the domain name service or NIS, this file may not be
> # consulted at all; see /etc/host.conf for the resolution order.
> #
>
> # IPv4 and IPv6 localhost aliases
> 127.0.0.1 localhost
> ::1 localhost
> 127.0.0.1 office
> 127.0.0.1 office.mave.si <http://office.mave.si>
>
> 192.168.1.16 office.mave.si <http://office.mave.si> office
>
> ----

Hmm, the 127.0.0.1 line should probably be just '127.0.0.1 office'

> cat /etc/resolv.conf
> # Generated by net-scripts for interface lo
> domain mave.si <http://mave.si>
>
>
And here is probably your main problem, it is not pointing to your samba
dns server, it should be:

search mave.si <http://mave.si>
domain <http://mave.si>mave.si <http://mave.si>
nameserver 127.0.0.1

Rowland

> Regards,
> Luka
>
>
>
> On Thu, Jan 9, 2014 at 11:17 AM, Rowland Penny
> <rowlan...@googlemail.com <mailto:rowlan...@googlemail.com>> wrote:
>
> On 09/01/14 09:59, Luka Goltnik wrote:
>
> Dear Derek,
>
> thank you for your reply.
>
>
> On Wed, Jan 8, 2014 at 11:28 PM, Werthmuller, Derek
> <dwer...@ctg.albany.edu <mailto:dwer...@ctg.albany.edu>
> <http://OFFICE.MAVE.SI>":
>
> The query was for the SRV record for
> _ldap._tcp.dc._msdcs.OFFICE.MAVE.SI <http://msdcs.OFFICE.MAVE.SI>
>
> The following domain controllers were identified by the query:
> office.office.mave.si <http://office.office.mave.si>
>
> Could you please post your krb5.conf, smb.conf, /etc/hostname,
> /etc/hosts and /etc/resolv.conf files.
> The problem, as I see it, is that samba seems to be trying to
> contact 'OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>' but you keep
> referring to 'o.m.s' which appears to be the initial letters of
> the domain name.
>
> Rowland
>
>
> However no domain controllers could be contacted.
> "
> Which (at least I think so) implies, that the client managed
> to contact the
> DNS server on o.m.s, but got the reply *o.o.m.s* instead of
> *o.m.s* or IP
>
> address alone.
>
> Any thoughts?
>
>
> Thanks for your help.
>
> Regards,
> Luka
>
>
>
>
>
> --
>
> Luka Goltnik
>
> Mave d.o.o.
>
> E-mail: luka.g...@mave.si <mailto:luka.g...@mave.si>**
>
> Tel.: + 386 59 951 844
>
> GSM: + 386 40 602 834
>
> www.mave.si <http://www.mave.si>

Luka Goltnik

unread,
Jan 9, 2014, 6:10:02 AM1/9/14
to
On Thu, Jan 9, 2014 at 11:47 AM, Rowland Penny
<rowlan...@googlemail.com>wrote:

> On 09/01/14 10:31, Luka Goltnik wrote:
>
> Rowland hello,
>
> o.m.s was just my attempt to try and shorten the whole thing o stands
> for office m stands for mave and s stands for si.
>
>
> So, lets be clear here, where you have posted o.m.s, we should read
> office.mave.si ??
>

Yes, that is correct


>
> When you attempt to join from a windows 7 client, just what are you
> entering as the realm/workgroup ??
>

I'm entering OFFICE.MAVE.SI
Entering just MAVE.SI gives me a completely different error:
"
An error occurred when DNS was queried for the service location (SRV)
resource record used to locate an Active Directory Domain Controller (AD
DC) for domain "MAVE.SI".

The error was: "No records found for given DNS query."
(error code 0x0000251D DNS_INFO_NO_RECORDS)

The query was for the SRV record for _ldap._tcp.dc._msdcs.MAVE.SI
"
Which kind of makes sense, since I get this answer from my server:
# host -t SRV _ldap._tcp.dc._msdcs.MAVE.SI
_ldap._tcp.dc._msdcs.MAVE.SI has no SRV record


As for files, here they are:
>
> /etc/samba/smb.conf
> # Global parameters
> [global]
> workgroup = MAVE.SI
>
>
> I have a feeling that you cannot use a dot in the workgroup name, i.e.
> MAVE_SI would be ok, but MAVE.SI as you have it wouldn't.
>

I can just change it to MAVE in case that that's the problem. The only
question is, do I have to go through the whole initialization of samba all
over again?

>
> Try changing the above file to this: (the default samba4 one)
>
>
> [libdefaults]
> default_realm = OFFICE.MAVE.SI
> dns_lookup_realm = false
> dns_lookup_kdc = true
>

Did that and it Kerberos still works, if I try testing it with kinit and
klist commands.


> ----
> /etc/hosts
> # /etc/hosts: Local Host Database
> #
> # This file describes a number of aliases-to-address mappings for the for
> # local hosts that share this file.
> #
> # In the presence of the domain name service or NIS, this file may not be
> # consulted at all; see /etc/host.conf for the resolution order.
> #
>
> # IPv4 and IPv6 localhost aliases
> 127.0.0.1 localhost
> ::1 localhost
> 127.0.0.1 office
> 127.0.0.1 office.mave.si
>
> 192.168.1.16 office.mave.si office
>
> ----
>
>
> Hmm, the 127.0.0.1 line should probably be just '127.0.0.1 office'
>

I removed the other one now.


> cat /etc/resolv.conf
> # Generated by net-scripts for interface lo
> domain mave.si
>
>
> And here is probably your main problem, it is not pointing to your
> samba dns server, it should be:
>
> search mave.si
> domain <http://mave.si>mave.si
> nameserver 127.0.0.1
>

And did this as well.

But I still have the same problem joining client to domain as I did before.


Regards,
Luka

Rowland Penny

unread,
Jan 9, 2014, 6:40:01 AM1/9/14
to
On 09/01/14 11:03, Luka Goltnik wrote:
>
> On Thu, Jan 9, 2014 at 11:47 AM, Rowland Penny
> <rowlan...@googlemail.com <mailto:rowlan...@googlemail.com>> wrote:
>
> On 09/01/14 10:31, Luka Goltnik wrote:
>> Rowland hello,
>>
>> o.m.s was just my attempt to try and shorten the whole thing o
>> stands for office m stands for mave and s stands for si.
>
> So, lets be clear here, where you have posted o.m.s, we should
> read office.mave.si <http://office.mave.si> ??
>
>
> Yes, that is correct
>
>
> When you attempt to join from a windows 7 client, just what are
> you entering as the realm/workgroup ??
>
>
> I'm entering OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
> Entering just MAVE.SI <http://MAVE.SI> gives me a completely different
> error:
> "
> An error occurred when DNS was queried for the service location (SRV)
> resource record used to locate an Active Directory Domain Controller
> (AD DC) for domain "MAVE.SI <http://MAVE.SI>".
>
> The error was: "No records found for given DNS query."
> (error code 0x0000251D DNS_INFO_NO_RECORDS)
>
> The query was for the SRV record for _ldap._tcp.dc._msdcs.MAVE.SI
> <http://msdcs.MAVE.SI>
> "
> Which kind of makes sense, since I get this answer from my server:
> # host -t SRV _ldap._tcp.dc._msdcs.MAVE.SI <http://msdcs.MAVE.SI>
> _ldap._tcp.dc._msdcs.MAVE.SI <http://msdcs.MAVE.SI> has no SRV record
>
>> As for files, here they are:
>>
>> /etc/samba/smb.conf
>> # Global parameters
>> [global]
>> workgroup = MAVE.SI <http://MAVE.SI>
>
> I have a feeling that you cannot use a dot in the workgroup name,
> i.e. MAVE_SI would be ok, but MAVE.SI <http://MAVE.SI> as you have
> it wouldn't.
>
>
> I can just change it to MAVE in case that that's the problem. The only
> question is, do I have to go through the whole initialization of samba
> all over again?
>
>>
> Try changing the above file to this: (the default samba4 one)
>
>
> [libdefaults]
> default_realm = OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
> dns_lookup_realm = false
> dns_lookup_kdc = true
>
>
> Did that and it Kerberos still works, if I try testing it with kinit
> and klist commands.
>
>
>> ----
>> /etc/hosts
>> # /etc/hosts: Local Host Database
>> #
>> # This file describes a number of aliases-to-address mappings for
>> the for
>> # local hosts that share this file.
>> #
>> # In the presence of the domain name service or NIS, this file
>> may not be
>> # consulted at all; see /etc/host.conf for the resolution order.
>> #
>>
>> # IPv4 and IPv6 localhost aliases
>> 127.0.0.1 localhost
>> ::1 localhost
>> 127.0.0.1 office
>> 127.0.0.1 office.mave.si <http://office.mave.si>
>>
>> 192.168.1.16 office.mave.si <http://office.mave.si> office
>>
>> ----
>
> Hmm, the 127.0.0.1 line should probably be just '127.0.0.1 office'
>
>
> I removed the other one now.
>
>> cat /etc/resolv.conf
>> # Generated by net-scripts for interface lo
>> domain mave.si <http://mave.si>
>>
>>
> And here is probably your main problem, it is not pointing to your
> samba dns server, it should be:
>
> nameserver 127.0.0.1
>
>
> And did this as well.
>
> But I still have the same problem joining client to domain as I did
> before.
>
>
> Regards,
> Luka

Hi, did you alter smb.conf in any way ??

I would have expected the [global] part to look like this:

[global]
workgroup = MAVE.SI
realm = office.mave.si
netbios name = OFFICE
server role = active directory domain controller
dns forwarder = 193.2.1.66
idmap_ldb:use rfc2307 = yes

Rowland

Luka Goltnik

unread,
Jan 9, 2014, 6:50:01 AM1/9/14
to
Hi!

No I haven't, but I'm happy to report that I just got it working! :-)
You were right, the problem was the dot in the workgroup name. So I deleted
all the files and did the whole samba configuration again and I'm happy to
report, I managed to join the client computer to the domain. I couldn't be
more happy right now!

Thank you very much for your help! ;-)

Now off to setting up file shares and users. :-)

Best wishes,
Luka


On Thu, Jan 9, 2014 at 12:36 PM, Rowland Penny
<rowlan...@googlemail.com>wrote:

> On 09/01/14 11:03, Luka Goltnik wrote:
>
>
> On Thu, Jan 9, 2014 at 11:47 AM, Rowland Penny <
> rowlan...@googlemail.com> wrote:
>
>> On 09/01/14 10:31, Luka Goltnik wrote:
>>
>> Rowland hello,
>>
>> o.m.s was just my attempt to try and shorten the whole thing o stands
>> for office m stands for mave and s stands for si.
>>
>>
>> So, lets be clear here, where you have posted o.m.s, we should read
>> office.mave.si ??
>>
>
> Yes, that is correct
>
>
>>
>> When you attempt to join from a windows 7 client, just what are you
>> entering as the realm/workgroup ??
>>
>
> I'm entering OFFICE.MAVE.SI
> Entering just MAVE.SI gives me a completely different error:
> "
> An error occurred when DNS was queried for the service location (SRV)
> resource record used to locate an Active Directory Domain Controller (AD
> DC) for domain "MAVE.SI".
>
> The error was: "No records found for given DNS query."
> (error code 0x0000251D DNS_INFO_NO_RECORDS)
>
> The query was for the SRV record for _ldap._tcp.dc._msdcs.MAVE.SI
> "
> Which kind of makes sense, since I get this answer from my server:
> # host -t SRV _ldap._tcp.dc._msdcs.MAVE.SI
> _ldap._tcp.dc._msdcs.MAVE.SI has no SRV record
>
>
> As for files, here they are:
>>
>> /etc/samba/smb.conf
>> # Global parameters
>> [global]
>> workgroup = MAVE.SI
>>
>>
>> I have a feeling that you cannot use a dot in the workgroup name, i.e.
>> MAVE_SI would be ok, but MAVE.SI as you have it wouldn't.
>>
>
> I can just change it to MAVE in case that that's the problem. The only
> question is, do I have to go through the whole initialization of samba all
> over again?
>
>>
>> Try changing the above file to this: (the default samba4 one)
>>
>>
>> [libdefaults]
>> default_realm = OFFICE.MAVE.SI
>> dns_lookup_realm = false
>> dns_lookup_kdc = true
>>
>
> Did that and it Kerberos still works, if I try testing it with kinit and
> klist commands.
>
>
>> ----
>> /etc/hosts
>> # /etc/hosts: Local Host Database
>> #
>> # This file describes a number of aliases-to-address mappings for the for
>> # local hosts that share this file.
>> #
>> # In the presence of the domain name service or NIS, this file may not be
>> # consulted at all; see /etc/host.conf for the resolution order.
>> #
>>
>> # IPv4 and IPv6 localhost aliases
>> 127.0.0.1 localhost
>> ::1 localhost
>> 127.0.0.1 office
>> 127.0.0.1 office.mave.si
>>
>> 192.168.1.16 office.mave.si office
>>
>> ----
>>
>>
>> Hmm, the 127.0.0.1 line should probably be just '127.0.0.1 office'
>>
>
> I removed the other one now.
>
>
>> cat /etc/resolv.conf
>> # Generated by net-scripts for interface lo
>> domain mave.si
>>
>>
>> And here is probably your main problem, it is not pointing to your
>> samba dns server, it should be:
>>
>> search mave.si
>> domain <http://mave.si>mave.si

Rowland Penny

unread,
Jan 9, 2014, 6:50:02 AM1/9/14
to
On 09/01/14 11:44, Luka Goltnik wrote:
> Hi!
>
> No I haven't, but I'm happy to report that I just got it working! :-)
> You were right, the problem was the dot in the workgroup name. So I
> deleted all the files and did the whole samba configuration again and
> I'm happy to report, I managed to join the client computer to the
> domain. I couldn't be more happy right now!
>
> Thank you very much for your help! ;-)
>
> Now off to setting up file shares and users. :-)
>
> Best wishes,
> Luka
>
>
> On Thu, Jan 9, 2014 at 12:36 PM, Rowland Penny
> <rowlan...@googlemail.com <mailto:rowlan...@googlemail.com>> wrote:
>
> On 09/01/14 11:03, Luka Goltnik wrote:
>>
>> On Thu, Jan 9, 2014 at 11:47 AM, Rowland Penny
>> <rowlan...@googlemail.com
>> <mailto:rowlan...@googlemail.com>> wrote:
>>
>> On 09/01/14 10:31, Luka Goltnik wrote:
>>> Rowland hello,
>>>
>>> o.m.s was just my attempt to try and shorten the whole thing
>>> o stands for office m stands for mave and s stands for si.
>>
>> So, lets be clear here, where you have posted o.m.s, we
>> should read office.mave.si <http://office.mave.si> ??
>>
>>
>> Yes, that is correct
>>
>>
>> When you attempt to join from a windows 7 client, just what
>> are you entering as the realm/workgroup ??
>>
>>
>> Entering just MAVE.SI <http://MAVE.SI> gives me a completely
>> different error:
>> "
>> An error occurred when DNS was queried for the service location
>> (SRV) resource record used to locate an Active Directory Domain
>> Controller (AD DC) for domain "MAVE.SI <http://MAVE.SI>".
>>
>> The error was: "No records found for given DNS query."
>> (error code 0x0000251D DNS_INFO_NO_RECORDS)
>>
>> The query was for the SRV record for _ldap._tcp.dc._msdcs.MAVE.SI
>> <http://msdcs.MAVE.SI>
>> "
>> Which kind of makes sense, since I get this answer from my server:
>> # host -t SRV _ldap._tcp.dc._msdcs.MAVE.SI <http://msdcs.MAVE.SI>
>> _ldap._tcp.dc._msdcs.MAVE.SI <http://msdcs.MAVE.SI> has no SRV record
>>
>>> As for files, here they are:
>>>
>>> /etc/samba/smb.conf
>>> # Global parameters
>>> [global]
>>> workgroup = MAVE.SI <http://MAVE.SI>
>>
>> I have a feeling that you cannot use a dot in the workgroup
>> name, i.e. MAVE_SI would be ok, but MAVE.SI <http://MAVE.SI>
>> as you have it wouldn't.
>>
>>
>> I can just change it to MAVE in case that that's the problem. The
>> only question is, do I have to go through the whole
>> initialization of samba all over again?
>>
>>>
>> Try changing the above file to this: (the default samba4 one)
>>
>>
>> [libdefaults]
>> default_realm = OFFICE.MAVE.SI <http://OFFICE.MAVE.SI>
>> dns_lookup_realm = false
>> dns_lookup_kdc = true
>>
>>
>> Did that and it Kerberos still works, if I try testing it with
>> kinit and klist commands.
>>
>>
>>> ----
>>> /etc/hosts
>>> # /etc/hosts: Local Host Database
>>> #
>>> # This file describes a number of aliases-to-address
>>> mappings for the for
>>> # local hosts that share this file.
>>> #
>>> # In the presence of the domain name service or NIS, this
>>> file may not be
>>> # consulted at all; see /etc/host.conf for the resolution order.
>>> #
>>>
>>> # IPv4 and IPv6 localhost aliases
>>> 127.0.0.1 localhost
>>> ::1 localhost
>>> 127.0.0.1 office
>>> 127.0.0.1 office.mave.si <http://office.mave.si>
>>>
>>> 192.168.1.16 office.mave.si <http://office.mave.si> office
>>>
>>> ----
>>
>> Hmm, the 127.0.0.1 line should probably be just '127.0.0.1
>> office'
>>
>>
>> I removed the other one now.
>>
>>> cat /etc/resolv.conf
>>> # Generated by net-scripts for interface lo
>>> domain mave.si <http://mave.si>
>>>
>>>
>> And here is probably your main problem, it is not pointing to
>> your samba dns server, it should be:
>>
>> nameserver 127.0.0.1
>>
>>
>> And did this as well.
>>
>> But I still have the same problem joining client to domain as I
>> did before.
>>
>>
>> Regards,
>> Luka
>
> Hi, did you alter smb.conf in any way ??
>
> I would have expected the [global] part to look like this:
>
> [global]
> workgroup = MAVE.SI <http://MAVE.SI>
> realm = office.mave.si <http://office.mave.si>
>
> netbios name = OFFICE
> server role = active directory domain controller
> dns forwarder = 193.2.1.66
> idmap_ldb:use rfc2307 = yes
>
> Rowland
>
>
Glad you got it work, perhaps this should be somewhere on the wiki ??

Luka Goltnik

unread,
Jan 10, 2014, 8:20:02 AM1/10/14
to
On Thu, Jan 9, 2014 at 12:46 PM, Rowland Penny
<rowlan...@googlemail.com>wrote:
>
> Glad you got it work, perhaps this should be somewhere on the wiki ??
>
> Rowland
>

I think this is definitely worth mentioning on the wiki. For novices in the
world of Samba4 and active directories and domain controllers, this is
quite important piece of information.

Regards,
Luka
0 new messages