LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 07-07-2015, 08:25 AM   #1
michael234
LQ Newbie
 
Registered: Jul 2015
Posts: 9

Rep: Reputation: Disabled
New Samba AD-DC as member: port 135 - NT_STATUS_CONNECTION_REFUSED


!!!UPDATE AT BOTTOM!!!

Hello everybody,

I'm trying to setup an additional Active Directory domain controller. The other 2 are on Windows, this one on debian, raspbian to be precise:

Code:
root@raspberrypi1:/var/log/samba# uname -a
Linux raspberrypi1 4.0.5+ #797 PREEMPT Sat Jun 20 00:47:38 BST 2015 armv6l GNU/Linux
root@raspberrypi1:/var/log/samba# cat /etc/debian_version
8.0
pi@raspberrypi1 ~ $ samba -V
Version 4.1.17-Debian
root@raspberrypi1:/var/log/samba# named -v
BIND 9.9.5-9-Raspbian (Extended Support Version)
I tried to follow this manual (unfortunately it is only in German): http://znil.net/index.php?title=Rasp...anuell_starten

Anyway, the join worked with all the

Partition[...] objects[402/1618] linked_values[0/0]

messages until it finally said

Joined domain [...] as a DC

I'm using bind as backend.

Unfortunately it doesn't seem to fully work:

Code:
root@raspberrypi1:/var/log/samba# samba-tool drs showrepl -d 4
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
Processing section "[global]"
Processing section "[netlogon]"
Processing section "[sysvol]"
pm_process() returned Yes
ldb_wrap open of secrets.ldb
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'schannel' registered
GENSEC backend 'spnego' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Using binding ncacn_ip_tcp:raspberrypi1.my.domain.name[,seal]
Mapped to DCERPC endpoint 135
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
added interface lo ip=::1 bcast= netmask=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
added interface lo ip=::1 bcast= netmask=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
Failed to connect host 192.168.0.33 on port 135 - NT_STATUS_CONNECTION_REFUSED
Failed to connect host 192.168.0.33 (raspberrypi1.my.domain.name) on port 135 - NT_STATUS_CONNECTION_REFUSED.
ERROR(<class 'samba.drs_utils.drsException'>): DRS connection to raspberrypi1.my.domain.name failed - drsException: DRS connection to raspberrypi1.my.domain.name failed: (-1073741258, 'The connection was refused')
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/drs.py", line 39, in drsuapi_connect
    (ctx.drsuapi, ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_utils.drsuapi_connect(ctx.server, ctx.lp, ctx.creds)
  File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 54, in drsuapi_connect
    raise drsException("DRS connection to %s failed: %s" % (server, e))
root@raspberrypi1:/var/log/samba#


--> port 135 - NT_STATUS_CONNECTION_REFUSED

I'm not sure what's supposed to listen on port 135. The documentation says:
End Point Mapper (DCE/RPC Locator Service)

When I use the Windows MMC and have a look at some things:

Active Directory Sites and Services:
-Sites
--Sitename
---Servers
-> All 3 are listed here, the 2 windows machines and the new samba one.

However when I look the DNS snap in and go to my domain, open the entry for the domain name itself it has a tab called "name servers". Here only the 2 windows machines are listed.

So it looks like it's half way integrated. A demotion I once tried also failed right at the beginning:

Code:
root@raspberrypi1:/var/log/samba# samba-tool domain demote
Using server.my.domain.name as partner server for the demotion
Desactivating inbound replication
Asking partner server server.my.domain.name to synchronize from us
Error while demoting, re-enabling inbound replication
ERROR(<class 'samba.drs_utils.drsException'>): Error while sending a DsReplicaSync for partion CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name - drsException: DsReplicaSync failed (8452, 'WERR_DS_DRA_NO_REPLICA')
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 650, in run
    sendDsReplicaSync(drsuapiBind, drsuapi_handle, ntds_guid, str(part), drsuapi.DRSUAPI_DRS_WRIT_REP)
  File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 83, in sendDsReplicaSync
    raise drsException("DsReplicaSync failed %s" % estr)
root@raspberrypi1:/var/log/samba#
Looks to me like it hasn't replicated, yet.

DNS lookups are working in every direction.

Here are some outputs:

Code:
root@raspberrypi1:/var/log/samba# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:cd:e3:60 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.33/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::ba27:ebff:fecd:e360/64 scope link
       valid_lft forever preferred_lft forever
Code:
pi@raspberrypi1 ~ $ testparm -s
Load smb config files from /etc/samba/smb.conf
Processing section "[netlogon]"
Processing section "[sysvol]"
Loaded services file OK.
Server role: ROLE_ACTIVE_DIRECTORY_DC
[global]
        workgroup = MYDOMAINNAME
        realm = my.domain.name
        interfaces = eth0, lo
        server role = active directory domain controller
        passdb backend = samba_dsdb
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc, dnsupdate
        rpc_server:tcpip = no
        rpc_daemon:spoolssd = embedded
        rpc_server:spoolss = embedded
        rpc_server:winreg = embedded
        rpc_server:ntsvcs = embedded
        rpc_server:eventlog = embedded
        rpc_server:srvsvc = embedded
        rpc_server:svcctl = embedded
        rpc_server:default = external
        idmap config * : backend = tdb
        map archive = No
        map readonly = no
        store dos attributes = Yes
        vfs objects = dfs_samba4, acl_xattr

[netlogon]
        path = /var/lib/samba/sysvol/my.domain.name/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No
pi@raspberrypi1 ~ $
------------------------------------------------------------------------

Code:
root@raspberrypi1:/var/log/samba# cat /etc/resolv.conf
domain my.domain.name
nameserver 127.0.0.1
nameserver 192.168.0.2	<- dc1, hostname "server"
nameserver 192.168.0.21	<- dc2, hostname "dc2"
root@raspberrypi1:/var/log/samba#
------------------------------------------------------------------------

Code:
pi@raspberrypi1 ~ $ sudo netstat -llptun
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 192.168.0.33:53       0.0.0.0:*               LISTEN      1249/named
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1249/named
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      373/sshd
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1249/named
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      722/smbd
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      722/smbd
tcp6       0      0 :::53                   :::*                    LISTEN      1249/named
tcp6       0      0 :::22                   :::*                    LISTEN      373/sshd
tcp6       0      0 ::1:953                 :::*                    LISTEN      1249/named
tcp6       0      0 :::445                  :::*                    LISTEN      722/smbd
tcp6       0      0 :::36735                :::*                    LISTEN      535/java
tcp6       0      0 :::36736                :::*                    LISTEN      535/java
tcp6       0      0 :::139                  :::*                    LISTEN      722/smbd
udp        0      0 192.168.0.33:123      0.0.0.0:*                           446/ntpd
udp        0      0 127.0.0.1:123           0.0.0.0:*                           446/ntpd
udp        0      0 0.0.0.0:123             0.0.0.0:*                           446/ntpd
udp        0      0 192.168.0.33:53       0.0.0.0:*                           1249/named
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1249/named
udp6       0      0 fe80::ba27:ebff:fec:123 :::*                                446/ntpd
udp6       0      0 ::1:123                 :::*                                446/ntpd
udp6       0      0 :::123                  :::*                                446/ntpd
udp6       0      0 :::53                   :::*                                1249/named
pi@raspberrypi1 ~ $
------------------------------------------------------------------------

Code:
pi@raspberrypi1 ~ $ sudo systemctl status samba <tab-tab>
samba-ad-dc.service  samba.service
------------------------------------------------------------------------

Code:
root@raspberrypi1:/var/log/samba# systemctl status samba-ad-dc.service
 samba-ad-dc.service - LSB: start Samba daemons for the AD DC
   Loaded: loaded (/etc/init.d/samba-ad-dc)
   Active: active (running) since Tue 2015-07-07 12:17:57 CEST; 1h 23min ago
  Process: 22308 ExecStop=/etc/init.d/samba-ad-dc stop (code=exited, status=0/SUCCESS)
  Process: 22338 ExecStart=/etc/init.d/samba-ad-dc start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/samba-ad-dc.service
           720 /usr/sbin/samba -D
           722 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
           841 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground

Jul 07 12:17:57 raspberrypi1 samba-ad-dc[22338]: Starting Samba AD DC daemon: samba.
Jul 07 12:17:57 raspberrypi1 systemd[1]: Started LSB: start Samba daemons for the AD DC.
root@raspberrypi1:/var/log/samba#
This log used to be full of messages about not being able to contact cups. I hadn't installed it since I didn't intend to use it.
They disappeared after I installed the cups packages.

------------------------------------------------------------------------

Maybe this is normal, but there are 2 samba services installed, one is not running.

It's masked, I tried to unmask it, but it doesn't seem to work. Should this be like it is?

Code:
pi@raspberrypi1 ~ $ sudo systemctl status samba.service
 samba.service
   Loaded: masked (/dev/null)
   Active: inactive (dead)

pi@raspberrypi1 ~ $ sudo systemctl unmask samba.service
pi@raspberrypi1 ~ $ echo $?
0
pi@raspberrypi1 ~ $ sudo systemctl start samba.service
Failed to start samba.service: Unit samba.service is masked.
pi@raspberrypi1 ~ $
------------------------------------------------------------------------

Code:
root@raspberrypi1:/var/log/samba# systemctl status samba-ad-dc.service
 samba-ad-dc.service - LSB: start Samba daemons for the AD DC
   Loaded: loaded (/etc/init.d/samba-ad-dc)
   Active: active (running) since Tue 2015-07-07 12:17:57 CEST; 1h 23min ago
  Process: 22308 ExecStop=/etc/init.d/samba-ad-dc stop (code=exited, status=0/SUCCESS)
  Process: 22338 ExecStart=/etc/init.d/samba-ad-dc start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/samba-ad-dc.service
           720 /usr/sbin/samba -D
           722 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
           841 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground

Jul 07 12:17:57 raspberrypi1 samba-ad-dc[22338]: Starting Samba AD DC daemon: samba.
Jul 07 12:17:57 raspberrypi1 systemd[1]: Started LSB: start Samba daemons for the AD DC.
root@raspberrypi1:/var/log/samba# systemctl status bind9.service
 bind9.service - BIND Domain Name Server
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled)
  Drop-In: /run/systemd/generator/bind9.service.d
           50-insserv.conf-$named.conf
   Active: active (running) since Tue 2015-07-07 12:21:56 CEST; 1h 21min ago
     Docs: man:named(8)
  Process: 22666 ExecStop=/usr/sbin/rndc stop (code=exited, status=1/FAILURE)
 Main PID: 22695 (named)
   CGroup: /system.slice/bind9.service
           22695 /usr/sbin/named -f -u bind

Jul 07 12:22:10 raspberrypi1 named[22695]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
Jul 07 12:22:10 raspberrypi1 named[22695]: command channel listening on 127.0.0.1#953
Jul 07 12:22:10 raspberrypi1 named[22695]: command channel listening on ::1#953
Jul 07 12:22:10 raspberrypi1 named[22695]: managed-keys-zone: loaded serial 2
Jul 07 12:22:10 raspberrypi1 named[22695]: zone 0.in-addr.arpa/IN: loaded serial 1
Jul 07 12:22:11 raspberrypi1 named[22695]: zone localhost/IN: loaded serial 2
Jul 07 12:22:11 raspberrypi1 named[22695]: zone 127.in-addr.arpa/IN: loaded serial 1
Jul 07 12:22:11 raspberrypi1 named[22695]: zone 255.in-addr.arpa/IN: loaded serial 1
Jul 07 12:22:11 raspberrypi1 named[22695]: all zones loaded
Jul 07 12:22:11 raspberrypi1 named[22695]: running
root@raspberrypi1:/var/log/samba#
------------------------------------------------------------------------

I've digged through all the NT_STATUS_CONNECTION_REFUSED results on the internet, but it doesn't seem their resolutions apply to my case. Does anybody have an idea?

UPDATE:
I was able to solve this one by: systemctl start smbd.service
Maybe restart them again, but after that the port 135 was finally taken.

Now I'm at the next error and getting this:

Code:
root@raspberrypi1:/var/log/samba# samba-tool drs showrepl -d 7
INFO: Current debug levels:
  all: 7
  tdb: 7
  printdrivers: 7
  lanman: 7
  smb: 7
  rpc_parse: 7
  rpc_srv: 7
  rpc_cli: 7
  passdb: 7
  sam: 7
  auth: 7
  winbind: 7
  vfs: 7
  idmap: 7
  quota: 7
  acls: 7
  locking: 7
  msdfs: 7
  dmapi: 7
  registry: 7
  scavenger: 7
  dns: 7
  ldb: 7
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
Processing section "[global]"
Processing section "[netlogon]"
Processing section "[sysvol]"
pm_process() returned Yes
ldb_wrap open of secrets.ldb
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'schannel' registered
GENSEC backend 'spnego' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Using binding ncacn_ip_tcp:raspberrypi1.MY.DOMAIN.NAME[,seal,print]
Mapped to DCERPC endpoint 135
interpret_interface: using netmask value 8 from config file on interface lo
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
interpret_interface: using netmask value 8 from config file on interface lo
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
Mapped to DCERPC endpoint 1024
interpret_interface: using netmask value 8 from config file on interface lo
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
interpret_interface: using netmask value 8 from config file on interface lo
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.0.33 bcast=192.168.0.255 netmask=255.255.255.0
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gssapi_krb5
Server ldap/RASPBERRYPI1.MY.DOMAIN.NAME@MY.DOMAIN.NAME is not registered with our KDC:  Miscellaneous failure (see text): Matching credential (ldap/RASPBERRYPI1.MY.DOMAIN.NAME@MY.DOMAIN.NAME) not found
SPNEGO(gssapi_krb5) creating NEG_TOKEN_INIT failed: NT_STATUS_INVALID_PARAMETER
Starting GENSEC submechanism ntlmssp
ERROR(<class 'samba.drs_utils.drsException'>): DRS connection to raspberrypi1.MY.DOMAIN.NAME failed - drsException: DRS connection to raspberrypi1.MY.DOMAIN.NAME failed: (-1073741643, 'NT_STATUS_IO_TIMEOUT')
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/drs.py", line 39, in drsuapi_connect
    (ctx.drsuapi, ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_utils.drsuapi_connect(ctx.server, ctx.lp, ctx.creds)
  File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 54, in drsuapi_connect
    raise drsException("DRS connection to %s failed: %s" % (server, e))
root@raspberrypi1:/var/log/samba#
The log.smb fills with entries like this every couple of seconds:
Code:
[2015/07/09 13:49:43.683996,  0] ../auth/gensec/gensec.c:247(gensec_update)
  Did not manage to negotiate mandetory feature SIGN for dcerpc auth_level 6
[2015/07/09 13:49:43.693671,  0] ../source4/librpc/rpc/dcerpc_util.c:681(dcerpc_pipe_auth_recv)
  Failed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for e3514235-4b06-11d1-ab04-00c04fc2dcd2@ncacn_ip_tcp:c68974ba-6fca-4d51-be8b-7519e3e1ea0b._msdcs.my.domain.name[1029,seal,krb5] NT_STATUS_ACCESS_DENIED
Does anybody have an idea? In a way the error is kind of clear, but I have no idea how to fix that permission issue. I've looked on the Windows DNS MMC snapin: Under the _msdcs.my.domain.name domain there were 2 entries, both aliases with id's like the above, each referencing one domain controller. So I added another alias manually pointing from e3514235-4b06-11d1-ab04-00c04fc2dcd2._msdcs.my.domain.name to raspberrypi1. But that didn't help.

Last edited by michael234; 07-09-2015 at 08:03 AM.
 
Old 07-13-2015, 05:23 PM   #2
michael234
LQ Newbie
 
Registered: Jul 2015
Posts: 9

Original Poster
Rep: Reputation: Disabled
I'm not sure if I should now be pissed or happy.

I may have mentioned one of the symptoms of my problems was that I had a very high CPU load caused by a samba process. I had rebooted the whole machine at least once in its current configuration. So all settings must have been applied already.

Because of the CPU load I decided to upgrade that raspberry model 1 to a model 2 (which has more lots more ram and a faster CPU). The idea was only that this would compensate for the CPU problem (the new one has multiple cores, so I didn't expect 100% again). However after I simply moved the SD card from the old raspberry to the new model (absolutely NO settings changes) and booted the problem seems to have disappeared:

Code:
root@raspberrypi1:~# samba-tool drs replicate raspberrypi1.my.domain.name server.my.domain.name CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name
Replicate from server.my.domain.name to raspberrypi1.my.domain.name was successful.
root@raspberrypi1:~# samba-tool drs replicate raspberrypi1.my.domain.name dc2.my.domain.name CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name
Replicate from dc2.my.domain.name to raspberrypi1.my.domain.name was successful.
showrepl also confirms everything is ok now, maybe with the expection of "Warning: No NC replicated for Connection!", which appears I can safely ignore (https://wiki.samba.org/index.php/FAQ..._Connection.21).

Again thanks a lot for your help!

Should somebody else stumble upon this issue, upgrading the raspi to model 2 seems to work :-) - at least for me.
 
Old 07-14-2015, 08:40 AM   #3
michael234
LQ Newbie
 
Registered: Jul 2015
Posts: 9

Original Poster
Rep: Reputation: Disabled
If you're trying the same thing I did I have one thing to add:

This morning I equipped the integrated LDAP server with a signed certificate. After restarting the services/rebooting I had the same problem I had before migrating to a raspi2 - synchronization wasn't working anymore.

I logged on to one of the Windows DCs and opened the eventlog. There I found errors regarding the Samba DC. A quick googling brought me to the recommendation of running dcdiag /E (check all DCs in the domain). There I was told that the long id under msdsc couln't be resolved to an IP. It appears at some point this ID changed. After modifying the alias sync worked again.

So I recommend to everybody of to also take a look at the Windows DCs if you have any. In this case their tools and logs were even more helpfull.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to block port 135 marcossf Linux - Security 3 04-04-2007 11:41 AM
Samba domain member server (DMS) group permissions in network with a Samba PDC srosa Linux - Networking 0 05-01-2006 06:55 PM
unwanted network traffic on tcp port 135 debasish_5849 Linux - Security 4 04-20-2006 11:33 PM
Port Scan on 135 ghight Linux - Security 6 12-15-2003 01:40 PM
TCP packets port 135,137,138,139 Gilion Linux - Networking 1 10-27-2003 10:11 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 10:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration