<div dir="ltr"><font face="courier new, monospace">Hi</font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">Let me start from the beginning once again. Let me explain you what steps I followed during the setup.</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">I am setting up the environment in Amazon AWS, both Windows AD server and Linux IPA configured in EC2.</font></div><div><font face="courier new, monospace">For configuring Windows 2008 I selected Windows_Server-2008-R2_SP1-English-64Bit-Base-2014.04.09 (ami-df8e93b6)</font></div>
<div><font face="courier new, monospace">and for configuring IPA server I selected CentOS 6.5 (x86_64) - Release Media (ami-8997afe0).</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">I followed the steps from <a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup">http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup</a> and also kept the domain names</font></div>
<div><font face="courier new, monospace">similar as in the example.</font></div><div><font face="courier new, monospace"><br></font></div><div><div><font face="courier new, monospace">IPA server hostname: ipaserver</font></div>
<div><font face="courier new, monospace">IPA domain: <a href="http://ipadomain.example.com">ipadomain.example.com</a></font></div><div><font face="courier new, monospace">IPA NetBIOS: IPADOMAIN</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">AD DC hostname: adserver</font></div><div><font face="courier new, monospace">AD domain: <a href="http://addomain.example.com">addomain.example.com</a></font></div>
<div><font face="courier new, monospace">AD NetBIOS: ADDOMAIN</font></div></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">1. Updated the system and install the packages.</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"># yum update -y<br></font></div><div><font face="courier new, monospace"># yum install -y "*ipa-server" "*ipa-server-trust-ad" samba4-winbind-clients samba4-winbind samba4-client bind bind-dyndb-ldap<br>
</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">List of important packages installed during the update are as follows.</font></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace"><div> bind x86_64 32:9.8.2-0.23.rc1.el6_5.1 </div><div> bind-dyndb-ldap x86_64 2.3-5.el6 </div><div><br></div><div> ipa-server x86_64 3.0.0-37.el6 </div>
<div> ipa-server-trust-ad x86_64 3.0.0-37.el6 </div><div> ipa-admintools x86_64 3.0.0-37.el6 </div><div> ipa-client x86_64 3.0.0-37.el6 </div><div>
ipa-pki-ca-theme noarch 9.0.3-7.el6 </div><div> ipa-pki-common-theme noarch 9.0.3-7.el6 </div><div> ipa-python x86_64 3.0.0-37.el6 </div><div> ipa-server-selinux x86_64 3.0.0-37.el6 </div>
<div><br></div><div> samba4-client x86_64 4.0.0-61.el6_5.rc4 </div><div> samba4-winbind x86_64 4.0.0-61.el6_5.rc4 </div><div> samba4-winbind-clients x86_64 4.0.0-61.el6_5.rc4 </div>
<div> samba4 x86_64 4.0.0-61.el6_5.rc4 </div><div> samba4-common x86_64 4.0.0-61.el6_5.rc4 </div><div> samba4-libs x86_64 4.0.0-61.el6_5.rc4 </div><div>
samba4-python x86_64 4.0.0-61.el6_5.rc4 </div><div><br></div><div> 389-ds-base x86_64 1.2.11.15-32.el6_5 </div><div> 389-ds-base-libs x86_64 1.2.11.15-32.el6_5 </div><div>
<br></div><div> certmonger x86_64 0.61-3.el6 </div><div><br></div><div> krb5-server x86_64 1.10.3-15.el6_5.1 </div><div> krb5-workstation x86_64 1.10.3-15.el6_5.1 </div><div>
<br></div><div> sssd x86_64 1.9.2-129.el6_5.4 </div><div> sssd-client x86_64 1.9.2-129.el6_5.4 </div><div><br></div></font></div><div><br></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace">2. System details </font></div><div><font face="courier new, monospace"><br></font></div><div><div><font face="courier new, monospace">[root@ipaserver ~]# hostname</font></div>
<div><font face="courier new, monospace"><a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">[root@ipaserver ~]# cat /etc/issue</font></div>
<div><font face="courier new, monospace">CentOS release 6.5 (Final)</font></div><div><font face="courier new, monospace">Kernel \r on an \m</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">[root@ipaserver ~]# uname -a</font></div>
<div><font face="courier new, monospace">Linux <a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a> 2.6.32-431.17.1.el6.x86_64 #1 SMP Wed May 7 23:32:49 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux</font></div>
</div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><div>[root@ipaserver ~]# cat /etc/hosts</div><div>127.0.0.1<span class="" style="white-space:pre"> </span>localhost.localdomain localhost</div>
<div>::1<span class="" style="white-space:pre"> </span>localhost6.localdomain6 localhost6</div><div>10.21.0.121<span class="" style="white-space:pre"> </span><a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a> ipaserver</div>
<div><br></div><div><br></div><div>3. Install IPA server</div><div><br></div><div>[root@ipaserver ~]# ipa-server-install --domain=<a href="http://ipadomain.example.com">ipadomain.example.com</a> --realm=<a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> --setup-dns --no-forwarders<br>
</div><div><br></div><div><div>The IPA Master Server will be configured with:</div><div>Hostname: <a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a></div><div>IP address: 10.21.0.121</div>
<div>Domain name: <a href="http://ipadomain.example.com">ipadomain.example.com</a></div><div>Realm name: <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a></div><div><br></div><div>BIND DNS server will be configured to serve IPA domain with:</div>
<div>Forwarders: No forwarders</div><div>Reverse zone: 0.21.10.in-addr.arpa.</div></div><div><br></div><div>...</div><div>...</div><div><br></div><div>The install was successful and no errors during the installation.</div>
<div><br></div><div>4. Login as admin and verify IPA users are available to the system service</div><div><br></div><div><div>[root@ipaserver ~]# kinit admin</div><div>Password for <a href="mailto:admin@IPADOMAIN.EXAMPLE.COM">admin@IPADOMAIN.EXAMPLE.COM</a>: </div>
<div><br></div><div>[root@ipaserver ~]# id admin</div><div>uid=189600000(admin) gid=189600000(admins) groups=189600000(admins)</div><div><br></div><div>[root@ipaserver ~]# getent passwd admin</div><div>admin:*:189600000:189600000:Administrator:/home/admin:/bin/bash</div>
</div><div><br></div></font></div><div class="gmail_extra"><font face="courier new, monospace">5. Configure IPA server for cross-realm trust.</font></div><div class="gmail_extra"><font face="courier new, monospace"><br></font></div>
<div class="gmail_extra"><font face="courier new, monospace"><div class="gmail_extra">[root@ipaserver ~]# ipa-adtrust-install --netbios-name=IPADOMAIN</div><div class="gmail_extra"><br></div><div class="gmail_extra">The log file for this installation can be found in /var/log/ipaserver-install.log</div>
<div class="gmail_extra">==============================================================================</div><div class="gmail_extra">This program will setup components needed to establish trust to AD domains for</div><div class="gmail_extra">
the FreeIPA Server.</div><div class="gmail_extra"><br></div><div class="gmail_extra">This includes:</div><div class="gmail_extra"> * Configure Samba</div><div class="gmail_extra"> * Add trust related objects to FreeIPA LDAP server</div>
<div><br></div><div>...</div><div>...</div><div><br></div><div>All completed successfully.</div><div><br></div><div>6. I disabled the firewalls and also during the boot up.</div><div><br></div><div><div>[root@ipaserver ~]# chkconfig --list iptables</div>
<div>iptables <span class="" style="white-space:pre"> </span>0:off<span class="" style="white-space:pre"> </span>1:off<span class="" style="white-space:pre"> </span>2:off<span class="" style="white-space:pre"> </span>3:off<span class="" style="white-space:pre"> </span>4:off<span class="" style="white-space:pre"> </span>5:off<span class="" style="white-space:pre"> </span>6:off</div>
</div><div><br></div><div>7. DNS configuration</div><div><br></div><div>On windows:</div><div><br></div><div><div>C:\Windows\system32>dnscmd 127.0.0.1 /ZoneAdd <a href="http://ipadomain.example.com">ipadomain.example.com</a> /Forwarder 10.21.0.121</div>
<div>DNS Server 127.0.0.1 created zone <a href="http://ipadomain.example.com">ipadomain.example.com</a>:</div><div><br></div><div>Command completed successfully.</div><div><br></div></div><div>On Linux:</div><div><br></div>
<div><div>[root@ipaserver ~]# ipa dnszone-add <a href="http://addomain.example.com">addomain.example.com</a> --name-server=<a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a> --admin-email='<a href="mailto:hostmaster@addomain.example.com">hostmaster@addomain.example.com</a>' --force --forwarder=10.21.0.231 --forward-policy=only --ip-address=10.21.0.231</div>
<div> Zone name: <a href="http://addomain.example.com">addomain.example.com</a></div><div> Authoritative nameserver: <a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a></div><div> Administrator e-mail address: <a href="http://hostmaster.addomain.example.com">hostmaster.addomain.example.com</a>.</div>
<div> SOA serial: 1400486308</div><div> SOA refresh: 3600</div><div> SOA retry: 900</div><div> SOA expire: 1209600</div><div> SOA minimum: 3600</div><div> BIND update policy: grant <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> krb5-self * A; grant <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> krb5-self * AAAA; grant <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> krb5-self * SSHFP;</div>
<div> Active zone: TRUE</div><div> Dynamic update: FALSE</div><div> Allow query: any;</div><div> Allow transfer: none;</div><div> Zone forwarders: 10.21.0.231</div><div> Forward policy: only</div></div><div><br></div>
<div><br></div><div>Verify DNS configuration:</div><div><br></div><div>In Windows AD:-</div><div><br></div><div><div>C:\Windows\system32>nslookup</div><div>Default Server: localhost</div><div>Address: 127.0.0.1</div>
<div><br></div><div>> set type=SRV</div><div>> _ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a></div><div>Server: localhost</div><div>Address: 127.0.0.1</div><div><br></div><div>_ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a> SRV service location:</div>
<div> priority = 0</div><div> weight = 100</div><div> port = 389</div><div> svr hostname = <a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a></div>
<div><a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a> internet address = 10.21.0.231</div><div>> _ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a></div><div>
Server: localhost</div><div>Address: 127.0.0.1</div><div><br></div><div>Non-authoritative answer:</div><div>_ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a> SRV service location:</div>
<div> priority = 0</div><div> weight = 100</div><div> port = 389</div><div> svr hostname = <a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a></div>
<div><br></div><div><a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a> internet address = 10.21.0.121</div><div>> quit</div></div><div><br></div><div>In Linux IPA:-</div><div><br></div>
<div><div>[root@ipaserver ~]# dig SRV _ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a></div><div><br></div><div>; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> SRV _ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a></div>
<div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40705</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1</div><div>
<br></div><div>;; QUESTION SECTION:</div><div>;_ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a>. IN<span class="" style="white-space:pre"> </span>SRV</div><div><br></div><div>;; ANSWER SECTION:</div>
<div>_ldap._<a href="http://tcp.addomain.example.com">tcp.addomain.example.com</a>. 588 IN<span class="" style="white-space:pre"> </span>SRV<span class="" style="white-space:pre"> </span>0 100 389 <a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a>.</div>
<div><br></div><div>;; ADDITIONAL SECTION:</div><div><a href="http://adserver.addomain.example.com">adserver.addomain.example.com</a>. 3588 IN<span class="" style="white-space:pre"> </span>A<span class="" style="white-space:pre"> </span>10.21.0.231</div>
<div><br></div><div>;; Query time: 0 msec</div><div>;; SERVER: 10.21.0.121#53(10.21.0.121)</div><div>;; WHEN: Mon May 19 08:02:20 2014</div><div>;; MSG SIZE rcvd: 114</div></div><div><br></div><div><br></div><div><div>[root@ipaserver ~]# dig SRV _ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a></div>
<div><br></div><div>; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> SRV _ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a></div><div>;; global options: +cmd</div>
<div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63334</div><div>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1</div><div><br></div><div>;; QUESTION SECTION:</div>
<div>;_ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a>. IN<span class="" style="white-space:pre"> </span>SRV</div><div><br></div><div>;; ANSWER SECTION:</div><div>_ldap._<a href="http://tcp.ipadomain.example.com">tcp.ipadomain.example.com</a>. 86400<span class="" style="white-space:pre"> </span>IN SRV<span class="" style="white-space:pre"> </span>0 100 389 <a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a>.</div>
<div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://ipadomain.example.com">ipadomain.example.com</a>.<span class="" style="white-space:pre"> </span>86400<span class="" style="white-space:pre"> </span>IN<span class="" style="white-space:pre"> </span>NS<span class="" style="white-space:pre"> </span><a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a>.</div>
<div><br></div><div>;; ADDITIONAL SECTION:</div><div><a href="http://ipaserver.ipadomain.example.com">ipaserver.ipadomain.example.com</a>. 1200 IN A<span class="" style="white-space:pre"> </span>10.21.0.121</div><div><br>
</div><div>;; Query time: 1 msec</div><div>;; SERVER: 10.21.0.121#53(10.21.0.121)</div><div>;; WHEN: Mon May 19 08:02:44 2014</div><div>;; MSG SIZE rcvd: 131</div><div><br></div></div><div><br></div><div>8. Add trust with AD domain</div>
<div><br></div><div><div>[root@ipaserver ~]# ipa trust-add --type=ad <a href="http://addomain.example.com">addomain.example.com</a> --admin Administrator --password</div><div>Active directory domain administrator's password: </div>
<div>-------------------------------------------------------------</div><div>Added Active Directory trust for realm "<a href="http://addomain.example.com">addomain.example.com</a>"</div><div>-------------------------------------------------------------</div>
<div> Realm name: <a href="http://addomain.example.com">addomain.example.com</a></div><div> Domain NetBIOS name: ADDOMAIN</div><div> Domain Security Identifier: S-1-5-21-2212595442-2951398754-4232868618</div><div> Trust direction: Two-way trust</div>
<div> Trust type: Active Directory domain</div><div> Trust status: Established and verified</div></div><div><br></div><div>9. Updated kerberos configuration.</div><div><br></div><div><div>[root@ipaserver ~]# cat /etc/krb5.conf</div>
<div>includedir /var/lib/sss/pubconf/krb5.include.d/</div><div><br></div><div>[logging]</div><div> default = FILE:/var/log/krb5libs.log</div><div> kdc = FILE:/var/log/krb5kdc.log</div><div> admin_server = FILE:/var/log/kadmind.log</div>
<div><br></div><div>[libdefaults]</div><div> default_realm = <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a></div><div> dns_lookup_realm = false</div><div> dns_lookup_kdc = true</div><div> rdns = false</div>
<div> ticket_lifetime = 24h</div><div> forwardable = yes</div><div><br></div><div>[realms]</div><div> <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> = {</div><div> kdc = <a href="http://ipaserver.ipadomain.example.com:88">ipaserver.ipadomain.example.com:88</a></div>
<div> master_kdc = <a href="http://ipaserver.ipadomain.example.com:88">ipaserver.ipadomain.example.com:88</a></div><div> admin_server = <a href="http://ipaserver.ipadomain.example.com:749">ipaserver.ipadomain.example.com:749</a></div>
<div> default_domain = <a href="http://ipadomain.example.com">ipadomain.example.com</a></div><div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div><div> auth_to_local = RULE:[1:$1@$0](^.*@<a href="http://ADDOMAIN.EXAMPLE.COM">ADDOMAIN.EXAMPLE.COM</a>$)s/@<a href="http://ADDOMAIN.EXAMPLE.COM/@addomain.example.com/">ADDOMAIN.EXAMPLE.COM/@addomain.example.com/</a></div>
<div> auth_to_local = DEFAULT</div><div>}</div><div><br></div><div>[domain_realm]</div><div> .<a href="http://ipadomain.example.com">ipadomain.example.com</a> = <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a></div>
<div> <a href="http://ipadomain.example.com">ipadomain.example.com</a> = <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a></div><div><br></div><div>[dbmodules]</div><div> <a href="http://IPADOMAIN.EXAMPLE.COM">IPADOMAIN.EXAMPLE.COM</a> = {</div>
<div> db_library = ipadb.so</div><div> }</div></div><div><br></div><div><br></div><div>10. Allow AD users to access resources in IPA domain</div><div><br></div><div><div>[root@ipaserver ~]# ipa group-add --desc='<a href="http://addomain.example.com">addomain.example.com</a> admins external map' ad_admins_external --external</div>
<div>--------------------------------</div><div>Added group "ad_admins_external"</div><div>--------------------------------</div><div> Group name: ad_admins_external</div><div> Description: <a href="http://addomain.example.com">addomain.example.com</a> admins external map</div>
<div>[root@ipaserver ~]# ipa group-add --desc='<a href="http://addomain.example.com">addomain.example.com</a> admins' ad_admins</div><div>-----------------------</div><div>Added group "ad_admins"</div><div>
-----------------------</div><div> Group name: ad_admins</div><div> Description: <a href="http://addomain.example.com">addomain.example.com</a> admins</div><div> GID: 189600004</div><div>[root@ipaserver ~]# ipa group-add-member ad_admins_external --external 'ADDOMAIN\Domain Admins'</div>
<div>[member user]: </div><div>[member group]: </div><div> Group name: ad_admins_external</div><div> Description: <a href="http://addomain.example.com">addomain.example.com</a> admins external map</div><div> External member: S-1-5-21-2212595442-2951398754-4232868618-512</div>
<div>-------------------------</div><div>Number of members added 1</div><div>-------------------------</div><div>[root@ipaserver ~]# ipa group-add-member ad_admins --groups ad_admins_external</div><div> Group name: ad_admins</div>
<div> Description: <a href="http://addomain.example.com">addomain.example.com</a> admins</div><div> GID: 189600004</div><div> Member groups: ad_admins_external</div><div>-------------------------</div><div>Number of members added 1</div>
<div>-------------------------</div></div><div><br></div><div><br></div><div>11. Verifying trust</div><div><br></div><div><div>[root@ipaserver ~]# wbinfo -n 'ADDOMAIN\Domain Admins'</div><div>failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND</div>
<div>Could not lookup name ADDOMAIN\Domain Admins</div><div><br></div><div>[root@ipaserver ~]# wbinfo -u</div><div><br></div><div>[root@ipaserver ~]# ipa trust-find</div><div>---------------</div><div>1 trust matched</div>
<div>---------------</div><div> Realm name: <a href="http://addomain.example.com">addomain.example.com</a></div><div> Domain NetBIOS name: ADDOMAIN</div><div> Domain Security Identifier: S-1-5-21-2212595442-2951398754-4232868618</div>
<div> Trust type: Active Directory domain</div><div>----------------------------</div><div>Number of entries returned 1</div><div>----------------------------</div><div><br></div><div>[root@ipaserver ~]# ipa trust-show</div>
<div>Realm name: <a href="http://ADDOMAIN.EXAMPLE.COM">ADDOMAIN.EXAMPLE.COM</a></div><div> Realm name: <a href="http://addomain.example.com">addomain.example.com</a></div><div> Domain NetBIOS name: ADDOMAIN</div><div> Domain Security Identifier: S-1-5-21-2212595442-2951398754-4232868618</div>
<div> Trust direction: Two-way trust</div><div> Trust type: Active Directory domain</div></div><div><br></div><div><br></div><div><br></div><div>Please note the error message while verifying trust. I am stuck completely</div>
<div>and not having any clue as why the setup is not working as expected.</div><div><br></div><div>Any help in fixing this problem would be appreciated.<br></div><div><br></div><div><br></div></font></div><div class="gmail_extra">
<font face="courier new, monospace"><br><br></font><div class="gmail_quote"><font face="courier new, monospace">On Fri, May 16, 2014 at 7:26 PM, Supratik Goswami <span dir="ltr"><<a href="mailto:supratiksekhar@gmail.com" target="_blank">supratiksekhar@gmail.com</a>></span> wrote:<br>
</font><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><font face="courier new, monospace">The IP 10.255.0.4 belongs to the Windows 2008 R2 system running AD DC.</font><div>
<font face="courier new, monospace">I disabled the firewall but still the problem is there :-(</font></div></div><div class="gmail_extra"><div><div class="h5"><font face="courier new, monospace"><br><br></font><div class="gmail_quote">
<font face="courier new, monospace">On Fri, May 16, 2014 at 7:14 PM, Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span> wrote:<br>
</font><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><font face="courier new, monospace">On Fri, May 16, 2014 at 04:29:33PM +0530, Supratik Goswami wrote:<br>
> Yes DNS is working fine and is able to return the IP address of the AD<br>
> server.<br>
><br>
> [root@master samba]# dig SRV _ldap._<a href="http://tcp.ad.idm.example.com" target="_blank">tcp.ad.idm.example.com</a><br>
><br>
> ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> SRV _ldap._<br>
> <a href="http://tcp.ad.idm.example.com" target="_blank">tcp.ad.idm.example.com</a><br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29147<br>
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br>
><br>
> ;; QUESTION SECTION:<br>
> ;_ldap._<a href="http://tcp.ad.idm.example.com" target="_blank">tcp.ad.idm.example.com</a>. IN SRV<br>
><br>
> ;; ANSWER SECTION:<br>
> _ldap._<a href="http://tcp.ad.idm.example.com" target="_blank">tcp.ad.idm.example.com</a>. 600 IN SRV 0 100 389<br>
> <a href="http://master.ad.idm.example.com" target="_blank">master.ad.idm.example.com</a>.<br>
><br>
> ;; ADDITIONAL SECTION:<br>
> <a href="http://master.ad.idm.example.com" target="_blank">master.ad.idm.example.com</a>. 3600 IN A 10.255.0.4<br>
><br>
> ;; Query time: 1 msec<br>
> ;; SERVER: 10.255.0.4#53(10.255.0.4)<br>
> ;; WHEN: Fri May 16 10:46:23 2014<br>
> ;; MSG SIZE rcvd: 106<br>
><br>
><br>
><br>
> In my case AD is the netbios name of the AD domain. Please find the log<br>
> message from the file log.wb-AD.<br>
><br>
><br>
<br>
</font></div><font face="courier new, monospace">...<br>
</font><div><font face="courier new, monospace"><br>
> [2014/05/16 10:50:37.542420, 5, pid=3305, effective(0, 0), real(0, 0)]<br>
</font></div><div><div><font face="courier new, monospace">> [2014/05/16 10:50:44.451669, 3, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/util_sock.c:585(open_socket_out_send)<br>
> Connecting to 10.255.0.4 at port 445<br>
> [2014/05/16 10:50:44.452793, 3, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/clidgram.c:333(nbt_getdc_send)<br>
> No nmbd found<br>
> [2014/05/16 10:50:44.452930, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/namequery.c:916(name_status_find)<br>
> name_status_find: looking up AD#1c at 10.255.0.4<br>
> [2014/05/16 10:50:44.453044, 5, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/namecache.c:299(namecache_status_fetch)<br>
> namecache_status_fetch: no entry for NBT/AD#1C.20.10.255.0.4 found.<br>
> [2014/05/16 10:50:44.453279, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/util_sock.c:499(open_socket_in)<br>
> bind succeeded on port 0<br>
> [2014/05/16 10:50:44.453449, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/unexpected.c:546(nb_packet_reader_connected)<br>
> async_connect failed: No such file or directory<br>
> [2014/05/16 10:50:44.453564, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/namequery.c:600(nb_trans_got_reader)<br>
> nmbd not around<br>
> [2014/05/16 10:50:45.454766, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:46.456103, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:47.457451, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:48.458773, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:49.460093, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:50.461420, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:51.462723, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:52.464265, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:53.465546, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750470<br>
> [2014/05/16 10:50:54.455168, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/lib/events.c:216(run_events_poll)<br>
> Running timed event "tevent_req_timedout" 0x1750590<br>
> [2014/05/16 10:50:54.455385, 10, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/namequery.c:962(name_status_find)<br>
> name_status_find: name not found<br>
> [2014/05/16 10:50:54.455497, 10, pid=3305, effective(0, 0), real(0, 0),<br>
> class=tdb] ../source3/lib/gencache.c:179(gencache_set_data_blob)<br>
> Adding cache entry with key = NEG_CONN_CACHE/AD,10.255.0.4 and timeout =<br>
> Fri May 16 10:51:54 2014<br>
> (60 seconds ahead)<br>
> [2014/05/16 10:50:54.455739, 9, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/conncache.c:189(add_failed_connection_entry)<br>
> add_failed_connection_entry: added domain AD (10.255.0.4) to failed conn<br>
> cache<br>
<br>
</font></div></div><div><font face="courier new, monospace">> class=tdb] ../source3/lib/gencache.c:246(gencache_del)<br>
> Deleting cache entry (key = SAFJOIN/DOMAIN/AD)<br>
> [2014/05/16 10:50:54.455967, 10, pid=3305, effective(0, 0), real(0, 0),<br>
> class=tdb] ../source3/lib/gencache.c:246(gencache_del)<br>
> Deleting cache entry (key = SAF/DOMAIN/AD)<br>
> [2014/05/16 10:50:54.456078, 10, pid=3305, effective(0, 0), real(0, 0),<br>
> class=tdb] ../source3/lib/gencache.c:179(gencache_set_data_blob)<br>
> Adding cache entry with key = NEG_CONN_CACHE/<a href="http://ad.idm.example.com" target="_blank">ad.idm.example.com</a>,10.255.0.4<br>
> and timeout = Fri May 16 10:51:54 2014<br>
> (60 seconds ahead)<br>
> [2014/05/16 10:50:54.456236, 9, pid=3305, effective(0, 0), real(0, 0)]<br>
> ../source3/libsmb/conncache.c:189(add_failed_connection_entry)<br>
> add_failed_connection_entry: added domain <a href="http://ad.idm.example.com" target="_blank">ad.idm.example.com</a> (10.255.0.4)<br>
> to failed conn cache<br>
> [2014/05/16 10:50:54.456330, 10, pid=3305, effective(0, 0), real(0, 0),<br>
> class=tdb] ../source3/lib/gencache.c:246(gencache_del)<br>
<br>
</font></div><font face="courier new, monospace">looks like the connection to 10.255.0.4 timed out after 10 seconds. Is<br>
there a firewall which might drop the packets?<br>
<br>
bye,<br>
Sumit<br>
</font></blockquote></div><font face="courier new, monospace"><br><br clear="all"></font><div><font face="courier new, monospace"><br></font></div></div></div><span class=""><font color="#888888" face="courier new, monospace">-- <br>
Warm Regards<br><br>Supratik
</font></span></div>
</blockquote></div><font face="courier new, monospace"><br><br clear="all"></font><div><font face="courier new, monospace"><br></font></div><font face="courier new, monospace">-- <br>Warm Regards<br><br>Supratik
</font></div></div>