Solved

Ebox PDC: Cannot join workstations to domain

Posted on 2009-05-10
7
3,010 Views
Last Modified: 2013-12-02
Hello experts,

I'm migrating a Windows 2003 domain to a domain using free tools using an ebox domain controller.  Everything was going quite well since I decided to reboot the server.  Since then, I cannot join the workstations to the domain.

When I try to join the workstation, I get a username/password prompt, and then I get the Message "The domain is not accessible or it cannot be found".  I have tried so many solutions from this forum, but none of them have worked (or I haven't been smart enough to get them working).  I have a Wireshark capture of the client/server conversation, and the workstation queries using netbios net service for the domain name, to the broadcast address, but gets no response whatsoever.

The problem is, I have migrated all of the accounts to the new domain, and I don't want to reinstall or make configurations changes that won't let me keep my migrated information as it is.

I'm using Ubuntu Server 8.04 LTS amd64, and  ebox 1.0.3-0ubuntu1~ppa1~hardy1

What can I do?

Thanks in advance,

marce_lito
0
Comment
Question by:marce_lito
  • 4
  • 3
7 Comments
 
LVL 10

Expert Comment

by:lanboyo
Comment Utility
You want to check the samba log files...


samba_directory /var/smbd.log and samba_directory /var/nmbd.log

Something hre may give you some assistance. Additionally since this occured during a reboot, someone may have grabbed the AD roles for the network in the servers absense.
0
 
LVL 6

Author Comment

by:marce_lito
Comment Utility
Thanks for the comment... Thought so too... especially one of the browser roles...

I guess the problem is in nmbd, as all the fuctionality of smbd is available... I've managed to join the computers specifying a wins server explicitly... I would have loved to put the wins server in dhcp, but there's no such option in ebox, and even though I could have edited the stub files directly, any update would have broken the hand made configuration...

Just in case you can give me some sort of clue, here's the nmbd log
  There is already a domain master browser at IP 10.80.46.3 for workgroup MICSIED.LOCAL registered on subnet UNICAST_SUBNET.
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(335)
  become_domain_master_browser_wins:
  Attempting to become domain master browser on workgroup MICSIED.LOCAL, subnet UNICAST_SUBNET.
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(349)
  become_domain_master_browser_wins: querying WINS server from IP 127.0.0.1 for domain master browser name MICSIED.LOCAL<1b> on workgroup MICSIED.LOCAL
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_query_success(233)
  become_domain_master_query_success:
  There is already a domain master browser at IP 10.80.46.3 for workgroup MICSIED.LOCAL registered on subnet UNICAST_SUBNET.
[2009/05/11 10:18:20, 0] nmbd/nmbd_browsesync.c:domain_master_node_status_fail(248)
  domain_master_node_status_fail:
  Doing a node status request to the domain master browser
  for workgroup MICSIED.LOCAL at IP 10.80.46.3 failed.
  Cannot sync browser lists.
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(335)
  become_domain_master_browser_wins:
  Attempting to become domain master browser on workgroup MICSIED.LOCAL, subnet UNICAST_SUBNET.
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(349)
  become_domain_master_browser_wins: querying WINS server from IP 127.0.0.1 for domain master browser name MICSIED.LOCAL<1b> on workgroup MICSIED.LOCAL
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_query_success(233)

10.80.46.3 is actually my external ip address... I really don't know what's that doing there since samba is not listening on that interface...
0
 
LVL 10

Expert Comment

by:lanboyo
Comment Utility
I dont know if you can edit smb.conf on eebox, but you probably want to limit the connections to your precise interfaces by adding this to smb.conf

[global]
    interfaces = eth1 lo
    bind interfaces only = yes

This covers smb and nmb, usually.

You'll need to restart.

0
Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

 
LVL 10

Expert Comment

by:lanboyo
Comment Utility
Interfaces should be your internal interface...

http://samba.org/~tpot/articles/multiple-interfaces.html
0
 
LVL 10

Accepted Solution

by:
lanboyo earned 500 total points
Comment Utility
Put in a ticket with ebox.

Is there any way that the internal and external interfaces were swapped on reboot? That is, did eth1 become the internal and eth0 become external or whatever?

I don't know if you have or are comfortable with manually editing the ebox configuration files. The internet has an example where the ebox was not the default interface for the network.

I think your problem is that samba is running on your external interface, and the domain master browser is unavailable from the internal interface.

You would need to re-enable ssh in th ebox gui and edit some files by hand...

You would need to edit /usr/shares/ebox/stubs/samba/smb.conf.mas
as above, or it will get deleted each reboot.

dhcp can be manipulated by editing

/usr/share/ebox/stubs/dhcp/dhcp.conf.mas

option netbios-name-servers 172.16.0.1;
option netbios-node-type 8; ### Node type = Hybrid ###

that 172. address needs to be your internal interface.


--------
copied from http://trac.ebox-platform.com/ticket/1268
---------

Ebox needs to add two lines to dhcp.conf when PDC is enabled:

option netbios-name-servers 172.16.0.1; <-EBOX SERVER

option netbios-node-type 8; ### Node type = Hybrid ###

In a standard two interface setup, this is not an issue because netbios automatically looks to the default gateway (EBOX). If, however, ebox is not the default gateway, workstations will not be able to find the PDC to join the domain w/o having to manually add the WINS server interface entry at each workstation.

I tested this fairly thoroughly this evening and I would consider this a major bug for anyone using ebox as a PDC that is not the default gateway.

Cheers,

-Jim
Attachments
Change History
Changed 4 months ago by juruen@& ¶

I think we are missing something here. I always test the PDC configuration in my local network with a machine that only has one interface. My test machine is not working as a gateway, and I have added windows machines to the domain successfully. So I'm pretty sure it should be something else that we are missing...
Changed 4 months ago by jcanfield@& ¶

Hmmm...I'll dig a little deeper. Your client computers are using the default windows interface setting of "Get netbios info from DHCP server" right? ...not NETBIOS over TCP/IP?

Could be a WINS issue. The only way I could get the machines to join w/o editing DHCP conf was by adding a WINS server entry on each client.
Changed 4 months ago by jcanfield@& ¶

I finally have things working the way I want. Here's what needs to be done:

Firstly, this error is a result of having winbind installed. The simple fix is to uninstall winbind and your domain will work just fine in broadcast mode. If, however, you are interested in running winbind this what needs to be done:

1) add the lines above to dhcp.conf.mas

2) run 'smbldap-populate' This will allow root to be the "Netbios Domain Administrator"

3) run 'smbldap-usermod -d /root -s /bin/bash root' This will fix the root account pointers.

4) restart samba and winbind

5) Join the domain locally 'net rpc join -S DOMAIN -U root%password

6) restart winbind

7) Do an anonymous domain query 'smbclient -L localhost -U%' If you see your server and shares you should be all set.

The advantages of of this config:

- Direct WINS host lookups (Reduces broadcast traffic on larger networks)

- Hostnames are matched to IP's even if they are not in DNS.

Also, running smbldap-populate will create a 'nobody' user. This might be annoying for some users. I'm not sure at this point exact what the account is used for.

Changed 7 weeks ago by michael.judd@& ¶

Just letting you know - I had the same issue and this ticket fixed the problem. I also had a separate gateway and I was having problems joining a windows XP computer to the domain. It would be great to see this in the core. I'm on: 0.11.100
Changed 7 weeks ago by juruen@& ¶

Micheal,

Did you have winbind installed on the eBox machine when you tried to add the machine to the domain?

If you did, that's probably the reason why you couldn't add the machine to the domain.
Changed 7 weeks ago by michael.judd@& ¶

No - there's no winbind installed as far as I can see (no /etc/init.d/winbindd)
0
 
LVL 6

Author Comment

by:marce_lito
Comment Utility
You can't edit smb.conf directly in ebox, but you can edit the stub files that will become smb.conf... about the interfaces, it was already there... samba was already  only listening on the internal interfaces... Indeed I had to edit the stub files by hand in order to do that... I have checked it with netstat, and only the internal interface is listening on port 139 and the others...
Still, I really don't know why the external interface is throwing nmb errors, and why nmbd is not answering broadcast queries for the domain name... I thought it could some firewall issue, but no luck without the firewall either... anyway, the wins server specification in the dhcpd files was a great idea...

Ebox could be a really simple solutions, but I guess it still needs time to get mature... If were the one to manage the domain, I would have installed the samba package independently, and managed it independently... alas, I'm doing this for a client terrified to death by a CLI.

Thanks a lot, you have been very helpful
0
 
LVL 6

Author Closing Comment

by:marce_lito
Comment Utility
Thanks a lot... putting the WINS options in the dhcpd stub files is what I'm going to do, but they will get overwritten if I upgrade my box... anyway, I haven't discovered why the linux box is not answering queries for the domain name...
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Introduction People like FTP.  It's a solid, stable, robust protocol for quickly transferring files between two hosts using TCP/IP.  In most cases it's much faster than SMB or CIFS, and certainly much easier to set up between organizations.  This…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now