<div dir="ltr"><span style="font-size:12.8px">I've been following the doc here: </span><a href="https://www.freeipa.org/page/Active_Directory_trust_setup" target="_blank" style="font-size:12.8px">https://www.freeipa.org/page/Active_Directory_trust_setup</a><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">To get AD Trust setup for auth of our windows users and vice-versae. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I'm getting to the point of running ipa-adtrust-install and getting the following: </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>[root@awse-util1 ~]# ipa-adtrust-install --netbios-name=<NETBIOSNAME></div><div><br></div><div>The log file for this installation can be found in /var/log/ipaserver-install.log</div><div>==============================================================================</div><div>This program will setup components needed to establish trust to AD domains for</div><div>the IPA Server.</div><div><br></div><div>This includes:</div><div> * Configure Samba</div><div> * Add trust related objects to IPA LDAP server</div><div><br></div><div>To accept the default shown in brackets, press the Enter key.</div><div><br></div><div>IPA generated smb.conf detected.</div><div>Overwrite smb.conf? [no]: yes</div><div>Do you want to enable support for trusted domains in Schema Compatibility plugin?</div><div>This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.</div><div><br></div><div>Enable trusted domains support in slapi-nis? [no]: yes</div><div><br></div><div>Configuring cross-realm trusts for IPA server requires password for user 'admin'.</div><div>This user is a regular system account used for IPA server administration.</div><div><br></div><div>admin password:</div><div><br></div><div><br></div><div>WARNING: 52 existing users or groups do not have a SID identifier assigned.</div><div>Installer can run a task to have ipa-sidgen Directory Server plugin generate</div><div>the SID identifier for all these users. Please note, the in case of a high</div><div>number of users and groups, the operation might lead to high replication</div><div>traffic and performance degradation. Refer to ipa-adtrust-install(1) man page</div><div>for details.</div><div><br></div><div>Do you want to run the ipa-sidgen task? [no]: yes</div><div><br></div><div>The following operations may take some minutes to complete.</div><div>Please wait until the prompt is returned.</div><div><br></div><div>Configuring CIFS</div><div> [1/23]: stopping smbd</div><div> [2/23]: creating samba domain object</div><div>Samba domain object already exists</div><div> [3/23]: creating samba config registry</div><div> [4/23]: writing samba config file</div><div> [5/23]: adding cifs Kerberos principal</div><div> [6/23]: adding cifs and host Kerberos principals to the adtrust agents group</div><div> [7/23]: check for cifs services defined on other replicas</div><div> [8/23]: adding cifs principal to S4U2Proxy targets</div><div>cifs principal already targeted, nothing to do.</div><div> [9/23]: adding admin(group) SIDs</div><div>Admin SID already set, nothing to do</div><div>Admin group SID already set, nothing to do</div><div> [10/23]: adding RID bases</div><div>RID bases already set, nothing to do</div><div> [11/23]: updating Kerberos config</div><div>'dns_lookup_kdc' already set to 'true', nothing to do.</div><div> [12/23]: activating CLDAP plugin</div><div>CLDAP plugin already configured, nothing to do</div><div> [13/23]: activating sidgen task</div><div>Sidgen task plugin already configured, nothing to do</div><div> [14/23]: configuring smbd to start on boot</div><div> [15/23]: adding special DNS service records</div><div> [16/23]: enabling trusted domains support for older clients via Schema Compatibility plugin</div><div> [17/23]: restarting Directory Server to take MS PAC and LDAP plugins changes into account</div><div> [18/23]: adding fallback group</div><div>Fallback group already set, nothing to do</div><div> [19/23]: adding Default Trust View</div><div>Default Trust View already exists.</div><div> [20/23]: setting SELinux booleans</div><div> [21/23]: enabling oddjobd</div><div> [22/23]: starting CIFS services</div><div>ipa : CRITICAL CIFS services failed to start</div><div> [23/23]: adding SIDs to existing users and groups</div><div>ipa : CRITICAL Failed to load ipa-sidgen-task-run.ldif: Command ''/usr/bin/ldapmodify' '-v' '-f' '/tmp/tmpiM6PLp' '-H' 'ldapi://%2fvar%2frun%2fslapd-GLPTRADING-NET.socket' '-Y' 'EXTERNAL'' returned non-zero exit status 1</div><div>Done configuring CIFS.</div><div><br></div><div>=============================================================================</div><div>Setup complete</div><div><br></div><div>You must make sure these network ports are open:</div><div><span style="white-space:pre-wrap"> </span>TCP Ports:</div><div><span style="white-space:pre-wrap"> </span> * 138: netbios-dgm</div><div><span style="white-space:pre-wrap"> </span> * 139: netbios-ssn</div><div><span style="white-space:pre-wrap"> </span> * 445: microsoft-ds</div><div><span style="white-space:pre-wrap"> </span>UDP Ports:</div><div><span style="white-space:pre-wrap"> </span> * 138: netbios-dgm</div><div><span style="white-space:pre-wrap"> </span> * 139: netbios-ssn</div><div><span style="white-space:pre-wrap"> </span> * 389: (C)LDAP</div><div><span style="white-space:pre-wrap"> </span> * 445: microsoft-ds</div><div><br></div><div>=============================================================================</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">As well, if I run it with the default settings smbd doesn't start either. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>[root@awse-util1 ~]# ipa-adtrust-install --netbios-name=<NETBIOS_NAME></div><div><br></div><div>The log file for this installation can be found in /var/log/ipaserver-install.log</div><div>==============================================================================</div><div>This program will setup components needed to establish trust to AD domains for</div><div>the IPA Server.</div><div><br></div><div>This includes:</div><div> * Configure Samba</div><div> * Add trust related objects to IPA LDAP server</div><div><br></div><div>To accept the default shown in brackets, press the Enter key.</div><div><br></div><div>IPA generated smb.conf detected.</div><div>Overwrite smb.conf? [no]: yes</div><div>Do you want to enable support for trusted domains in Schema Compatibility plugin?</div><div>This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.</div><div><br></div><div>Enable trusted domains support in slapi-nis? [no]:</div><div><br></div><div>Configuring cross-realm trusts for IPA server requires password for user 'admin'.</div><div>This user is a regular system account used for IPA server administration.</div><div><br></div><div>admin password:</div><div><br></div><div><br></div><div>WARNING: 52 existing users or groups do not have a SID identifier assigned.</div><div>Installer can run a task to have ipa-sidgen Directory Server plugin generate</div><div>the SID identifier for all these users. Please note, the in case of a high</div><div>number of users and groups, the operation might lead to high replication</div><div>traffic and performance degradation. Refer to ipa-adtrust-install(1) man page</div><div>for details.</div><div><br></div><div>Do you want to run the ipa-sidgen task? [no]:</div><div><br></div><div>The following operations may take some minutes to complete.</div><div>Please wait until the prompt is returned.</div><div><br></div><div>Configuring CIFS</div><div> [1/21]: stopping smbd</div><div> [2/21]: creating samba domain object</div><div>Samba domain object already exists</div><div> [3/21]: creating samba config registry</div><div> [4/21]: writing samba config file</div><div> [5/21]: adding cifs Kerberos principal</div><div> [6/21]: adding cifs and host Kerberos principals to the adtrust agents group</div><div> [7/21]: check for cifs services defined on other replicas</div><div> [8/21]: adding cifs principal to S4U2Proxy targets</div><div>cifs principal already targeted, nothing to do.</div><div> [9/21]: adding admin(group) SIDs</div><div>Admin SID already set, nothing to do</div><div>Admin group SID already set, nothing to do</div><div> [10/21]: adding RID bases</div><div>RID bases already set, nothing to do</div><div> [11/21]: updating Kerberos config</div><div>'dns_lookup_kdc' already set to 'true', nothing to do.</div><div> [12/21]: activating CLDAP plugin</div><div>CLDAP plugin already configured, nothing to do</div><div> [13/21]: activating sidgen task</div><div>Sidgen task plugin already configured, nothing to do</div><div> [14/21]: configuring smbd to start on boot</div><div> [15/21]: adding special DNS service records</div><div> [16/21]: restarting Directory Server to take MS PAC and LDAP plugins changes into account</div><div> [17/21]: adding fallback group</div><div>Fallback group already set, nothing to do</div><div> [18/21]: adding Default Trust View</div><div>Default Trust View already exists.</div><div> [19/21]: setting SELinux booleans</div><div> [20/21]: enabling oddjobd</div><div> [21/21]: starting CIFS services</div><div>ipa : CRITICAL CIFS services failed to start</div><div>Done configuring CIFS.</div><div><br></div><div>=============================================================================</div><div>Setup complete</div><div><br></div><div>You must make sure these network ports are open:</div><div><span style="white-space:pre-wrap"> </span>TCP Ports:</div><div><span style="white-space:pre-wrap"> </span> * 138: netbios-dgm</div><div><span style="white-space:pre-wrap"> </span> * 139: netbios-ssn</div><div><span style="white-space:pre-wrap"> </span> * 445: microsoft-ds</div><div><span style="white-space:pre-wrap"> </span>UDP Ports:</div><div><span style="white-space:pre-wrap"> </span> * 138: netbios-dgm</div><div><span style="white-space:pre-wrap"> </span> * 139: netbios-ssn</div><div><span style="white-space:pre-wrap"> </span> * 389: (C)LDAP</div><div><span style="white-space:pre-wrap"> </span> * 445: microsoft-ds</div><div><br></div><div>=============================================================================</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Hostname is fqdn. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Packages: </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>ipa-admintools.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-client.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-python.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server-dns.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>ipa-server-trust-ad.x86_64 4.2.0-15.0.1.el7.centos.17 @updates</div><div>libipa_hbac.x86_64 1.13.0-40.el7_2.9 @updates</div><div>python-libipa_hbac.x86_64 1.13.0-40.el7_2.9 @updates</div><div>sssd-ipa.x86_64 1.13.0-40.el7_2.9 @updates</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">-------------------------------</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">If I restart smb, I get the following log entries in /var/log/samba/log.smbd:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>[2016/07/22 15:00:17, 0] ../source3/smbd/server.c:1241(main)</div><div> smbd version 4.2.10 started.</div><div> Copyright Andrew Tridgell and the Samba Team 1992-2014</div><div>[2016/07/22 15:00:17.486910, 0] ipa_sam.c:3703(ipasam_search_domain_info)</div><div> iapsam_search_domain_info: Got [5] domain info entries, but expected only 1.</div><div>[2016/07/22 15:00:17.487212, 0] ipa_sam.c:4558(pdb_init_ipasam)</div><div> pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain. We cannot work reliably without it.</div><div>[2016/07/22 15:00:17.487407, 0] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)</div><div> pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-<IPA_DOMAIN>.socket did not correctly init (error was NT_STATUS_CANT_ACCESS_DOMAIN_INFO)</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Does anybody have any ideas here?</div><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><span style="color:rgb(136,136,136)"><br></span></div><span style="color:rgb(136,136,136)">Best regards,</span><div><br style="color:rgb(136,136,136)"><span style="color:rgb(136,136,136)">Rolf Brusletto</span><br style="color:rgb(136,136,136)"></div></div></div></div></div></div>
</div>
<br>
<p><span style="font-size:9pt"><em></em></span> </p><p><span style="font-size:9pt"><em><strong>Confidentiality Notice:</strong> This email,
including attachments, may include non-public, proprietary, confidential
or legally privileged information. If you are not an intended
recipient or an authorized agent of an intended recipient, you are
hereby notified that any dissemination, distribution or copying of the
information contained in or transmitted with this e-mail is unauthorized
and strictly prohibited. If you have received this email in error,
please notify the sender by replying to this message and permanently
delete this e-mail, its attachments, and any copies of it immediately.
You should not retain, copy or use this e-mail or any attachment for any
purpose, nor disclose all or any part of the contents to any other
person.</em></span></p>