Host is not configured as a member server: Samba joining Windows 2003 AD

linuxlover.chaitanya · 10-15-2009, 05:17 AM

Hello all,

Wanting to join my CentOS5.3 to a windows 2003 active directory.
Configured kerberos and samba.

Code:

[libdefaults]
 default_realm = domain
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes
 default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
 default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC

[realms]
  domain = {
  kdc = <ip>:88
  admin_server = <ip>:749
  default_domain = domain
 }

Code:

[global]
netbios name = IB
workgroup = domain
realm = domain.com
encrypt passwords = yes
security = ADS
password server = <ad server ip>
log level = 3

Code:

net ads join -U administrator@domain
Host is not configured as a member server.
Invalid configuration.  Exiting....
Failed to join domain: Invalid domain role

Any ideas.

Forrest Coredump · 10-16-2009, 01:44 AM

First of all, your going to need to enable a name service for this to work properly (wins or prefereably DNS). I would look there before anything else. Can you do a kinit <username> on the system you trying to join to AD (test your kerberos setup)? Are you running SELinux?

It would be helpful if you could post the output to the following (attempt to join with additional debug output). Redact your personal info you don't want posted ;-)

net ads join -D 5 -S <domain controllers IP address> -U administrator

A few other things to note, though most likely unrelated to this problem,

1.) Check you time on both servers, too much drift will cause the operation to fail
2.) Don't forget your /etc/krb5.conf /etc/pam.d, and /etc/nssswitch.conf, /etc/hosts settings
3.) Either winbind, or a correct win username-linux uid mapping

An excellent resource is below:
http://www.stuartellis.eu/articles/l...#prerequisites

linuxlover.chaitanya · 10-16-2009, 04:07 AM

I have finally joined the squid machine to windows 2003 active directory domain with LikeWise. And it shows up in AD server. DNS is already configured and working fine. I can nslookup the hostnames.
I can use kinit and time on both the machines are similar.

This is the output of net ads join

Code:

Host is not configured as a member server.
Invalid configuration.  Exiting....
Failed to join domain: Invalid domain role

Forrest Coredump · 10-16-2009, 06:10 AM

This is probably the most obvious of them all (permissions issue). Did you pre-statge the machine account in AD? In some instance that's necessary (when insufficient priviliges, or naming issues prevent automatic account creation). Go to your default computer OU in AD and create a machine account matching the name of your linux box in DNS.

Retry the "net ads join"

My guess is that's all that's wrong here...

linuxlover.chaitanya · 10-20-2009, 12:29 AM

I do have those. DNS has the entry for squid machine with the same name as the OU in the AD. I can login using my domain account in squid. So I guess Like Wise has worked and added it to domain successfully. And squid shows in the AD.

linuxlover.chaitanya · 10-20-2009, 04:37 AM

I yum removed samba, removed all the samba files, yum installed samba, configured samba again and it is working now. I just hope ntlm works as well without issues. With command line, I can check ntlm and it works, but it needs domain username as option which I do not want to pass. This is because I would want to use squid with ntlm and I can not pass username from squid configuration file. I want it to authenticate from the domain username that has been used to log in into the system.
Is there any option like %LOGIN or something that can take this username automatically? Wiki pages do say this is automatically done but I do think it will be possible in my case.
And I guess we all missed this: I am using squid in TRANSPARENT mode.