<div dir="ltr">Hi Alexander,<div><br></div><div>I've changed the names to anonymize the logs, but have maintained the structure of the names.</div><div><br></div><div>This is how I've got the hostname configured:</div><div><br></div><div><div>>> [root@freeipaserver ~]# hostname</div><div>>> freeipaserver</div><div>>> [root@freeipaserver ~]# hostname -a</div><div>>> freeipaserver</div><div>>> [root@freeipaserver ~]# hostname -f</div><div>>> <a href="http://freeipaserver.my.sub.domain.com">freeipaserver.my.sub.domain.com</a></div><div>>> [root@freeipaserver ~]# cat /etc/hosts</div><div>>> 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4</div><div>>> ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6</div><div>>> </div><div>>> 192.168.1.10 <a href="http://freeipaserver.my.sub.domain.com">freeipaserver.my.sub.domain.com</a> freeipaserver</div><div>>> </div><div>>> [root@freeipaserver ~]# cat /etc/sysconfig/network</div><div>>> DNS1=192.168.10.1</div><div>>> NISDOMAIN=<a href="http://my.sub.domain.com">my.sub.domain.com</a></div><div>>> GATEWAY=192.168.1.1</div><div>>> SEARCH=<a href="http://my.sub.domain.com">my.sub.domain.com</a></div><div>>> DOMAIN=<a href="http://my.sub.domain.com">my.sub.domain.com</a></div></div><div><br></div><div>(NISDOMAIN and DOMAIN were previous attempts to set the domain. I can't just set /etc/hostname to "freeipaserver" as a bash prompt that says [<a href="mailto:root@freeipaserver.my.sub.domain.com">root@freeipaserver.my.sub.domain.com</a> ~] is unacceptable to our ops teams, and we can't rewrite our bashrcs (these are company standards). However, based on the instructions, I do believe I've set the hostname correctly unless something has changed between RHEL6 and RHEL7).</div><div><br></div><div>Thanks,</div><div>Jon A</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 2:44 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Wed, 27 Jan 2016, Jon wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
Thanks for your feedback.<br>
<br>
So I reran `ipa-adtrust-install` and got a core dump from samba that there<br>
was no space left on the device...?<br>
<br>
A little digging showed that /var/log had filled up with files named<br>
"core.XXXXX" in /var/log/samba/cores/winbindd. So I removed all of them<br>
and reran `ipa-adtrust-install --add-sids` which continues to fail on<br>
starting CIFS services. Debug information shows that it's the smb service<br>
that isn't starting:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[22/22]: starting CIFS services<br>
ipa : DEBUG Starting external process<br>
ipa : DEBUG args='/bin/systemctl' 'start' 'smb.service'<br>
ipa : DEBUG Process finished, return code=1<br>
ipa : DEBUG stdout=<br>
ipa : DEBUG stderr=Job for smb.service failed because the<br>
</blockquote></blockquote>
control process exited with error code. See "systemctl status smb.service"<br>
and "journalctl -xe" for details.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
ipa : CRITICAL CIFS services failed to start<br>
ipa : DEBUG duration: 16 seconds<br>
ipa : DEBUG Done configuring CIFS.<br>
</blockquote></blockquote>
<br>
Looking at the samba logs, I see:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:48 freeipa01enwdco smbd[18300]: [2016/01/27<br>
</blockquote></blockquote>
13:19:48.482378, 0] ipa_sam.c:4208(bind_callback_cleanup)<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:48 freeipa01enwdco smbd[18300]: kerberos error:<br>
</blockquote></blockquote>
code=-1765328203, message=Keytab contains no suitable keys for cifs/<br>
<a href="mailto:freeipaserver@MY.SUB.DOMAIN.COM" target="_blank">freeipaserver@MY.SUB.DOMAIN.COM</a><br>
</blockquote></div></div>
^ is this the real name for the server? E.g. it is non-fully qualified<br>
one here? What does your `hostname` command show?<div class="HOEnZb"><div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco smbd[18300]: [2016/01/27<br>
</blockquote></blockquote>
13:19:49.482818, 0] ipa_sam.c:4520(pdb_init_ipasam)<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco smbd[18300]: Failed to get base DN.<br>
Jan 27 13:19:49 freeipa01enwdco smbd[18300]: [2016/01/27<br>
</blockquote></blockquote>
13:19:49.482909, 0]<br>
../source3/passdb/pdb_interface.c:179(make_pdb_method_name)<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco smbd[18300]: pdb backend<br>
</blockquote></blockquote>
ipasam:ldapi://%2fvar%2frun%2fslapd-MY-SUB-DOMAIN-COM.socket did not<br>
correctly init (error was NT_STATUS_UNSUCCESSFUL)<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco systemd[1]: smb.service: main process<br>
</blockquote></blockquote>
exited, code=exited, status=1/FAILURE<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco systemd[1]: Failed to start Samba SMB<br>
</blockquote></blockquote>
Daemon.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco systemd[1]: Unit smb.service entered<br>
</blockquote></blockquote>
failed state.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 27 13:19:49 freeipa01enwdco systemd[1]: smb.service failed.<br>
</blockquote></blockquote>
<br>
<br>
I tried following the trust debugging instructions here:<br>
<a href="http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust</a><br>
<br>
But it fails on the step `systemctl start smb winbind`<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
# systemctl stop smb winbind<br>
# net conf setparm global 'log level' 100<br>
# nano /usr/share/ipa/smb.conf.empty<br>
# rm /var/log/samba/log.*<br>
# systemctl start smb winbind<br>
Job for smb.service failed because the control process exited with error<br>
</blockquote></blockquote>
code. See "systemctl status smb.service" and "journalctl -xe" for details.<br>
<br>
Which produces the exact same error listed above.<br>
<br>
<br>
in /var/log/samba/log.smbd I see what appears to be a stack trace, I see<br>
the same exact error above as well as the error about the socket not<br>
initing correctly:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[2016/01/27 13:26:21.606257, 0, pid=18344, effective(0, 0), real(0, 0)]<br>
</blockquote></blockquote>
ipa_sam.c:4208(bind_callback_cleanup)<br>
kerberos error: code=-1765328203, message=Keytab contains no suitable<br>
keys for cifs/<a href="mailto:freeipaserver@MY.SUB.DOMAIN.COM" target="_blank">freeipaserver@MY.SUB.DOMAIN.COM</a><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[2016/01/27 13:26:21.606422, 2, pid=18344, effective(0, 0), real(0, 0)]<br>
</blockquote></blockquote>
../source3/lib/smbldap.c:998(smbldap_connect_system)<br>
failed to bind to server<br>
ldapi://%2fvar%2frun%2fslapd-MY-SUB-DOMAIN-COM.socket with dn="[Anonymous<br>
bind]" Error: Local error<br>
(unknown)<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[2016/01/27 13:26:22.606842, 0, pid=18344, effective(0, 0), real(0, 0),<br>
</blockquote></blockquote>
class=passdb] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)<br>
pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-MY-SUB-DOMAIN-COM.socket<br>
did not correctly init (error was NT_STATUS_UNSUCCESSFUL)<br>
<br>
So I think the problem is more fundamental than trusts as samba won't even<br>
start.<br>
<br>
Is there any documentation or does anyone have some good tricks for<br>
troubleshooting samba?<br>
<br>
Thanks,<br>
Jon A<br>
<br>
On Wed, Jan 20, 2016 at 4:57 AM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>><br>
wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Wed, 20 Jan 2016, Anon Lister wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
So I had the same problem. For me it ended up being that some attribute<br>
was<br>
not created correctly in 389 using the instructions in the guide. I don't<br>
remember what it was off the top of my head. Something about a default<br>
user<br>
or group SID I think. Had to turn samba logging up. Eventually it shows<br>
the<br>
attribute it is failing on. I ended up manually adding it with vildap and<br>
it worked fine after that. If noone else gets it I'll poke around and see<br>
if I can find what it was, took me several hours to debug due to the<br>
somewhat misleading error message.<br>
<br>
</blockquote>
The message is the only thing we get from Samba Python libraries, so it<br>
is as good as what we get.<br>
<br>
Use<br>
<a href="http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust</a><br>
to produce debug output needed to find out where things happened.<br>
<br>
If your setup lacks 'Default SMB Group' group with a SID<br>
(ipaNTSecurityIdentifier attribute), run ipa-adtrust-install --add-sids.<br>
<br>
ipa-adtrust-install can be re-run several times to fix missing parts. It<br>
skips steps which were already done and only performs those that are<br>
really needed.<br>
<br>
However, if your base IPA deployment does not work, like in the Jon's<br>
case, there is little reason to run any of ipa-adtrust-install or other<br>
trust-related functions.<br>
<br>
Additionally, DNS should be configured properly. ipa-adtrust-install<br>
either automatically updates IPA DNS (if IPA manages the DNS zone) or<br>
produces list of entries that should be added to the DNS zone whoever<br>
manages it. This should not be overlooked -- when Active Directory<br>
domain controller tries to validate the trust, it uses DNS SRV records<br>
to find out IPA domain controllers ('trust controllers' in IPA speak,<br>
the ones where ipa-adtrust-install was run) and only considers those<br>
that are available via SRV records. If AD DC cannot find IPA DC via SRV<br>
record, trust cannot be validated.<br>
<br>
On Jan 19, 2016 1:37 PM, "Jon" <<a href="mailto:three18ti@gmail.com" target="_blank">three18ti@gmail.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Hello,<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
While following the guide on setting up FreeIPA with AD<br>
<<a href="http://www.freeipa.org/page/Active_Directory_trust_setup" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup</a>>, I got to the<br>
<br>
step where I'm adding the AD trust to FreeIPA but I receive an error:<br>
<br>
>> Active Directory domain administrator's password:<br>
>> ipa: ERROR: CIFS server communication error: code "-1073741801",<br>
>> message "Memory allocation error" (both may be<br>
"None")<br>
<br>
Thinking that the error was what was stated (my VM at the time only had<br>
1GB of ram), I shutdown my VM (memory hot add was not enabled in VMware,<br>
it<br>
is now), bumped the RAM to 4GB, and booted the VM.<br>
<br>
Upon running the same command after reboot I received an error:<br>
<br>
>> ipa: ERROR: did not receive Kerberos credentials<br>
<br>
kinit admin is also reporting an error:<br>
<br>
>> kinit: Cannot contact any KDC for realm 'myrealm' while getting<br>
initial credentials<br>
<br>
trying to start FreeIPA in debug mode identified the samba service as at<br>
fault.<br>
<br>
>> Jan 19 10:19:50 myfreeipaserver smbd[3676]: kerberos error:<br>
code=-1765328203, message=Keytab contains no suitable keys for cifs/<br>
<a href="mailto:myfreeipaserver@SUB.DOMAIN.MYDOMAIN.COM" target="_blank">myfreeipaserver@SUB.DOMAIN.MYDOMAIN.COM</a><br>
>> Jan 19 10:19:51 myfreeipaserver smbd[3676]: [2016/01/19<br>
10:19:51.261648, 0] ipa_sam.c:4520(pdb_init_ipasam)<br>
>> Jan 19 10:19:51 myfreeipaserver smbd[3676]: Failed to get base DN.<br>
>> Jan 19 10:19:51 myfreeipaserver smbd[3676]: [2016/01/19<br>
10:19:51.262675, 0]<br>
../source3/passdb/pdb_interface.c:179(make_pdb_method_name)<br>
>> Jan 19 10:19:51 myfreeipaserver smbd[3676]: pdb backend<br>
ipasam:ldapi://%2fvar%2frun%2fslapd-SUB-DOMAIN-MYDOMAIN-COM.socket did<br>
not<br>
correctly init (error was NT_STATUS_UNSUCCESSFUL)<br>
<br>
Googling for these errors turned up a few similar threads but none of the<br>
solutions seemed to work and all signs pointed to AD integration as the<br>
culprit...<br>
<br>
So I did what any good sysadmin would do and forced freeipa to start<br>
while<br>
ignoring any failures. Every service except samba starts without issue.<br>
<br>
So I tried my trust connection again, and received the same error,<br>
<br>
>> Active Directory domain administrator's password:<br>
>> ipa: ERROR: CIFS server communication error: code "-1073741801",<br>
>> message "Memory allocation error" (both may be<br>
"None")<br>
<br>
Which brought me to googling two bug reports opened on this exact issue:<br>
<br>
>> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=878168" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=878168</a><br>
>> <a href="https://fedorahosted.org/freeipa/ticket/3266" rel="noreferrer" target="_blank">https://fedorahosted.org/freeipa/ticket/3266</a><br>
<br>
Both of these bug reports indicate there's an upstream bug in Samba, the<br>
bug has been closed and reopened at least once. I did add the AD servers<br>
to /etc/hosts and rebooted the server. I have to go through the same<br>
process of forcing freeipa to start after the server rebooted...<br>
However, I<br>
received the same error message.<br>
<br>
While the bug report is currently closed, I seem to be experiencing the<br>
same issues...<br>
<br>
Given this bug report, can you please answer me these questions three:<br>
<br>
1) Given the issues with Samba starting after reboot, is this bug report<br>
actually what's wrong or is the error message when trying to create a<br>
trust<br>
a red herring and it's actually samba that's the problem?<br>
2) Does this bug report mean that trusts between FreeIPA and AD are<br>
broken and can not be established until the upstream bug in Samba is<br>
fixed?<br>
3) Is there a workaround? (as adding the domain controllers to<br>
/etc/hosts with IPv4 address does not appear to work)<br>
<br>
System Stats:<br>
- AD Server: Win2k8R2<br>
- FreeIPA server:<br>
<br>
>> CentOS Linux release 7.2.1511 (Core)<br>
<br>
<br>
>> # uname -a<br>
>> Linux myserver 3.10.0-327.4.4.el7.x86_64 #1 SMP Tue Jan 5 16:07:00 UTC<br>
2016 x86_64 x86_64 x86_64 GNU/Linux<br>
<br>
>> # rpm -qa | grep ipa<br>
>> python-libipa_hbac-1.13.0-40.el7_2.1.x86_64<br>
>> ipa-server-4.2.0-15.el7.centos.3.x86_64<br>
>> ipa-server-dns-4.2.0-15.el7.centos.3.x86_64<br>
>> python-iniparse-0.4-9.el7.noarch<br>
>> libipa_hbac-1.13.0-40.el7_2.1.x86_64<br>
>> sssd-ipa-1.13.0-40.el7_2.1.x86_64<br>
>> ipa-python-4.2.0-15.el7.centos.3.x86_64<br>
>> ipa-client-4.2.0-15.el7.centos.3.x86_64<br>
>> ipa-server-trust-ad-4.2.0-15.el7.centos.3.x86_64<br>
>> ipa-admintools-4.2.0-15.el7.centos.3.x86_64<br>
<br>
<br>
I appreciate any help. I've been trying to get FreeIPA going for a<br>
couple<br>
of weeks now and have run into nothing but frustrations. The funny thing<br>
is, I've never had a problem deploying FreeIPA by itself... Microsoft<br>
seems to be the common denominator in my hair pulling lately...<br>
Correlation<br>
does not equal causation... but it sure is a coincidence... :)<br>
<br>
Thanks for your time!<br>
<br>
Best Regards,<br>
Jon A<br>
<br>
<br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br>
<br>
<br>
</blockquote></blockquote>
--<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br>
<br>
</blockquote>
<br>
<br>
--<br>
/ Alexander Bokovoy<br>
<br>
</blockquote></blockquote>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-- <br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br>
</blockquote>
<br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</div></div></blockquote></div><br></div>