I’ve had my domain named a .local for years and nothing has ever come of it until now- In fact, I believe Microsoft actually recommends using a .local domain for an internal network unless you have a specific use for a top level domain (my college had a .edu for the AD server).
I’m not sure what you mean by my local root- that is how I am taking care of all of this, but when I add a computer to the domain or take it off, it requires a network administrator account from the server. That is the only time that the logon works. I’m wondering if something is messed up with the logon client.
On 2013-12-16 02:16, vader95 wrote:
>
> I’ve had my domain named a .local for years and nothing has ever come of
> it until now- In fact, I believe Microsoft actually recommends using a
> .local domain for an internal network unless you have a specific use for
> a top level domain (my college had a .edu for the AD server).
What would Microsoft care if it doesn’t work with Linux or if it is
difficult? >;-)
> I’m not sure what you mean by my local root- that is how I am taking
> care of all of this, but when I add a computer to the domain or take it
> off, it requires a network administrator account from the server. That
> is the only time that the logon works. I’m wondering if something is
> messed up with the logon client.
Oh, ok, understood.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
On 2013-12-16 02:16, vader95 wrote:
>
> I’ve had my domain named a .local for years and nothing has ever come of
> it until now- In fact, I believe Microsoft actually recommends using a
> .local domain for an internal network unless you have a specific use for
> a top level domain (my college had a .edu for the AD server).
From an old post of mine:
I don’t know if the fault is with Microsoft or with the autoconf
service. Both want to use .local, I guess.
The documentation bug I pointed you to lists another bug with Ubuntu
with perhaps some background information.
It says:
+++·······················
I confirm it doesn’t work out of the box if the domain you try to join
is named “something.local”. This is the result of a war between
Microsoft and Apple over the .local domain, with Ubuntu siding with Apple:
Ubuntu (like Apple) uses Zeroconf for simple service discovery on LAN,
and this makes use of the .local domain. On the other hand, Microsoft AD
won’t work correctly if its domain name is not served by its own DNS.
Using .local for a domain name is therefore a recipe for trouble [1].
If for some reason you have to join an AD domain called
“something.local”, then you want to disable Zeroconf because the two
won’t work together. You want the .local DNS domain to be served
primarily by the Microsoft DNS and not by Zeroconf. So you edit the
/etc/nsswitch.conf file accordingly.
On Sun, 15 Dec 2013 23:46:01 +0000, vader95 wrote:
> hendersj Wrote:
>>
>> That is strange…though a BDC isn’t something that you use in a pure
>> AD environment (as I recall, Microsoft even discontinued support for
>> NT4 domains in AD on server 2012 - ISTR that you can’t set the domain
>> functional level to W2K any more, but I might be wrong on that).
>>
>> You might try switching it over entirely to Kerberos authentication and
>> see if that helps.
>>
>>
> It’s not an official “Backup Domain Controller” it is considered a
> global catalog (sorry, that is just its purpose as a backup server). As
> far as I know, the lowest functional level you can have in a 2012 R2
> domain is 2008. I don’t even think a 2003 functional level is supported
> any more.
Ah, I see. And yeah, I think you’re right that even 2003 functional
level is no longer supported. I spent a little time looking at it a
couple months back for a prospective job, but it fell through and I
stopped my research. I still have the VM, though, so maybe if things are
slow over the holidays, I’ll have a chance to look at it and see.
I tried to edit it, but it still isn’t working… I may not have edited it correctly, though. This is what I have now:
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#
# passwd: files nis
# shadow: files nis
# group: files nis
passwd: winbind files
group: winbind files
hosts: files dns
networks: dns files
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files nis
publickey: files
bootparams: files
automount: files nis
aliases: files
Is there some other setting I have to change that you know of?
Yeah, I stopped it first, using both YaST originally (and then thinking there was something else running from it with the commands). I noticed that was Ubuntu- I’ve used it before (And actually it runs my one linux PXE server). I’m still not wondering if there is a bug in the KDE Login (kdm, if I’m not mistaking… but I might be), for it to not allow for logins across the network. Like I said, no packets were coming out of the system when I tried to login before.
On 2013-12-17 15:06, vader95 wrote:
>
> robin_listas;2609193 Wrote:
>>
>>
>> Did you stop avahi? That report I posted was not from openSUSE, not
>> everything applies.
>>
>
> Yeah, I stopped it first, using both YaST originally (and then thinking
> there was something else running from it with the commands). I noticed
> that was Ubuntu- I’ve used it before (And actually it runs my one linux
> PXE server). I’m still not wondering if there is a bug in the KDE Login
> (kdm, if I’m not mistaking… but I might be), for it to not allow for
> logins across the network. Like I said, no packets were coming out of
> the system when I tried to login before.
You can try switching to GDM and find out…
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
I didn’t realize it was as easy to switch as it was… It has been a while since I used openSUSE. It still isn’t working, but I do have a bit more information now. In the console log, I am getting the following messages.
winbindd[2503]create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/smb_tmp_krb5.nv851Y. Errno Permission denied
winbindd[2592]: cm_prepare_connection: Mutex grab failed for server-2012.hcr.local
Do you know what this means? I’m guessing it can’t access the server for some reason.
On 2013-12-17 16:16, vader95 wrote:
>
> I didn’t realize it was as easy to switch as it was… It has been a
> while since I used openSUSE. It still isn’t working, but I do have a
> bit more information now. In the console log, I am getting the
> following messages.
In the client?
> Code:
> --------------------
>
> winbindd[2503]create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/smb_tmp_krb5.nv851Y. Errno Permission denied
>
> winbindd[2592]: cm_prepare_connection: Mutex grab failed for server-2012.hcr.local
>
> --------------------
>
> Do you know what this means? I’m guessing it can’t access the server
> for some reason.
No, but just a wild guess: try stopping apparmor. The samba profile
might be blocking that permission to read.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
Yeah, that is on the client side (the console log that comes up with gdm).
That did it, though! App armor must be causing some interference.
Now it is time for the configuration to take place so everything is up and running by the new year. (I am trying to transition the Windows XP side of the network by the end of the year, that way I don’t have to rush to do it by EOL).
On 2013-12-17 18:26, vader95 wrote:
>
> Yeah, that is on the client side (the console log that comes up with
> gdm).
>
> That did it, though! App armor must be causing some interference.
Ok, then please report this issue against apparmour in Bugzilla. They
requested this type of errors, as told in the openSUSE 13.1 release
notes, paragraph 5.11.
+++······························
5.11. AppArmor and Permission Settings
AppArmor is enabled by default. This means more security, but might
prevent services from working, if you run them in unexpected ways. If
you encounter strange permission problems, try to switch the AppArmor
profile for the affected service to complain mode with:
aa-complain /usr/bin/$your_service
Complain mode means: allow everything, and log things that the profile
would not allow.
Even if it helps report it as a bug! We want to fix AppArmor profiles to
cover also corner cases.
······························+±
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
I would, but it is not letting me log into bugzilla. It requested me to verify my email, but somehow sent it to the wrong address. When I tried to change my email (here on the forums) it says that the password I entered to change it does not match my password… which it does… I’m not sure what the problem is with that, but I’ll try again in a few days and see if it has been fixed.
On 2013-12-17 20:06, vader95 wrote:
>
> I would, but it is not letting me log into bugzilla. It requested me to
> verify my email, but somehow sent it to the wrong address. When I tried
> to change my email (here on the forums) it says that the password I
> entered to change it does not match my password… which it does…
> I’m not sure what the problem is with that, but I’ll try again in a few
> days and see if it has been fixed.
It is the same login/pass as the forum. If you are logged in here, you
should be automatically logged in bugzilla (actually, any openSUSE web
service) automatically.
If you have email change/verification problems, there is a recent thread
in the forum support area where they say how to do it.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
And yeah, I think you’re right that even 2003 functional