Need help to configure my new AD/NS8 domain or reinstall from scratch

NethServer Version: 8
Module: AD/Samba

Hello! Background: I’m having a major problem with my old NS7; I’m getting an error that says, “The RPC server is unavailable,” and it seems this error is due to the Samba version. So, I’m trying to use a new NS8 (Proxmox VM, Rocky). I ran some tests back then and managed to get it working. But because I’ve been busy, months have gone by, and now I’m having a lot of trouble joining any computer to the new domain. I’ve been using Grok to try to fix it (and avoid bothering anyone), but I feel like I’m just going in circles. I haven’t been able to find a “how-to” guide that walks me through solving this. I’d almost bet that one already exists.

I can try reinstalling everything; if that solves my problem (I had already created all my users and groups) and I’ve already exported them to a file.
The problem, as I mentioned, is that when using the new AD’s DNS at 192.168.16.7/21 (yes, there are thousands of IPs—sorry)

Current Issues:
Windows 11 x64 PC
Connection-specific DNS suffix . . :
IPv4 address . . . . . . . . . . . . . . : 192.168.18.14
Subnet mask . . . . . . . . . . . . : 255.255.248.0
Default gateway . . . . . : 192.168.16.99

Error querying the DNS for the Service Location Resource (SRV) record used to locate an Active Directory domain controller (AD DC) for the domain “avion.org.mx”:

The error was: “This operation was returned because the timeout expired.”
(error code 0x000005B4 ERROR_TIMEOUT)

The query referred to the SRV record for _ldap._tcp.dc._msdcs.avion.org.mx

The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:

192.168.16.7

Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one DNS server is running.

I’ve already added this to my hosts file:

192.168.16.7 avion.org.mx
192.168.16.7 ns8.avion.org.mx
192.168.16.7 ns8
192.168.16.7 ad.avion.org.mx
192.168.16.7 ad

And this image show that “all is good”?

Thanks in advance.


Added: I plan to use this AD exclusively for authentication; I don’t intend to install any additional services to avoid complications. I’ve only installed dnsmasq

More info:

# podman ps
CONTAINER ID  IMAGE                                     COMMAND               CREATED            STATUS            PORTS           NAMES
ed5912663868  quay.io/prometheus/node-exporter:v1.10.2  --collector.cpu.i...  7 days ago         Up 7 days         9100/tcp        node_exporter
ffbe84162ed5  ghcr.io/nethserver/redis:3.20.0           redis-server /dat...  7 days ago         Up 7 days         6379/tcp        redis
6153de8e0e1e  docker.io/grafana/alloy:v1.11.3           run /etc/alloy/co...  7 days ago         Up 7 days                         promtail
3b570dd577f1  ghcr.io/nethserver/rclone:3.20.0                                7 days ago         Up 7 days                         rclone-gateway
5c465bdb9495  ghcr.io/nethserver/dnsmasq-server:1.3.3   dnsmasq               About an hour ago  Up About an hour  53/udp, 67/udp  dnsmasq1

A little more info:

cat /etc/resolv.conf 
# Generated by NetworkManager
search avion.org.mx
nameserver 9.9.9.9
nameserver 1.1.1.2
nameserver 1.1.1.3
1 Like

Hi,

please disable the DNSmasq DNS first because it conflicts with Samba on the same node as both want to use the same ports.

it seems you didn’t enable the file server (which includes authentication, see User domains | NethServer 8 documentation) as the Samba server has a wireguard VPN IP 10.5.4.1 which isn’t reachable from LAN.

I assume there’s just one NS8 node and a single samba server without replicas. In this case it’s possible to change the IP to the LAN one - 192.168.16.7:

api-cli run module/samba1/set-ipaddress --data '{"ipaddress":"192.168.16.7"}'

Now the DC should be reachable from the clients.

1 Like

Thanks mrmarkuz, how can I disable DNSmasq?

Sorry, I didn’t get your screenshots, the dnsmasq DNS part is already disabled because Samba is installed, so it should be no problem.

But if you don’t need the DHCP server you could just uninstall DNSmasq.

1 Like

Done; —these are tests run from on the server. I wonder if my /etc/resolv.conf file set up correctly?

[root@ns8 ~]# api-cli run module/samba1/set-ipaddress --data '{"ipaddress":"192.168.16.7"}'
""
[root@ns8 ~]# nslookup -type=SRV _ldap._tcp.ad.avion.org.mx 192.168.16.7
nslookup -type=SRV _kerberos._tcp.ad.avion.org.mx 192.168.16.7
nslookup ad.avion.org.mx 192.168.16.7
Server:         192.168.16.7
Address:        192.168.16.7#53

_ldap._tcp.ad.avion.org.mx      service = 0 100 389 dc1.ad.avion.org.mx.

Server:         192.168.16.7
Address:        192.168.16.7#53

_kerberos._tcp.ad.avion.org.mx  service = 0 100 88 dc1.ad.avion.org.mx.

Server:         192.168.16.7
Address:        192.168.16.7#53

Name:   ad.avion.org.mx
Address: 192.168.16.7

[root@ns8 ~]# nslookup -type=SRV _ldap._tcp.ad.avion.org.mx
nslookup -type=SRV _kerberos._tcp.ad.avion.org.mx
nslookup ad.avion.org.mx
Server:         9.9.9.9
Address:        9.9.9.9#53

** server can't find _ldap._tcp.ad.avion.org.mx: NXDOMAIN

Server:         9.9.9.9
Address:        9.9.9.9#53

** server can't find _kerberos._tcp.ad.avion.org.mx: NXDOMAIN

Server:         9.9.9.9
Address:        9.9.9.9#53

** server can't find ad.avion.org.mx: NXDOMAIN

The NS8 node shouldn’t use Samba as DNS server, see System requirements | NethServer 8 documentation
If there are wrong entries in /etc/resolv.conf, please remove them.

EDIT:

You need to test the samba DNS (192.168.16.7), it’s not working with 9.9.9.9 as that DNS server doesn’t know about the samba DNS entries.

EDIT2:

Another way is to test the Samba DNS from a client device.

EDIT3:

Your /etc/resolv.conf looks good as you’re using external DNS servers only.

1 Like

All is working now @mrmarkuz wow!!

nslookup -type=SRV _kerberos._tcp.ad.avion.org.mx 192.168.16.7
Server:         192.168.16.7
Address:        192.168.16.7#53

_kerberos._tcp.ad.avion.org.mx  service = 0 100 88 dc1.ad.avion.org.mx.

We’ve already managed to join two computers to the new domain. Now I just need to install the administrative tools to recreate the GPOs from the old domain in this new one.

Your help has been fantastic. Now I really need to look into buying the subscription!!:partying_face:

1 Like