I've got a Samba4 installation set up as a backup domain controller:
james@photon:~$ testparm Load smb config files from /etc/samba/smb.conf rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[homes]" Processing section "[netlogon]" Processing section "[profiles]" Processing section "[printers]" Processing section "[print$]" Loaded services file OK. Server role: ROLE_DOMAIN_BDC Press enter to see a dump of your service definitions [global] workgroup = NT4Domain server string = %h NT4 BDC (Samba4, Linux) interfaces = lo, eth1 bind interfaces only = Yes server role = classic backup domain controller map to guest = Bad User obey pam restrictions = Yes passdb backend = ldapsam:ldap://127.0.0.1/ pam password change = Yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . syslog = 0 log file = /var/log/samba/log.%m max log size = 1000 name resolve order = wins, bcast, hosts client signing = if_required server signing = if_required add user script = /usr/sbin/smbldap-useradd -m '%u' -t 1 add group script = /usr/sbin/smbldap-groupadd -p '%g' add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g' set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u' add machine script = /usr/sbin/smbldap-useradd -w '%u' -t 1 logon script = scripts\logon.cmd logon path = \\%L\profiles\%U logon drive = H: logon home = \\%L\%U domain logons = Yes domain master = No dns proxy = No wins server = ip.of.nt4.box ldap admin dn = cn=admin,dc=thisdomain ldap group suffix = ou=Groups ldap idmap suffix = ou=Idmap ldap machine suffix = ou=People ldap passwd sync = yes ldap suffix = dc=thisdomain ldap ssl = no ldap timeout = 20 ldap user suffix = ou=People usershare allow guests = Yes panic action = /usr/share/samba/panic-action %d winbind cache time = 3600 winbind enum users = Yes winbind enum groups = Yes winbind use default domain = Yes winbind offline logon = Yes idmap config * : backend = tdb ea support = Yes map acl inherit = Yes [homes] comment = Home Directories valid users = %S read only = No create mask = 0775 directory mask = 0775 browseable = No [netlogon] comment = Network Logon Service path = /home/samba/netlogon guest ok = Yes [profiles] comment = Users profiles path = /home/samba/profiles create mask = 0600 directory mask = 0700 browseable = No [printers] comment = All Printers path = /var/spool/samba create mask = 0700 printable = Yes print ok = Yes browseable = No [print$] comment = Printer Drivers path = /var/lib/samba/printers write list = root, @lpadmin
It is joined to my NT4 domain. The shared printer is accessible, the netlogon share is visible, the user shares are visible and browsable by the correct (locally set up) users from Windows machines in the domain. The machine account is visible in the NT4 domain controller. It works.
However, I can't get net rpc vampire to work. There are several hundred user accounts stored on the NT4 domain controller, and I need to get the synchronised to the (working) LDAP instance on the Samba machine so that we can decomission the NT4 machine.
james@photon:~$ sudo net rpc join -U NT4AdminAccount%secret Joined domain NT4Domain.
sudo net rpc vampire -U NT4AdminAccount%secret DC is not running Active Directory cli_rpc_pipe_open_schannel: failed to get schannel session key from server 127.0.0.1 for domain NT4Domain. Could not initialise schannel netlogon pipe. Error was NT_STATUS_ACCESS_DENIED
sudo net rpc vampire -S NT4DC -U NT4AdminAccount%secret DC is not running Active Directory cli_rpc_pipe_open_schannel: failed to get schannel session key from server data1 for domain ATMOS. Could not initialise schannel netlogon pipe. Error was NT_STATUS_INVALID_COMPUTER_NAME
The relevant lines I see when trying to run vampire with -d=10 are:
result : NT_STATUS_INVALID_COMPUTER_NAME get_schannel_session_key_common: rpccli_netlogon_setup_creds failed with result NT_STATUS_INVALID_COMPUTER_NAME to server NT4DC, domain NT4Domain, machine account SAMBASERVER. cli_rpc_pipe_open_schannel: failed to get schannel session key from server data1 for domain ATMOS. Could not initialise schannel netlogon pipe. Error was NT_STATUS_INVALID_COMPUTER_NAME return code = -1 Freeing parametrics:
So, after all that, what's wrong? Is vampire now broken? I keep reading that it's been deprecated, but all the documentation I've seen for doing this with samba-tool domain join is about joining an active directory domain. That's not what we want to do. I'm also reading a lot about Kerberos in the context of the schannel session key error, but that's an active directory thing too isn't it? I though NT4 used LANMAN for those functions now covered by Kerberos. It seems only to be the vampire operation I'm having difficulty with. Everything else seems to work fine...
Thanks in advance.