samba join to active directory

boazs · 08-08-2009, 12:41 PM

i am try to join ma box which is debian kernel 2.6.30-1-amd64
my smb.conf global section is
[global]
workgroup = SHATZ
realm = SHATZ.ORG.EDU
server string = %h server
security = ADS
obey pam restrictions = Yes
password server = shatzdc.shatz.org.edu
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
dns proxy = No
panic action = /usr/share/samba/panic-action %d

when i use net ADS join i got
Failed to join domain: failed to find DC for domain SHATZ.ORG.EDU
any help would be appriciate

mcolangelo · 08-08-2009, 02:45 PM

Could be a DNS issue and the SRV record for your server not getting resolved properly. Stupid question, but are you sure you're using the right realm name?

You could try specifying the AD server with:

Code:

net ads join -S SERVER -U <username>%<password>

boazs · 08-08-2009, 05:01 PM

trying
net ads join -S server -U user%password gave

failed to connect to AD: Cannot resolve network address for KDC in requested realm
but pinging the kdc work well

mcolangelo · 08-09-2009, 06:06 PM

You could still be able to ping the server and have a DNS issue.

What did you use for SERVER in the command
net ads join -S SERVER -U <username>%<password>

To rule out any DNS issues you can check your srv records with
dig _ldap._tcp.DOMAIN.COM SRV
_kerberos._tcp.DOMAIN.COM. SRV
_ldap._tcp.dc._msdcs.DOMAIN.COM. SRV
_kerberos._tcp.dc._msdcs.DOMAIN.COM. SRV

Valid output would look something like

Code:

# dig @localhost _ldap._tcp.mydomain.dom SRV
;; QUESTION SECTION:
;_ldap._tcp.socnet.dom.		IN	SRV

;; ANSWER SECTION:
_ldap._tcp.mydomain.dom.	259200	IN	SRV	0 0 389 hostname.mydomain.dom.

Have you tried taking a look at something like http://wiki.samba.org/index.php/Samb...tive_Directory double checking that all your other requirements have been met?

boazs · 08-09-2009, 09:53 PM

thanks it is nowwork was aspelling mistake