I try to join Active Directory and Samba 4 in Ubuntu 12.04.05.
When I run host -t SRV _kerberos._udp.test.sg I get the error:

Host _kerberos._udp.test.sg not found: 3(NXDOMAIN)


$# host -t SRV _ldap._tcp.test.sg 
_ldap._tcp.test.sg has SRV record 0 0 389 4ecapsvsg6.test.sg.
$# host -t A 4ECAPSVSG6.test.sg
4ECAPSVSG6.test.sg has address

My /etc/samba/smb.conf:

# Global parameters
   workgroup = TEST
   realm = TEST.SG
   netbios name = 4ECAPSVSG6
   server role = active directory domain controller
   dns forwarder =
   security = ads
   use kerberos keytab = true
   password server = 4ecapsvsg6.test.sg
   allow dns updates = nonsecure and secure
   bind interfaces only = no
   server services = +smb -s3fs
   dcerpc endpoint servers = +winreg +srvsvc
   passdb backend = samba4
   server services = smb, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc, dnsupdate, dns 

My /etc/krb5.conf:

    default_realm = TEST.SG
    krb4_config = /etc/krb.conf
    krb4_realms = /etc/krb.realms
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true
     4ECAP.SG = {
          kdc = 4ecapsvsg6.test.sg:88
          admin_server = 4ecapsvsg6.test.sg:749
          default_domain = test.sg
    .test.sg = TEST.SG
    test.sg = TEST.SG
    krb4_convert = true
    krb4_get_tickets = false

My /etc/hosts:       localhost       4ecapsvsg6
  # The following lines are desirable for IPv6 capable hosts
  ::1     ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
  ff00::0 ip6-mcastprefix
  ff02::1 ip6-allnodes
  ff02::2 ip6-allrouters     4ecapsvsg6.test.sg     4ecapsvsg6

What is the solution? Without it I cannot run join domain with command:

sudo net ads join

which comes out error like

Failed to join domain: failed to lookup DC info for domain 'TEST' over rpc: Logon failure

I did kinit administrator and klist, result:

   Ticket cache: FILE:/tmp/krb5cc_0
   Default principal: administrator@TEST.SG
    Valid starting       Expires              Service principal
    26/03/2015 14:29:04  27/03/2015 00:29:04  krbtgt/TEST.SG@TEST.SG
    renew until 27/03/2015 14:29:00
  • The DNS lookup for _kerberos._udp.test.sg is important. I suggest you look to fixing that before trying to continue. Is your /etc/resolv.conf valid and correct? – roaima Mar 31 '15 at 8:59
  • @roaima here is my list of /etc/resolv.conf nameserver nameserver search test.sg domain test.sg – AdhiDazz Mar 31 '15 at 9:05
  • Please edit it into the question so that (a) all the information is together, (b) the formatting lets it be readable. As a follow-up, though, you need to get rid of that and point your nameservers exclusively at your domain controllers. – roaima Mar 31 '15 at 9:27
  • @AdhiDazz We don't use "Solved" here, if your question is answered or you have answered it your self(as you have)... just mark that as the right answer with the icon below where you up/down vote the answers. – somethingSomething Apr 2 '15 at 10:34
  • @somethingSomething thanks i'll keep that in mind – AdhiDazz Apr 6 '15 at 8:57

After i google this past week, lucky i found this site http://edoceo.com/howto/samba4

Happens to be i need to edit my dnsmasq (/etc/dnsmasq.conf) add this line :

srv-host=_kerberos._tcp.test.sg,4ecapsvsg6.test.sg,88 srv-host=_kerberos._tcp.dc._msdcs.test.sg,4ecapsvsg6.test.sg,88 srv-host=_kerberos._udp.test.sg,4ecapsvsg6.test.sg,88

srv-host=_kpasswd._tcp.test.sg,4ecapsvsg6.test.sg,464 srv-host=_kpasswd._udp.test.sg,4ecapsvsg6.test.sg,464

and disable Bind9 (which installed along with Samba4 by default)

Now the problems gone :)

Only one problems remains, how to connect to AD (which i'll open another thread for that)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.