Join AD EFW 2.3

[Guest]

[npeterson]

I've done this 3-4 times now heres what i do:

1. install efw
2. Do the join domain (This will fail, but it saves settings to the server, and creates host entries)
3. Goto console or ssh to server
4. edit the file /var/efw/proxy/settings, remove the NTLM_BDC line
5. run /usr/local/bin/restartsamba.py (this should generate your winbind.conf)
6. Edit /etc/samba/winbind.conf Change the following: Workgroup = <domain short Name> to Workgroup = <Domain Full name, (the same as your realm)>
7. Run: net ads join -U<username> -s /etc/samba/winbind.conf (this will join the pc to the domain. It will say Joined or failed)
8. Wait 15 minutes. This will allow the domain controllers to replicate the new computer login(yes you do have to wait, annoying but take that up with microsoft.)
9. Test by running: wbinfo --configfile=/etc/samba/winbind.conf -t (if it suceeded your golden, you should now be able to see your groups in efw)

[bodo.olschewski]

this way it works here:

pword server = DC.domain.local
realm = domain.local

workgroup = domain

[njtd]

I understand corrent?

realm = FQDN
workgroup = NETBIOS

Thanks

[entourage]

Thanks for being patient.  This is such a pain, especially when my 2.2 went so smooth.

I'm still not able to join.

I know I've run into situations before where it was case sensitive...could that be it?

I tried removing my DNS entry just to see what happened and now when I try to join it's back to "Failed to join domain: Invalid configuration and configuration modification was not requested"
(Doesn't matter if I run it from ssh or try to join from the web interface.)

Putting the DNS entry back I get "Failed to join domain: failed to find DC for domain DOMAIN.LOCAL"  This worries me too because I've changed from Uppercase to lower, but it doesn't reflect that.

[npeterson]

entourage, check your /etc/hosts and make sure your dc's have entries in there, if not create them.
Next go back to the web interface, goto Services->Time Server, Check over ride default time servers, and put the IP addresses of the DC's in there. save, goback to the page, and hit synchronize now.

Your Workgroup should be domain.local ex constco.com NOT JUST Constco.

Try the net join again from below. If it doesnt work let me know

[entourage]

Still fail.

I had previously made sure my time was sync'd, but went ahead and sync'd it with the DC, just for good measure.

Here's a copy of my /etc/hosts:

10.0.0.1   DC.domain.local        DC
127.0.0.1   localhost.localhost localhost
10.0.0.14   EFW23.domain.local EFW23
10.0.0.1   dc.domain.local        dc
10.0.0.14   wpad.domain.local  wpad

I'm still concerned because when I run the restartsamba.py it replaces my domain.local with DOMAIN.LOCAL and I can't for the life of me locate where that's coming from.  It's not in smb.conf, it's not in /proxy/settings, I'm just not sure.

[npeterson]

First we are not using the smb.conf file. if you have it remove it. (winbind.conf is the same format but endian decided to call the configuration something other than the default)

Whats the output of this command:

net ads join -U <admin_user> -s winbind.conf -d 5

[entourage]

Ok, renamed smb.conf to smb.conf.old

Here's the output:

Code:

[2009/11/09 15:11:28,  5] lib/debug.c:debug_dump_status(407)  INFO: Current debug levels:
    all: True/5
    tdb: False/0
    printdrivers: False/0
    lanman: False/0
    smb: False/0
    rpc_parse: False/0
    rpc_srv: False/0
    rpc_cli: False/0
    pdb: False/0
    sam: False/0
    auth: False/0
    winbind: False/0
    vfs: False/0
    idmap: False/0
    quota: False/0
    acls: False/0
    locking: False/0
    msdfs: False/0
    dmapi: False/0
    registry: False/0
[2009/11/09 15:11:28,  3] param/loadparm.c:lp_load_ex(8753)  lp_load_ex: refreshing parameters
[2009/11/09 15:11:28,  3] param/loadparm.c:init_globals(4597)  Initialising global parameters
[2009/11/09 15:11:28,  3] param/params.c:pm_process(569)  params.c:pm_process() - Processing configuration file "winbind.conf"
[2009/11/09 15:11:28,  3] param/loadparm.c:do_section(7416)  Processing section "[global]"
  doing parameter security = ADS
  doing parameter pword server = DC.DOMAIN.LOCAL
  doing parameter realm = DOMAIN.LOCAL
  doing parameter syslog only = Yes
Enter administrator's pword:
Failed to join domain: failed to find DC for domain DOMAIN.LOCAL

[npeterson]

That is the same error i receive when not setting the workgroup correctly.

copy and paste this config into your winbind.conf, change stuff in <> to match your info:

[global]
security = ADS
password server = <Domain Controller FQDN(make sure its in hosts)>
realm = <Domain Name FQ>

# handle logging
syslog only = Yes
log level = 0 winbind:2
syslog = 1
max log size = 1000

local master = no
hosts allow = <Allowed Subnets(green)>
interfaces = br0 br2
bind interfaces only = yes
preferred master = no
dns proxy = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

workgroup = <Domain Name FQ>
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind use default domain = Yes
winbind separator = +
unix charset = UTF8

ntlm auth = Yes
min protocol = NT1
client NTLMv2 auth = Yes
lm announce = No


run: ads joint -U<username> -s/etc/samba/winbind.conf -d5

[entourage]

Unfortunately more of the same.

I copied your winbind.conf and edited the servers.  same message. (failed to find DC for domain DOMAIN.LOCAL)

I can ping the DC, so I know it sees it, however I still get the same message if I type in an incorrect password when it prompts.  (Of course I've tried more than one domain admin account.)

I think since this is running on a VM, I'm going to grab the old 2.2 iso and try the installation again, so I can confirm that at least it will connect.

I'll report back.

[npeterson]

Uhh sounds silly, but your not using domain.local for your domain name are you? It should be your domain name.

Otherwise I'de start from a fresh install again and try the config again.

[entourage]

Nothing sounds silly at this point.   

Yeah, I'm just changing it from the real one before I paste.

[npeterson]

Noticed that after i joined the domain (#7) i missed two steps, you need to stop/start winbind:

I've done this 3-4 times now heres what i do:

1. install efw
2. Do the join domain (This will fail, but it saves settings to the server, and creates host entries)
3. Goto console or ssh to server
4. edit the file /var/efw/proxy/settings, remove the NTLM_BDC line
5. run /usr/local/bin/restartsamba.py (this should generate your winbind.conf)
5.5 Run /etc/init.d/winbind stop
6. Edit /etc/samba/winbind.conf Change the following: Workgroup = <domain short Name> to Workgroup = <Domain Full name, (the same as your realm)>
7. Run: net ads join -U<username> -s /etc/samba/winbind.conf (this will join the pc to the domain. It will say Joined or failed)
7.5 Run /etc/init.d/winbind start
8. Wait 15 minutes. This will allow the domain controllers to replicate the new computer login(yes you do have to wait, annoying but take that up with microsoft.)
9. Test by running: wbinfo --configfile=/etc/samba/winbind.conf -t (if it suceeded your golden, you should now be able to see your groups in efw)

[njtd]

I have success join the domain with npeterson step but I must modify line

pword server = <DC Hostname eg: DC1>
realm = <Domain Name FQ eg: ABC.COM>
workgroup = <NETBIOS eg: ABC>

Thank you very much npeterson.

[entourage]

Ok, well, to prove I'm not crazy I just loaded up a VM with 2.2 and joined the domain successfully the first try.

npeterson, I added the extra step on my clean 2.3 install and it said that /etc/init.d/winbind stop [Failed]
Don't know if that matters?