Active directory broken

Support
,
21

no folder /var/lib/kerberos exists
also, again no /etc/krb5.keytab has been generated

also after expanding the templates again, I still get “Could not connect to accounts provider!”

22

Im not at home il be around 1hr and il see if i can help

23

thanks dude :smile:

24

Sorry about this im ssh into computer whilst walking lol

Check if there is a folder

Var/kerberose

25

If so contents

26 
/var/kerberos/krb5/
/var/kerberos/krb5/.
/var/kerberos/krb5/..
/var/kerberos/krb5kdc/
/var/kerberos/krb5kdc/.
/var/kerberos/krb5kdc/..
/var/kerberos/krb5kdc/kadm5.acl

contents:

*/admin@EXAMPLE.COM *
EOF

/var/kerberos/krb5kdc/kdc.conf

contents:

[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88

[realms]
EXAMPLE.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:
}
EOF

27

Ok remove file kadm5.acl

28

It took a lot of work to get this working after you remove files repeat the steps dont worry if the keytab file is not there for removal i included that incase it got made

29

make sure there is only one folder named krb5 and krb5kdc and inside krb5kdc there is one file called kdc.conf

30

If it still does not work pm me and i can login and have a look for you but this up to you as obviously i need root access

31

i’d be happy enough for you to to log in via anydesk, so i can follow along if thats cool with you… anydesk is totally free to use

32

affirmative

33

yep that’s cool I have just installed it pm me the details

34

Can you guys give some follow up info? Curioys if you managed to solve it and find the problem/root cause

35

right, sorry for the long delay here, took us/me a few hours to sort.

sooo tldr:

  • remove AD via WebUI
  • yum -y reinstall samba samba-dc krb5-server krb5-libs
  • rm /etc/krb5/keytab
  • delete every folder in /var/kerberos/krb5kdc EXCEPT FOR kdc.conf!!
  • rm -rf /var/lib/machines/
  • signal-event nethserver-sssd-remove-provider
  • expand-template /etc/samba/smb.conf
  • expand-template /etc/sssd/sssd.conf
  • expand-template /etc/krb5.conf
  • install AD via WebUI

and that’s done it for me, (note that we didn’t try expanding the krb5.conf template before, I tried that on a hunch)

also, as far as I can tell, the domain chosen for your AD is not as important as initially assumed.

My setup:

DNS domain : home.mitos-kalandiel.me
Hostname : daffy.home.mitos-kalandiel.me
AD Domain: ad.home.mitos-kalandiel.me

I have NOT created a subdomain in DNS for this.

I also had an issue, where I had switched off IPv6 (due to another package that didn’t like binding to an IPv4 interface if IPv6 was available as well, but I have since moved that package off server, so then after re-enabling IPv6 samba was working as expected.

Any questions, don’t hesitate to PM me, this thread can be considered solved/closed. :smile:

36

Morning glad you got it sorted so we left a expand out lol

Sorry droped off last night whilst you went off i started working on my foreman plugin and broke the machine reinstalling now as my wifi router routes through the server :frowning: kids not happy with me last night

Gonna do a fresh install of ad and see how it it diifers from when you unistall and reinstall so the admins cans implement it into the removal process making it easier to reinstall

37

It’s all good, thanks again for all your time/effort
hope you get your machine sorted :slight_smile:

38

Ok I have just done a fresh nethserver install and only updated already installed packages

Took a while I have 40tb resyncing

Any way did a dc install via the webgui and it failed when I did some inspecting of the file creation I noticed the folder

/var/kerberos/krb5kdc

was not created

which leaves me to believe krb5-server is not being installed or properly when the dc is created which I believe the kdc file is needed to make this work.

I also notice folder

/etc/krb5.conf.d

is empty which I believe the krb5.conf file should be in not sure on that thou I will double check the time stamp when I get samba-dc working again and see
if this is relevant.

If this is the case maybe a dev can look into why

/var/kerberos/krb5kdc

is not being created

I think I have found the underlying proble

39

did you expand the /etc/krb5.conf template?

I had to expand all three templates (sssd.conf,smb.conf and krb5.conf)

40

this was on a complete fresh install of a neth install

This should be done automatically