I have a CentOS 6.4 box with SerNet's Samba 4.0.8 installed and no smb.conf file yet, as it should be. I want it to become an AD DC in my existing Windows domain, replicating from the existing Windows Server 2003 box. I have SELinux enabled and want it to stay that way in the end, but would be willing to attempt to disable it temporarily. But I've run
sudo setsebool -P samba_domain_controller on and
sudo setsebool -P samba_enable_home_dirs on and they returned no errors.
Also I opted to try using Samba 4's internal DNS rather than BIND.
I'm getting this error trying to run samba-tool:
$ sudo samba-tool domain join currentwindowsadserver.mydomain.lan DC -Uadministrator --realm=currentwindowsadserver.mydomain.lan Finding a writeable DC for domain 'currentwindowsadserver.mydomain.lan' ERROR(exception): uncaught exception - Failed to find a writeable DC for domain 'currentwindowsadserver.mydomain.lan' File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs) File "/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py", line 552, in run machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend) File "/usr/lib64/python2.6/site-packages/samba/join.py", line 1082, in join_DC machinepass, use_ntvfs, dns_backend, promote_existing) File "/usr/lib64/python2.6/site-packages/samba/join.py", line 73, in __init__ ctx.server = ctx.find_dc(domain) File "/usr/lib64/python2.6/site-packages/samba/join.py", line 246, in find_dc raise Exception("Failed to find a writeable DC for domain '%s'" % domain)
Same situation as described here, but the suggested
-S does not seem to exist anymore--it spits out usage directions when I try it and said:
samba-tool domain join: error: no such option: -S
I tried adding the old and new to
/etc/hosts but that didn't change the results.
klist work as they should, and
host -t A mynewserver also produces correct output (giving the correct IP and the correct name, see below.)
Currently, my windows AD server has 5 names and 5 IP addresses, but if I ping it from CentOS by its main name that I use for everything Windows (the other 4 I only use for Apache, yes I know, running Apache on Windows...you can see why I'm migrating) it returns correctly as that name. Nonetheless I thought maybe that was causing some problems, so seeing this page (and even
samba-tool domain join -h) I also tried adding
--ipaddress=192.168.1.2 and it said that it wasn't a valid option either:
samba-tool domain join: error: no such option: --ip-address
samba-tool domain info without
DC but otherwise the same parameters as at the start, correctly gives me info about the Windows DC. Also DNS seems to be fine:
$ host -t SRV _ldap._tcp.mydomain.lan _ldap._tcp.mydomain.lan has SRV record 0 100 389 currentwindowsadserver.mydomain.lan $ host -t SRV _kerberos._udp.mydomain.lan _kerberos._udp.mydomain.lan has SRV record 0 100 88 currentwindowsadserver.mydomain.lan $ host -t SRV _ldap._tcp.dc._msdcs.mydomain.lan _ldap._tcp.dc._msdcs.mydomain.lan has SRV record 0 100 389 currentwindowsadserver.mydomain.lan $ host -t SRV _kerberos._tcp.dc._msdcs.mydomain.lan _kerberos._tcp.dc._msdcs.mydomain.lan has SRV record 0 100 88 currentwindowsadserver.mydomain.lan $ host -t SRV _kpasswd._tcp.mydomain.lan _kpasswd._tcp.mydomain.lan has SRV record 0 100 464 currentwindowsadserver.mydomain.lan. $ host -t SRV _kpasswd._udp.mydomain.lan _kpasswd._udp.mydomain.lan has SRV record 0 100 464 currentwindowsadserver.mydomain.lan. $ host -t SRV _ldap._tcp.gc._msdcs.mydomain.lan _ldap._tcp.gc._msdcs.mydomain.lan has SRV record 0 100 3268 currentwindowsadserver.mydomain.lan. $ host -t SRV _gc._tcp.mydomain.lan _gc._tcp.mydomain.lan has SRV record 0 100 3268 currentwindowsadserver.mydomain.lan.
ATM, AFAIK, we're an IPv4-only network (one page mentioned IPv6 issues). I don't see any IPv6 addresses when I ping or run
host -t A or anything like that--if this is the issue I'm not sure what to do to verify or fix it, maybe someone could help me out with that.
sudo netstat -tunpe | grep ":53" returns nothing, and I have iptables open on 445 UDP and TCP. Update, I now have it open on everything listed here except the NetBIOS ones, and reloaded iptables without error, but still no change. I've also tried stopping the iptables service temporarily, no difference.
I also have both
search directives with mydomain.lan after them in
/etc/resolv.conf, as well as
nameserver with the primary IP of the Windows box.
What else could it be? Google isn't giving me much else to try here.