Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured a Fedora 11 installation to join our domain. It seems to join successfully (though it reports a DNS update failure) but when I try to access \\fedoraserver.test.mycompany.com I'm prompted for a password. So I enter adminuser and the password and that fails, so I try test.mycompany.com\adminuser and that too fails. What am I missing?

EDIT (Update 9/1/09): I can now connect to the machine and see the shares on it (see my response to djhowell's answer) but when I try to connect, I get an error saying The network path was not found. I checked the log entry on the Fedora computer for the computer I'm connecting from (/var/log/samba/log.ComputerX) and it reads:

[2009/09/01 12:02:46,  1] libads/cldap.c:recv_cldap_netlogon(157)
    no reply received to cldap netlogon
[2009/09/01 12:02:46,  1] libads/ldap.c:ads_find_dc(417)
    ads_find_dc: failed to find a valid DC on our site (Default-First-Site-Name), trying to find another DC

Config files as of 9/1/09:

smb.conf:

[global]
Workgroup = TEST
realm = TEST.MYCOMPANY.COM
password server = DC.TEST.MYCOMPANY.COM
security = DOMAIN
server string = Test Samba Server
log file = /var/log/samba/log.%m
max log size = 50
idmap uid = 15000-20000
idmap gid = 15000-20000
windbind use default domain = yes
cups options = raw
client use spnego = no
server signing = auto
client signing = auto

[share]
comment = Test Share
path = /mnt/storage1
valid users = adminuser
admin users = adminuser
read list = adminuser
write list = adminuser
read only = No

I also set the krb5.conf file to look like this:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = test.mycompany.com
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
TEST.MYCOMPANY.COM = {
 kdc = dc.test.mycompany.com
 admin_server = dc.test.mycompany.com
 default_domain = test.mycompany.com
}

[domain_realm]
dc.test.mycompany.com = test.mycompany.com
.dc.test.mycompany.com = test.mycompany.com

[appdefaults]
pam = {
 debug = false
 ticket_lifetime = 36000
 renew_lifetime = 36000
 forwardable = true
 krb4_convert = false
}

I realize that there might be an issue with EXAMPLE.COM in there, however if I change it to TEST.MYCOMPANY.COM then it fails to join the domain with a preauthentication failure. As of 9/1/09, this is no longer the case.

share|improve this question
add comment

3 Answers

From the linux box try:

$ kinit your_username

And enter your password. Then enter:

$ klist

And see if you have a valid kerberos ticket.

In my krb5.conf file I do not have any port numbers in my realms section. Additionally, in the domain_realm section I have something like this:

MY-DC1.COMPANY.COM = COMPANY.COM
.MY-DC1.COMPANY.COM = COMPANY.COM

Try changing the left side of those lines to point directly to the domain controller you're going to authenticate to.

share|improve this answer
    
I tried kinit, and it said Cannot find KDC for requested realm. So I made the corrections you suggested to my krb5.conf file and fixed the EXAMPLE.COM entry and was successfully able to run kinit, klist and kdestroy. I then redid the net ads join command, which succeeded (except for the "DNS update failed!" message again) and I can now use \\fedoraserver.test.mycompany.com to browse the shares. However, if I try to open one, I get the message "The network name cannot be found." Now what? –  jasonh Aug 26 '09 at 20:55
    
Try doing a: $ net ads dns register -I <IP of your AD> -U Administrator That may get the DNS error resolved. In regards to the actual share... Double check the path of the share in smb.conf and the permissions of that path. Try setting the permissions to 777 with chmod -R 777 /mnt/path and see if you can access it. You can modify the permissions back to something more restrictive once you figure out if it is indeed a permissions issue. –  djhowell Aug 26 '09 at 21:18
    
The first command didn't go over so well. The result is: ads_connect: No logon servers –  jasonh Aug 26 '09 at 21:40
    
I also tried chmod -R 777 on the mounted path for the share, but that didn't solve the issue accessing the share. –  jasonh Aug 26 '09 at 21:45
add comment

Sorry for the late reply but maybe I can help someone with the DNS problem once he/she has it. I resolved the DNS problem by adding a mapping to the Fully Qualified DomainName to the address of the Domain Controller such as so:

Domain: herazio.com DC: HER-PDC

/etc/hosts file: HER-PDC.herazio.com 192.50.2.2

This resolved the DNS issue for me luckily.

Regards hope it was useful.

share|improve this answer
add comment

I would expect that the DNS update failure is your clue here - Windows/Linux (or Unix) interoperability is by no means as seamless as it's sometimes advertised to be. Make sure that your other machines can resolve name-to-IP and IP-to-name for the new box, and if not, add the appropriate DNS records. Then try it and see what happens.

Also worth checking out the IP configuration for the new box to ensure that it's got the correct settings there.

share|improve this answer
    
Yep, I can ping the Linux machine just fine and the Windows machine resolves the IP address of it, and vice-versa. Both machines can also resolve the IP address of the domain server. –  jasonh Aug 26 '09 at 20:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.