Rob Campbell's questions

I have samba ad dc and on a different member I have a file server.

Domain Controller = Debian 11 (DC01)
Domain Member (File Server) = Fedora 34 (FS01)
Domain Member (Workstation) = Fedora 34 (F01)

Here are the mount points (F01)

/multimedia/Photos
/multimedia/Movies
/multimedia/Music
/multimedia/Videos

smb.conf (FS01)

# Global parameters
[global]
    dedicated keytab file = /etc/krb5.keytab
    kerberos method = secrets and keytab
    realm = HOME.TEST-SERVER.LAN
    security = ADS
    template homedir = /home/HOME/%U
    template shell = /bin/bash
    username map = /etc/samba/user.map
    winbind refresh tickets = Yes
    winbind use default domain = Yes
    workgroup = HOME
    idmap config * : range = 10000-24999999
    idmap config * : backend = autorid
    map acl inherit = Yes
    vfs objects = acl_xattr


[homes]
    browseable = No
    comment = Home Directories
    read only = No
    valid users = %S


[printers]
    browseable = No
    comment = All Printers
    path = /var/spool/samba
    printable = Yes


[Photos]
    comment = Photos
    inherit acls = Yes
    path = /multimedia/Photos
    read list = "@HOME\Domain Users"
    read only = No
    valid users = "@HOME\Media Admins" @HOME\Photographers
    write list = @HOME\Photographers


[Videos]
    comment = Videos
    inherit acls = Yes
    path = /multimedia/Videos
    read only = No
    valid users = "@HOME\Video Users"


[Movies]
    comment = Videos
    inherit acls = Yes
    path = /multimedia/Movies
    read only = No
    valid users = "@HOME\Domain Users"


[Music]
    comment = Videos
    inherit acls = Yes
    path = /multimedia/Music
    read only = No
    valid users = "@HOME\Domain Users"


[seagate]
    comment = Videos
    inherit acls = Yes
    path = /media/seagate
    read only = No
    valid users = "@HOME\Domain Users"


[Backup]
    comment = Backup
    inherit acls = Yes
    path = /media/Seagate_1
    read only = No
    valid users = "@HOME\Domain Users"

gio mount smb://fs01/photos (F01)

gio: smb://fs01/photos/: Failed to mount Windows share: Permission denied

tail /var/log/messages (F01)

Nov  9 15:29:33 FS01 smbd[799696]: [2021/11/09 15:29:33.316583,  0] ../../source3/smbd/service.c:167(chdir_current_service)
Nov  9 15:29:33 FS01 smbd[799696]:  chdir_current_service: vfs_ChDir(/multimedia/Photos) failed: Permission denied. Current token: uid=211104, gid=210513, 8 groups: 211104 210513 211112 211113 109999 109990 109982 10001

Above worked at one time but no longer working

sudo mount -vvv -t cifs //fs01/photos /multimedia/Photos/ -o credentials=/root/.smb (F01)

domain=FS01
mount.cifs kernel mount options: ip=10.0.0.10,unc=\\fs01\photos,user=redhat,domain=FS01,pass=********
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

dmesg (F01)

[ 7092.213424] CIFS: Attempting to mount \\fs01\photos
[ 7092.222559] CIFS: Status code returned 0xc000006d STATUS_LOGON_FAILURE
[ 7092.222564] CIFS: VFS: \\fs01 Send error in SessSetup = -13
[ 7092.222571] CIFS: VFS: cifs_mount failed w/return code = -13

How do I mount these so that access is controlled by Samba where I would just need to update the smb.conf with groups to control access?

I have a DC (Debian) that seems to be working fine. I am able to join the domain but when I join a Fedora member it joins but the DNS isn't registered. I have to manually add the record to the dc. The Debian members join just fine. I am also able to ssh and log in to the Debian members using the desktop gui. I am not able to do either with the Fedora member. Only local users can log in (ssh/gui).

/var/log/audit/audit.log

type=CRYPTO_SESSION msg=audit(1636214847.520:2087): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=start direction=from-server [email protected] ksize=512 mac=<implicit> pfs=curve25519-sha256 spid=32862 suid=74 rport=34444 laddr=10.0.0.17 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.0.0.16 terminal=? res=success'UID="root" AUID="unset" SUID="sshd"
type=CRYPTO_SESSION msg=audit(1636214847.522:2088): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=start direction=from-client [email protected] ksize=512 mac=<implicit> pfs=curve25519-sha256 spid=32862 suid=74 rport=34444 laddr=10.0.0.17 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.0.0.16 terminal=? res=success'UID="root" AUID="unset" SUID="sshd"
type=USER_AUTH msg=audit(1636214851.295:2089): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:authentication grantors=? acct="test" exe="/usr/sbin/sshd" hostname=10.0.0.16 addr=10.0.0.16 terminal=ssh res=failed'UID="root" AUID="unset"
type=CRYPTO_KEY_USER msg=audit(1636214857.117:2090): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=destroy kind=session fp=? direction=both spid=32862 suid=74 rport=34444 laddr=10.0.0.17 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.0.0.16 terminal=? res=success'UID="root" AUID="unset" SUID="sshd"
type=CRYPTO_KEY_USER msg=audit(1636214857.117:2091): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=destroy kind=server fp=SHA256:3f:a3:9d:94:52:57:d5:43:b1:ed:67:07:77:62:db:05:80:10:1b:b0:57:ab:77:56:88:b8:2a:f2:ef:3e:d3:73 direction=? spid=32862 suid=74  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" SUID="sshd"
type=CRYPTO_KEY_USER msg=audit(1636214857.122:2092): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=destroy kind=server fp=SHA256:3f:a3:9d:94:52:57:d5:43:b1:ed:67:07:77:62:db:05:80:10:1b:b0:57:ab:77:56:88:b8:2a:f2:ef:3e:d3:73 direction=? spid=32861 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" SUID="root"
type=USER_LOGIN msg=audit(1636214857.122:2093): pid=32861 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=10.0.0.16 terminal=ssh res=failed'UID="root" AUID="unset"

/etc/ssh/sshd_config

Include /etc/ssh/sshd_config.d/*.conf AcceptEnv LANG LC_*
Subsystem   sftp    /usr/lib/openssh/sftp-server
ChallengeResponseAuthentication no 
UsePAM yes 
X11Forwarding yes
PrintMotd no 
PasswordAuthentication yes 
AllowGroups "domain users"

/etc/pam.d/sshd

#%PAM-1.0
auth       substack     password-auth
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    optional     pam_krb5.so minimum_uid=1000
session    optional     pam_winbind.so
session    optional     pam_sss.so
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin

I am trying to use my Fedora 34 workstation as a domain member but I'm having problems. First problem is that when I join the domain, I get an dns error.

net ads join -U Administrator

Enter Administrator's password:
Using short domain name -- HOME
Joined 'FSDM01' to dns domain 'home.test-server.lan'
DNS Update for fsdm01.home.test-server.lan failed: ERROR_DNS_UPDATE_FAILED
DNS update failed: NT_STATUS_UNSUCCESSFUL

I have created similar domain members in Debian and both of them work just fine. The DC is also Debian.

DC01 (10.0.0.19) = Debian Domain Controller
DM01 (10.0.0.14) = Debian Domain Member
DM02 (10.0.0.16) = Debian Domain Member
FSDM01 (10.0.0.17) = Fedora Domain Member
realm = home.test-server.lan

I can ping hostname from and between all Debian hosts. I can ping all Debian hostnames from Fedora. I cannot ping Fedora hostname from any of the Debian hosts.

I followed these instructions: https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller

These instructions didn't work exactly as they read. There was one step I didn't get a result because samba was stopped and it needed to be running (for dns) to get the result in the guide but other than that, everything happens as this guide says but when I try to join the domain from a vm I created. I have just one dc at this time. I've created a Fedora Server 35 vm to add as another dc after I get it working solo bc that's how I really want to use it.

$ realm join test-server.lan -U Administrator

Password for Administrator:
See: journalctl REALMD_OPERATION=r1171585.2732805
realm: Couldn't join realm: Failed to join the domain**

$ journalctl REALMD_OPERATION=r1171585.2732805

-- Journal begins at Fri 2021-10-01 15:39:25 EDT, ends at Mon 2021-10-04 22:26:45 EDT. --
Oct 04 22:24:21 fedora realmd[2732808]:  * Resolving: _ldap._tcp.test-server.lan
Oct 04 22:24:21 fedora realmd[2732808]:  * Performing LDAP DSE lookup on: 10.0.0.10
Oct 04 22:24:21 fedora realmd[2732808]:  * Successfully discovered: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli
Oct 04 22:24:30 fedora realmd[2732808]:  * LANG=C /usr/sbin/adcli join --verbose --domain test-server.lan --domain-realm TEST-SERVER.LAN --domain-controller 10.0.0.10 --login-type user --login-user Administrator --stdin-password
Oct 04 22:24:30 fedora realmd[2732808]:  * Using domain name: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Calculated computer account name from fqdn: FEDORA
Oct 04 22:24:30 fedora realmd[2732808]:  * Using domain realm: test-server.lan
Oct 04 22:24:30 fedora realmd[2732808]:  * Sending NetLogon ping to domain controller: 10.0.0.10
Oct 04 22:24:46 fedora realmd[2732808]:  * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-OMYnX1/krb5.d/adcli-krb5-conf-lTV3xU
Oct 04 22:24:46 fedora realmd[2732808]:  ! Couldn't authenticate as: [email protected]: Client '[email protected]' not found in Kerberos database
Oct 04 22:24:46 fedora realmd[2732808]: adcli: couldn't connect to test-server.lan domain: Couldn't authenticate as: [email protected]: Client '[email protected]' not found in Kerberos database
Oct 04 22:24:46 fedora realmd[2732808]:  ! Failed to join the domain

/etc/samba/smb.conf:

# Global parameters
[global]
dns forwarder = 10.0.0.1
netbios name = FS34
realm = TEST-SERVER.LAN
server role = active directory domain controller
workgroup = TEST-SERVER
idmap_ldb:use rfc2307 = yes

[sysvol]
path = /var/lib/samba/sysvol
read only = No

[netlogon]
path = /var/lib/samba/sysvol/test-server.lan/scripts
read only = No

[homes]
comment = Home Directories
browseable = no
writable = yes
valid users = %S
; valid users = MYDOMAIN\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons:
; [netlogon]
; comment = Network Logon Service
; path = /var/lib/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no

# Un-comment the following to provide a specific roaming profile share.
# The default is to use the user's home directory:
; [Profiles]
; path = /var/lib/samba/profiles
; browseable = no
; guest ok = yes

# A publicly accessible directory that is read only, except for users in the
# "staff" group (which have write permissions):
; [public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; writable = no
; printable = no
; write list = +staff

[Photos]
comment = Photos
path = /multimedia/Photos

browseable = Yes
read only = No
inherit acls = Yes

[Videos]
comment = Videos
path = /multimedia/Videos

browseable = Yes
read only = No
inherit acls = Yes

[Movies]
comment = Videos
path = /multimedia/Movies

browseable = Yes
read only = No
inherit acls = Yes

[Music]
comment = Videos
path = /multimedia/Music

browseable = Yes
read only = No
inherit acls = Yes

[seagate]
comment = Videos
path = /media/seagate

browseable = Yes
read only = No
inherit acls = Yes

/etc/krb5.conf:

[libdefaults]
default_realm = TEST-SERVER.LAN
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h

[realms]
TEST-SERVER.LAN = {
default_domain = test-server.lan
kdc = test-server.lan
}

[domain_realm]
fs34 = TEST-SERVER.LAN
dc01 = TEST-SERVER.LAN
.test-server = TEST-SERVER.LAN
.test-server.lan = TEST-SERVER.LAN
dc01.test-server.lan = TEST-SERVER.LAN

I am able to access the shares and I have mounted them (as a user I've added).

//test-server.lan/Photos  2.7T  1.8T  926G  66% /home/user/mnt/Photos
//test-server.lan/Videos  2.8T  1.9T  926G  68% /home/user/mnt/Videos
//test-server.lan/Movies  2.8T  1.9T  926G  68% /home/user/mnt/Movies

# smbclient -L test-server.lan -U user

Enter TEST-SERVER\user's password:

Sharename       Type      Comment
---------       ----      -------
sysvol          Disk      
netlogon        Disk      
Photos          Disk      Photos
Videos          Disk      Videos
Movies          Disk      Videos
Music           Disk      Videos
seagate         Disk      Videos
IPC$            IPC       IPC Service (Samba 4.14.7)
SMB1 disabled -- no workgroup available

I am able to run dnsmasq with no issues but only when I don't have samba (ad dc) running. With dnsmasq running I am able to resolve both internal and external hostnames within my network. However, when I am running dnsmasq, samba service will not start. Likewise, if I stop dnsmasq service and start samba ad dc service, I am able to access the dc and the shares. Both are trying to use port 53 and apparently they both need to listen on that port bc other hosts communicate with them on that specific port. How do I solve this issue? I've created a new interface as suggested on a site I found but that hasn't resolved the issue.

lo:0: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.2  netmask 255.0.0.0
        loop  txqueuelen 1000  (Local Loopback)