1

In the office I'm currently working is the following setup:

  • a linux server managing the accounts for single sign on, shares and printers. This will be called 'server129' and should not be modified. (if possible)
  • several Windows XP Clients that need to be replaced. It is possible to login an arbitrary Client PC and the files and settings are automatically available (single sign on).

In the first step I want to integrate a new Client PC into the existing network. This new client is a fresh Linux Mint 18.3 and is called 'pc135'. I have problems integrating the new client into the existing network.

I did not set up the machines. The person who did it, is not available anymore. I'm myself no expert with unix and only have small experience. So i try to include as many as possible relevant information.

In the following is a description of the settings and already done tests.


Network

My office is part of a greater network, but i could manage to configure the IP's and DNS. From the Client 'pc135' i can ping 'server129' by it's name server129, by server129.subdomain.domain.com and by IP. From the server129 I can ping the client pc135. So I assume the network is fine.


Server Configuration

This server is actively used and should remain untouched if possible. I have sudo rights.

Everything seems to be shared by samba. For the XP Clients someone unknown wrote two scripts for adding users and new clients

new Client

useradd -s /bin/false $1\$
smbpasswd -a -m $1\$

new User

useradd -s /bin/false $1\$
smbpasswd -a -m $1\$

So I'm assuming everything is managed by samba. On the server 'Samba version 3.0.24' is installed and testparm results in

Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[printers]"
Processing section "[print$]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions

[global]
    workgroup = MYWORKGROUP
    server string = %h server
    obey pam restrictions = Yes
    passdb backend = tdbsam
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    name resolve order = lmhosts host wins bcast
    logon drive = H:
    domain logons = Yes
    os level = 200
    preferred master = Yes
    domain master = Yes
    dns proxy = No
    wins support = Yes
    panic action = /usr/share/samba/panic-action %d
    profile acls = Yes
    hide files = /desktop.ini/Desktop.ini/

[homes]
    comment = Home Directories
    valid users = %S
    read only = No
    create mask = 0700
    directory mask = 0700
    browseable = No

[netlogon]
    comment = Network Logon Service
    path = /home/samba/netlogon
    guest ok = Yes
    share modes = No

[profiles]
    comment = Users profiles
    path = /home/samba/profiles
    create mask = 0600
    directory mask = 0700
    browseable = No

[printers]
    comment = All Printers
    path = /var/spool/samba
    create mask = 0700
    printable = Yes
    browseable = No

[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers

Client Configuration

After a fresh install i managed to get the network working. Locally i have an account with sudo rights. Version: 'Samba version 4.3.11-Ubuntu'

I tested for quite some time with the samba config and didn't get the new client to join the domain. I used this description.

Here is my samba client config which is the most promising version.

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
WARNING: The "idmap uid" option is deprecated
WARNING: The "idmap gid" option is deprecated
WARNING: The "syslog" option is deprecated
Processing section "[printers]"
Processing section "[print$]"
Loaded services file OK.
'winbind separator = +' might cause problems with group membership.

Server role: ROLE_DOMAIN_MEMBER

Press enter to see a dump of your service definitions

# Global parameters
[global]
    workgroup = MYWORKGROUP
    server string = %h server (Samba, Ubuntu)
    server role = member server
    security = DOMAIN
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    client signing = if_required
    server signing = if_required
    os level = 0
    preferred master = No
    local master = No
    domain master = No
    dns proxy = No
    wins server = server129
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    template homedir = /home/%U
    template shell = /bin/bash
    winbind separator = +
    winbind cache time = 10
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    client ipc signing = if_required
    idmap config * : range = 10000-20000
    idmap config * : backend = tdb


[printers]
    comment = All Printers
    path = /var/spool/samba
    create mask = 0700
    printable = Yes
    browseable = No


[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers

At first I didn't get any connection. After googling i added

   client ipc signing = auto
   server signing = auto
   client signing = auto

and now I can see the domain infos.

net rpc info
Enter root's password:
Domain Name: MYWORKGROUP
Domain SID: S-1-5-21-2587772309-3456421220-248070441
Sequence number: 1516110814
Num users: 59
Num domain groups: 0
Num local groups: 0

Additionally I see the other Clients in the filemanager

But i can't see the users or join the domain.

sudo net rpc user
Enter root's password: 
session setup failed: NT_STATUS_NO_LOGON_SERVERS

net rpc join
No realm has been specified! Do you really want to join an Active Directory server?
Enter root's password:
No realm has been specified! Do you really want to join an Active Directory server?
connect_to_domain_password_server: unable to open the domain client session to machine SERVER129. Flags[0x00000000] Error was : NT_STATUS_ACCESS_DENIED.
Failed to join domain: failed to verify domain membership after joining: Access denied

The corresponding logs

[2018/01/16 14:58:57.547800,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine SERVER129. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2018/01/16 14:58:57.557704,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine SERVER129. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2018/01/16 14:58:57.567853,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine SERVER129. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2018/01/16 14:58:57.568229,  0] ../source3/auth/auth_domain.c:184(domain_client_validate)
  domain_client_validate: Domain password server not available.

So what possibilities do I have? The most guides are something with active directory , kerberus and many other technologies/packages. A first step would be specifying what is running on the server. Or better what is not running. I guess that it is not running active directory and ldap. how can i confirm this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.