Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Ebox PDC: Cannot join workstations to domain

Posted on 2009-05-10
7
Medium Priority
?
3,027 Views
Last Modified: 2013-12-02
Hello experts,

I'm migrating a Windows 2003 domain to a domain using free tools using an ebox domain controller.  Everything was going quite well since I decided to reboot the server.  Since then, I cannot join the workstations to the domain.

When I try to join the workstation, I get a username/password prompt, and then I get the Message "The domain is not accessible or it cannot be found".  I have tried so many solutions from this forum, but none of them have worked (or I haven't been smart enough to get them working).  I have a Wireshark capture of the client/server conversation, and the workstation queries using netbios net service for the domain name, to the broadcast address, but gets no response whatsoever.

The problem is, I have migrated all of the accounts to the new domain, and I don't want to reinstall or make configurations changes that won't let me keep my migrated information as it is.

I'm using Ubuntu Server 8.04 LTS amd64, and  ebox 1.0.3-0ubuntu1~ppa1~hardy1

What can I do?

Thanks in advance,

marce_lito
0
Comment
Question by:marce_lito
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 10

Expert Comment

by:lanboyo
ID: 24360178
You want to check the samba log files...


samba_directory /var/smbd.log and samba_directory /var/nmbd.log

Something hre may give you some assistance. Additionally since this occured during a reboot, someone may have grabbed the AD roles for the network in the servers absense.
0
 
LVL 6

Author Comment

by:marce_lito
ID: 24360636
Thanks for the comment... Thought so too... especially one of the browser roles...

I guess the problem is in nmbd, as all the fuctionality of smbd is available... I've managed to join the computers specifying a wins server explicitly... I would have loved to put the wins server in dhcp, but there's no such option in ebox, and even though I could have edited the stub files directly, any update would have broken the hand made configuration...

Just in case you can give me some sort of clue, here's the nmbd log
  There is already a domain master browser at IP 10.80.46.3 for workgroup MICSIED.LOCAL registered on subnet UNICAST_SUBNET.
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(335)
  become_domain_master_browser_wins:
  Attempting to become domain master browser on workgroup MICSIED.LOCAL, subnet UNICAST_SUBNET.
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(349)
  become_domain_master_browser_wins: querying WINS server from IP 127.0.0.1 for domain master browser name MICSIED.LOCAL<1b> on workgroup MICSIED.LOCAL
[2009/05/11 10:17:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_query_success(233)
  become_domain_master_query_success:
  There is already a domain master browser at IP 10.80.46.3 for workgroup MICSIED.LOCAL registered on subnet UNICAST_SUBNET.
[2009/05/11 10:18:20, 0] nmbd/nmbd_browsesync.c:domain_master_node_status_fail(248)
  domain_master_node_status_fail:
  Doing a node status request to the domain master browser
  for workgroup MICSIED.LOCAL at IP 10.80.46.3 failed.
  Cannot sync browser lists.
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(335)
  become_domain_master_browser_wins:
  Attempting to become domain master browser on workgroup MICSIED.LOCAL, subnet UNICAST_SUBNET.
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_wins(349)
  become_domain_master_browser_wins: querying WINS server from IP 127.0.0.1 for domain master browser name MICSIED.LOCAL<1b> on workgroup MICSIED.LOCAL
[2009/05/11 10:22:59, 0] nmbd/nmbd_become_dmb.c:become_domain_master_query_success(233)

10.80.46.3 is actually my external ip address... I really don't know what's that doing there since samba is not listening on that interface...
0
 
LVL 10

Expert Comment

by:lanboyo
ID: 24363653
I dont know if you can edit smb.conf on eebox, but you probably want to limit the connections to your precise interfaces by adding this to smb.conf

[global]
    interfaces = eth1 lo
    bind interfaces only = yes

This covers smb and nmb, usually.

You'll need to restart.

0
Containers & Docker to Create a Powerful Team

Containers are an incredibly powerful technology that can provide you and/or your engineering team with huge productivity gains. Using containers, you can deploy, back up, replicate, and move apps and their dependencies quickly and easily.

 
LVL 10

Expert Comment

by:lanboyo
ID: 24363668
Interfaces should be your internal interface...

http://samba.org/~tpot/articles/multiple-interfaces.html
0
 
LVL 10

Accepted Solution

by:
lanboyo earned 2000 total points
ID: 24363905
Put in a ticket with ebox.

Is there any way that the internal and external interfaces were swapped on reboot? That is, did eth1 become the internal and eth0 become external or whatever?

I don't know if you have or are comfortable with manually editing the ebox configuration files. The internet has an example where the ebox was not the default interface for the network.

I think your problem is that samba is running on your external interface, and the domain master browser is unavailable from the internal interface.

You would need to re-enable ssh in th ebox gui and edit some files by hand...

You would need to edit /usr/shares/ebox/stubs/samba/smb.conf.mas
as above, or it will get deleted each reboot.

dhcp can be manipulated by editing

/usr/share/ebox/stubs/dhcp/dhcp.conf.mas

option netbios-name-servers 172.16.0.1;
option netbios-node-type 8; ### Node type = Hybrid ###

that 172. address needs to be your internal interface.


--------
copied from http://trac.ebox-platform.com/ticket/1268
---------

Ebox needs to add two lines to dhcp.conf when PDC is enabled:

option netbios-name-servers 172.16.0.1; <-EBOX SERVER

option netbios-node-type 8; ### Node type = Hybrid ###

In a standard two interface setup, this is not an issue because netbios automatically looks to the default gateway (EBOX). If, however, ebox is not the default gateway, workstations will not be able to find the PDC to join the domain w/o having to manually add the WINS server interface entry at each workstation.

I tested this fairly thoroughly this evening and I would consider this a major bug for anyone using ebox as a PDC that is not the default gateway.

Cheers,

-Jim
Attachments
Change History
Changed 4 months ago by juruen@& ¶

I think we are missing something here. I always test the PDC configuration in my local network with a machine that only has one interface. My test machine is not working as a gateway, and I have added windows machines to the domain successfully. So I'm pretty sure it should be something else that we are missing...
Changed 4 months ago by jcanfield@& ¶

Hmmm...I'll dig a little deeper. Your client computers are using the default windows interface setting of "Get netbios info from DHCP server" right? ...not NETBIOS over TCP/IP?

Could be a WINS issue. The only way I could get the machines to join w/o editing DHCP conf was by adding a WINS server entry on each client.
Changed 4 months ago by jcanfield@& ¶

I finally have things working the way I want. Here's what needs to be done:

Firstly, this error is a result of having winbind installed. The simple fix is to uninstall winbind and your domain will work just fine in broadcast mode. If, however, you are interested in running winbind this what needs to be done:

1) add the lines above to dhcp.conf.mas

2) run 'smbldap-populate' This will allow root to be the "Netbios Domain Administrator"

3) run 'smbldap-usermod -d /root -s /bin/bash root' This will fix the root account pointers.

4) restart samba and winbind

5) Join the domain locally 'net rpc join -S DOMAIN -U root%password

6) restart winbind

7) Do an anonymous domain query 'smbclient -L localhost -U%' If you see your server and shares you should be all set.

The advantages of of this config:

- Direct WINS host lookups (Reduces broadcast traffic on larger networks)

- Hostnames are matched to IP's even if they are not in DNS.

Also, running smbldap-populate will create a 'nobody' user. This might be annoying for some users. I'm not sure at this point exact what the account is used for.

Changed 7 weeks ago by michael.judd@& ¶

Just letting you know - I had the same issue and this ticket fixed the problem. I also had a separate gateway and I was having problems joining a windows XP computer to the domain. It would be great to see this in the core. I'm on: 0.11.100
Changed 7 weeks ago by juruen@& ¶

Micheal,

Did you have winbind installed on the eBox machine when you tried to add the machine to the domain?

If you did, that's probably the reason why you couldn't add the machine to the domain.
Changed 7 weeks ago by michael.judd@& ¶

No - there's no winbind installed as far as I can see (no /etc/init.d/winbindd)
0
 
LVL 6

Author Comment

by:marce_lito
ID: 24365008
You can't edit smb.conf directly in ebox, but you can edit the stub files that will become smb.conf... about the interfaces, it was already there... samba was already  only listening on the internal interfaces... Indeed I had to edit the stub files by hand in order to do that... I have checked it with netstat, and only the internal interface is listening on port 139 and the others...
Still, I really don't know why the external interface is throwing nmb errors, and why nmbd is not answering broadcast queries for the domain name... I thought it could some firewall issue, but no luck without the firewall either... anyway, the wins server specification in the dhcpd files was a great idea...

Ebox could be a really simple solutions, but I guess it still needs time to get mature... If were the one to manage the domain, I would have installed the samba package independently, and managed it independently... alas, I'm doing this for a client terrified to death by a CLI.

Thanks a lot, you have been very helpful
0
 
LVL 6

Author Closing Comment

by:marce_lito
ID: 31579996
Thanks a lot... putting the WINS options in the dhcpd stub files is what I'm going to do, but they will get overwritten if I upgrade my box... anyway, I haven't discovered why the linux box is not answering queries for the domain name...
0

Featured Post

Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Goal:  To set up a secure SSH server for your home computer to make it accessible anywhere AND to use it as a port forwarding proxy. Steps 1.  WinSSHD version 5 is free for personal use.  So download and install it.  You can download it from the…
If, like me, you have a lot of Dell servers in the estate you manage this article should save you a little time. When attempting to login to iDrac on any server I would be presented with two errors. The first reads "Do you want to run this applicati…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question