<div dir="ltr">I've been following the doc here: <a href="https://www.freeipa.org/page/Active_Directory_trust_setup">https://www.freeipa.org/page/Active_Directory_trust_setup</a><div><br></div><div>To get AD Trust setup for auth of our windows users and vice-versae. </div><div><br></div><div>I'm getting to the point of running ipa-adtrust-install and getting the following: </div><div><br></div><div><br></div><div><div>[root@awse-util1 ~]# ipa-adtrust-install --netbios-name=<NETBIOSNAME></div><div><br></div><div>The log file for this installation can be found in /var/log/ipaserver-install.log</div><div>==============================================================================</div><div>This program will setup components needed to establish trust to AD domains for</div><div>the IPA Server.</div><div><br></div><div>This includes:</div><div> * Configure Samba</div><div> * Add trust related objects to IPA LDAP server</div><div><br></div><div>To accept the default shown in brackets, press the Enter key.</div><div><br></div><div>IPA generated smb.conf detected.</div><div>Overwrite smb.conf? [no]: yes</div><div>Do you want to enable support for trusted domains in Schema Compatibility plugin?</div><div>This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.</div><div><br></div><div>Enable trusted domains support in slapi-nis? [no]: yes</div><div><br></div><div>Configuring cross-realm trusts for IPA server requires password for user 'admin'.</div><div>This user is a regular system account used for IPA server administration.</div><div><br></div><div>admin password:</div><div><br></div><div><br></div><div>WARNING: 52 existing users or groups do not have a SID identifier assigned.</div><div>Installer can run a task to have ipa-sidgen Directory Server plugin generate</div><div>the SID identifier for all these users. Please note, the in case of a high</div><div>number of users and groups, the operation might lead to high replication</div><div>traffic and performance degradation. Refer to ipa-adtrust-install(1) man page</div><div>for details.</div><div><br></div><div>Do you want to run the ipa-sidgen task? [no]: yes</div><div><br></div><div>The following operations may take some minutes to complete.</div><div>Please wait until the prompt is returned.</div><div><br></div><div>Configuring CIFS</div><div> [1/23]: stopping smbd</div><div> [2/23]: creating samba domain object</div><div>Samba domain object already exists</div><div> [3/23]: creating samba config registry</div><div> [4/23]: writing samba config file</div><div> [5/23]: adding cifs Kerberos principal</div><div> [6/23]: adding cifs and host Kerberos principals to the adtrust agents group</div><div> [7/23]: check for cifs services defined on other replicas</div><div> [8/23]: adding cifs principal to S4U2Proxy targets</div><div>cifs principal already targeted, nothing to do.</div><div> [9/23]: adding admin(group) SIDs</div><div>Admin SID already set, nothing to do</div><div>Admin group SID already set, nothing to do</div><div> [10/23]: adding RID bases</div><div>RID bases already set, nothing to do</div><div> [11/23]: updating Kerberos config</div><div>'dns_lookup_kdc' already set to 'true', nothing to do.</div><div> [12/23]: activating CLDAP plugin</div><div>CLDAP plugin already configured, nothing to do</div><div> [13/23]: activating sidgen task</div><div>Sidgen task plugin already configured, nothing to do</div><div> [14/23]: configuring smbd to start on boot</div><div> [15/23]: adding special DNS service records</div><div> [16/23]: enabling trusted domains support for older clients via Schema Compatibility plugin</div><div> [17/23]: restarting Directory Server to take MS PAC and LDAP plugins changes into account</div><div> [18/23]: adding fallback group</div><div>Fallback group already set, nothing to do</div><div> [19/23]: adding Default Trust View</div><div>Default Trust View already exists.</div><div> [20/23]: setting SELinux booleans</div><div> [21/23]: enabling oddjobd</div><div> [22/23]: starting CIFS services</div><div>ipa : CRITICAL CIFS services failed to start</div><div> [23/23]: adding SIDs to existing users and groups</div><div>ipa : CRITICAL Failed to load ipa-sidgen-task-run.ldif: Command ''/usr/bin/ldapmodify' '-v' '-f' '/tmp/tmpiM6PLp' '-H' 'ldapi://%2fvar%2frun%2fslapd-GLPTRADING-NET.socket' '-Y' 'EXTERNAL'' returned non-zero exit status 1</div><div>Done configuring CIFS.</div><div><br></div><div>=============================================================================</div><div>Setup complete</div><div><br></div><div>You must make sure these network ports are open:</div><div><span class="" style="white-space:pre"> </span>TCP Ports:</div><div><span class="" style="white-space:pre"> </span> * 138: netbios-dgm</div><div><span class="" style="white-space:pre"> </span> * 139: netbios-ssn</div><div><span class="" style="white-space:pre"> </span> * 445: microsoft-ds</div><div><span class="" style="white-space:pre"> </span>UDP Ports:</div><div><span class="" style="white-space:pre"> </span> * 138: netbios-dgm</div><div><span class="" style="white-space:pre"> </span> * 139: netbios-ssn</div><div><span class="" style="white-space:pre"> </span> * 389: (C)LDAP</div><div><span class="" style="white-space:pre"> </span> * 445: microsoft-ds</div><div><br></div><div>=============================================================================</div></div><div><br></div><div><br></div><div>As well, if I run it with the default settings smbd doesn't start either. </div><div><br></div><div><div>[root@awse-util1 ~]# ipa-adtrust-install --netbios-name=<NETBIOS_NAME></div><div><br></div><div>The log file for this installation can be found in /var/log/ipaserver-install.log</div><div>==============================================================================</div><div>This program will setup components needed to establish trust to AD domains for</div><div>the IPA Server.</div><div><br></div><div>This includes:</div><div> * Configure Samba</div><div> * Add trust related objects to IPA LDAP server</div><div><br></div><div>To accept the default shown in brackets, press the Enter key.</div><div><br></div><div>IPA generated smb.conf detected.</div><div>Overwrite smb.conf? [no]: yes</div><div>Do you want to enable support for trusted domains in Schema Compatibility plugin?</div><div>This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.</div><div><br></div><div>Enable trusted domains support in slapi-nis? [no]:</div><div><br></div><div>Configuring cross-realm trusts for IPA server requires password for user 'admin'.</div><div>This user is a regular system account used for IPA server administration.</div><div><br></div><div>admin password:</div><div><br></div><div><br></div><div>WARNING: 52 existing users or groups do not have a SID identifier assigned.</div><div>Installer can run a task to have ipa-sidgen Directory Server plugin generate</div><div>the SID identifier for all these users. Please note, the in case of a high</div><div>number of users and groups, the operation might lead to high replication</div><div>traffic and performance degradation. Refer to ipa-adtrust-install(1) man page</div><div>for details.</div><div><br></div><div>Do you want to run the ipa-sidgen task? [no]:</div><div><br></div><div>The following operations may take some minutes to complete.</div><div>Please wait until the prompt is returned.</div><div><br></div><div>Configuring CIFS</div><div> [1/21]: stopping smbd</div><div> [2/21]: creating samba domain object</div><div>Samba domain object already exists</div><div> [3/21]: creating samba config registry</div><div> [4/21]: writing samba config file</div><div> [5/21]: adding cifs Kerberos principal</div><div> [6/21]: adding cifs and host Kerberos principals to the adtrust agents group</div><div> [7/21]: check for cifs services defined on other replicas</div><div> [8/21]: adding cifs principal to S4U2Proxy targets</div><div>cifs principal already targeted, nothing to do.</div><div> [9/21]: adding admin(group) SIDs</div><div>Admin SID already set, nothing to do</div><div>Admin group SID already set, nothing to do</div><div> [10/21]: adding RID bases</div><div>RID bases already set, nothing to do</div><div> [11/21]: updating Kerberos config</div><div>'dns_lookup_kdc' already set to 'true', nothing to do.</div><div> [12/21]: activating CLDAP plugin</div><div>CLDAP plugin already configured, nothing to do</div><div> [13/21]: activating sidgen task</div><div>Sidgen task plugin already configured, nothing to do</div><div> [14/21]: configuring smbd to start on boot</div><div> [15/21]: adding special DNS service records</div><div> [16/21]: restarting Directory Server to take MS PAC and LDAP plugins changes into account</div><div> [17/21]: adding fallback group</div><div>Fallback group already set, nothing to do</div><div> [18/21]: adding Default Trust View</div><div>Default Trust View already exists.</div><div> [19/21]: setting SELinux booleans</div><div> [20/21]: enabling oddjobd</div><div> [21/21]: starting CIFS services</div><div>ipa : CRITICAL CIFS services failed to start</div><div>Done configuring CIFS.</div><div><br></div><div>=============================================================================</div><div>Setup complete</div><div><br></div><div>You must make sure these network ports are open:</div><div><span class="" style="white-space:pre"> </span>TCP Ports:</div><div><span class="" style="white-space:pre"> </span> * 138: netbios-dgm</div><div><span class="" style="white-space:pre"> </span> * 139: netbios-ssn</div><div><span class="" style="white-space:pre"> </span> * 445: microsoft-ds</div><div><span class="" style="white-space:pre"> </span>UDP Ports:</div><div><span class="" style="white-space:pre"> </span> * 138: netbios-dgm</div><div><span class="" style="white-space:pre"> </span> * 139: netbios-ssn</div><div><span class="" style="white-space:pre"> </span> * 389: (C)LDAP</div><div><span class="" style="white-space:pre"> </span> * 445: microsoft-ds</div><div><br></div><div>=============================================================================</div></div><div><br></div><div>Hostname is fqdn. </div><div><br></div><div>Packages: </div><div><br></div><div><div>ipa-admintools.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-client.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-python.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server-dns.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server-trust-ad.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>libipa_hbac.x86_64 1.13.0-40.el7_2.9 @updates</div><div>python-libipa_hbac.x86_64 1.13.0-40.el7_2.9 @updates</div><div>sssd-ipa.x86_64 1.13.0-40.el7_2.9 @updates</div></div><div><br></div><div><br></div><div><br></div><div>-------------------------------</div><div><br></div><div>If I restart smb, I get the following log entries in /var/log/samba/log.smbd:</div><div><br></div><div><div>[2016/07/22 15:00:17, 0] ../source3/smbd/server.c:1241(main)</div><div> smbd version 4.2.10 started.</div><div> Copyright Andrew Tridgell and the Samba Team 1992-2014</div><div>[2016/07/22 15:00:17.486910, 0] ipa_sam.c:3703(ipasam_search_domain_info)</div><div> iapsam_search_domain_info: Got [5] domain info entries, but expected only 1.</div><div>[2016/07/22 15:00:17.487212, 0] ipa_sam.c:4558(pdb_init_ipasam)</div><div> pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain. We cannot work reliably without it.</div><div>[2016/07/22 15:00:17.487407, 0] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)</div><div> pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-<IPA_DOMAIN>.socket did not correctly init (error was NT_STATUS_CANT_ACCESS_DOMAIN_INFO)</div></div><div><br></div><div><br></div><div><br></div><div>Does anybody have any ideas here?</div><div><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><span style="color:rgb(136,136,136)"><br></span></div><span style="color:rgb(136,136,136)">Best regards,</span><div><br style="color:rgb(136,136,136)"><span style="color:rgb(136,136,136)">Rolf Brusletto</span><br style="color:rgb(136,136,136)"><span style="color:rgb(136,136,136)">Senior Network And Systems Admin</span><br style="color:rgb(136,136,136)"><span style="color:rgb(136,136,136)">Global Liquidity Partners, LLC</span><br style="color:rgb(136,136,136)"><a href="mailto:rolf@glptrading.com" style="color:rgb(17,85,204)" target="_blank">rolf@glptrading.com</a></div><div><font color="#999999">720-763-8163 office</font><br><span style="color:rgb(136,136,136)">303-638-8013 mobile</span><br></div></div></div></div></div></div>
</div></div>
<br>
<p><span style="font-size:9pt"><em></em></span> </p><p><span style="font-size:9pt"><em><strong>Confidentiality Notice:</strong> This email,
including attachments, may include non-public, proprietary, confidential
or legally privileged information. If you are not an intended
recipient or an authorized agent of an intended recipient, you are
hereby notified that any dissemination, distribution or copying of the
information contained in or transmitted with this e-mail is unauthorized
and strictly prohibited. If you have received this email in error,
please notify the sender by replying to this message and permanently
delete this e-mail, its attachments, and any copies of it immediately.
You should not retain, copy or use this e-mail or any attachment for any
purpose, nor disclose all or any part of the contents to any other
person.</em></span></p>