Permissions problem with NethServer and remote AD 2008 SP2

[troublestarter (David)]

Hi
Users permissions not functiun well with shared folders and permissions.

Here my informations

Account provider

i have saved again information and here is the ouput of /var/log/messages logs

Apr 30 12:13:25 srv-data systemd: Reloading.
Apr 30 12:13:25 srv-data systemd: Starting System Security Services Daemon…
Apr 30 12:13:25 srv-data sssd: Starting up
Apr 30 12:13:25 srv-data sssd[be[chabert.internal]]: Starting up
Apr 30 12:13:25 srv-data sssd[nss]: Starting up
Apr 30 12:13:25 srv-data sssd[pam]: Starting up
Apr 30 12:13:25 srv-data systemd: Started System Security Services Daemon.
Apr 30 12:13:25 srv-data esmith::event[20137]: [INFO] sssd has been started
Apr 30 12:13:25 srv-data esmith::event[20137]: Action: /etc/e-smith/events/actions/adjust-services SUCCESS [0.51964]
Apr 30 12:13:25 srv-data esmith::event[20137]: Event: nethserver-sssd-save SUCCESS
Apr 30 12:13:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 12:13:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 12:13:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 12:13:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 12:13:26 srv-data sssd: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database.
Apr 30 12:13:26 srv-data sssd: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database.
Apr 30 12:13:26 srv-data sssd: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database.

[troublestarter (David)]

[root@srv-data ~]# config show sssd
sssd=service
    AdDns=172.30.0.24
    BaseDN=DC=chabert,DC=internal
    BindDN=
    BindPassword=
    GroupDN=DC=chabert,DC=internal
    LdapURI=ldap://dc2008.chabert.internal
    Provider=ad
    Realm=CHABERT.INTERNAL
    StartTls=
    UserDN=DC=chabert,DC=internal
    Workgroup=CHABERT
    status=enabled

[root@srv-data ~]# config show dns
dns=configuration
    NameServers=172.30.0.24,8.8.8.8

[root@srv-data ~]# config show nsdc
[root@srv-data ~]#

[root@srv-data ~]# cat /etc/hosts
# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at NethServer official site: https://www.nethserver.org
#
#


#
# 10localhost
#
127.0.0.1       localhost       localhost.localdomain


#
# 20hostname(s)
#
172.30.0.12             srv-data.chabert.internal srv-data



#
# 30hosts_remote
#


#
# 40hosts_local
#

[troublestarter (David)]

Maybe the domain controller is too old …
I’m trying to update it or migrate the AD version in major release…

[mrmarkuz (Markus Neuberger)]

Hi David,

you may try “ldaps://…” with STARTTLS “no” or “ldap://” with STARTTLS “yes”. Sometimes unbind and rejoin helps. Different system clocks could be a problem too.

http://docs.nethserver.org/en/v7/accounts.html#join-an-existing-active-directory-domain

@troublestarter

NameServers=172.30.0.24,8.8.8.8

This may be a problem. The Google DNS 8.8.8.8 is not able to resolve your AD domain so please try to remove it and use the internal DNS only.

[troublestarter (David)]

1 -> Delete 8.8.8.8 from secondary DNS Server OK
2-> Validated again “Account provider” and ask to rejoin domain OK
3-> Go to “Domain account” -> Still “Could not connect to accounts provider!” error.

[troublestarter (David)]

Try with ldap with STARTLS and ldaps with no tls

same errors
Apr 30 14:34:25 srv-data esmith::event[24138]: Event: nethserver-sssd-save SUCCESS
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:25 srv-data sssd: ; TSIG error with server: tsig verify failure
Apr 30 14:34:32 srv-data xe-daemon: Running CollectOS …
Apr 30 14:34:32 srv-data xe-daemon: Running CollectMisc …
Apr 30 14:34:32 srv-data xe-daemon: Running CollectNetworkAddr …

[pike (Michael Kicks)]

do nethserver resolve correctly the hostname for “dc2008.chabert.internal”?
Poor answer: yes, is already joined at the domain.

But my little question is: why join the doman and use LDAP auth?

[troublestarter (David)]

@pike

dc2008.chabert.internal

I’ve used domain join…
So i have put informations like asked by documentation :

[troublestarter (David)]

i don’t want to use ldap.
MY problem is that :

i have a lots permissions problem with shared folders…
Is there a command to test shared folder access with specific AD account ?

[pike (Michael Kicks)]

Join went ok with TLS disabled. Should LDAP connection have TLS disabled too?

[mrmarkuz (Markus Neuberger)]

@troublestarter

Is there a command to test shared folder access with specific AD account ?

You may use smbclient:

smbclient //yourserver/sharetotest -U admin

https://www.samba.org/samba/docs/current/man-html/smbclient.1.html

[troublestarter (David)]

I think the problem come from the windows server.

Is there a way to migrate fsmo roles to nethserver to have the nethserver working as PDC ?

[mrmarkuz (Markus Neuberger)]

@troublestarter

I think the problem come from the windows server.

Usually I’d agree but it should work with 2008 AFAIK.

@troublestarter

Is there a way to migrate fsmo roles to nethserver

It’s still experimental as you need to join the AD as DC to get the roles:

https://wiki.nethserver.org/doku.php?id=howto:add_ns7_samba_domain_controller_to_existing_active_directory

So, what are you working on? - 5 March 2018

Hi to all and many congrats for this project! I’ve started as MSWin admin, but now my big intention is to replace as many win services with linux ones wherever possible. This is my first post and I would like to share my scenario and discuss it’s feasabilty whit you. So, my big client has one central location and several remote ones. We all agree that there is no adequate replacement for every piece of Win mosaic, but as someone has mentioned , not every part of MS services/fetaures are us…

I played with joining as DC some time ago but it wasn’t stable:

Add/Replace existing AD Domain Controller with ns7

Hello, i tested joining Nethserver/NSDC to a Windows Server 2003 R2 Standard and at least the joins worked. I used https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory as a starting point. I setup a new domain admin called superuser to make the joins. I did: systemd-run -M nsdc -t /bin/bash On the NSDC: echo domain cmb.local > /etc/resolv.conf Added my Windows Server as nameserver echo nameserver 192.168.1.20 >> /etc/resolv.conf Joining: samba-tool…