Topic: XP client cant access 2nd sme shares after valid domain login to first sme (DC)

[joshAU]

Hi, I'm confused again...

Problem:
i cannot get xp client to access shares on my second sme server after I successfully logon to the domain.

Current setup:
1x sme server 7.0 in server-gateway mode doing dhcp, dns, domain controller,etc.
domain is ABC, and ABC is listed as workgroup in the workgroup panel.
ip 10.0.0.1
1x sme server 8 BETA in server only mode as a file server.
10.0.0.2
ABC is also listed as the workgroup in the workgroup panel on this server, although domain controller is obviously turned off on the second server.
all clients are set to autodhcp

Detail:
All XP and 2000 clients can login to the domain and see printers/shares on 10.0.0.1
all 2000 pcs can see, acccess and map network shares.
All 2000 clients can also see, access and map network shares on 10.0.0.2.
The XP clients cannot access shares on 10.0.0.2, except their username ibay share.
The XP clients can see the shares in network neighbourhood, but when i try to connect,
it does not accept any valid password.
The only share that the XP client can connect to is the one linked to the user name. eg admin folder when logged in as admin, username folder for username, etc.

If i logon to the XP client using a local account, after changing pc name, when i try to connect to a share, i get prompted for a user and password, and then i am successfully connected, can see, create, execute files.
But if I try to logon using a domain account, I log in to the domain successfully, can see shares but cannot access them. The password keeps getting rejected. i have tried to enter admin as user,  abc\admin, abc\username.. It seems the second sme server does not accept the domain user/password, or any user/password for that matter, if the XP pc has already logged onto the domain.

The admin and root accounts on both sme servers have the same password. All user accounts have identical settings & passwords on both servers.

The workgroup is listed as ABC in the workgroup panel on the domain controller

Things I have already tried:

Search these forums.   -yes, for the last two days...
Disable XP firewall
modify XP registry as suggested in the forums, even though i can connect to the domain.
Change XP client pc name
created new local and domain user accounts
set the ibay group to everyone, web

I see some references to samba in the forums, but these seem to deal with domain logon issues. This is not really the issue, as the XP client can log into the domain ABC, can access network shares, printers, etc.

Am I getting confused with domain authentication?
Is there a way to get the second sme to accept the domain accounts for login?

I would have thought that the second (fileserver -  10.0.0.2), being a member of the same domain, would accept a domain password, even if its not the domain controller. I may be wrong again though!. But it does not even accept admin login. It rejects it, appends the computername to the username, and then rejects it again. But if i dont log in to the domain, but only a local logon, I correctly get prompted for the user/pass and it accepts the admin password.

The easy answer is to stick with 2000, but its not an option.

Any help greatly appreciated. I have been trying to figure this out for a week now.

[girkers]

I can't say that I have explicit experience with this, but from my understanding this may be the problem. When setting the domain on SME2 the domain keys will be generated that will be different to what is configured on SME1. Samba has a page on adding member servers http://us1.samba.org/samba/docs/man/Samba-Guide/unixclients.html which is really what you want with SME2.

From having a quick read of this page I am not sure if it can be implemented with SME as it requires LDAP for some parts, I do beleive recently SME had an update that included OpenLDAP.

I hope this steers you in the right direction.

[raem]

joshAU

As a means of eliminating/identifying the source of the problem, could you try temporarily making the second server a sme7.3 ie same as the main server.

If it's a bug/issue with sme8 then you would expect a second sme7 server to be accessible

[joshAU]

Thanks for your input.

girkers:
Thanks, I suspect I have not correctly configured my systems.
You link is very informative, if a bit over my head....

RayMitchell:
G'day again Ray. I suspect it's going to be a bug with me, than a bug with sme8. Either way, I may have go down that path anyway.

I think my problem is that i havent joined the second sme to the first's domain.
I came across the following link that deals with using a sme server with domain authentication using a windows domain controller.

http://forums.contribs.org/index.php?topic=24087.msg96198#msg96198

I thought that if I modified the instructions there I could get the second sme to log into and validate against the domain. From there I believe it should then accept domain passwords.
The link in girkers' post above is probably the best way to go, but appeared very complicated

The gist of the above link's instructions were to:

------------------------------------------------------------------
2   Log in as root.

3   Copy /etc/samba/smb.conf to /etc/e-smith/templates-custom/etc

4   Add/Change following lines to smb.conf in templates directory.

   netbios name = {SME computer name}
   security = domain
   workgroup = {your domain}
   encrypt passwords = yes
   password server = {your PDC}

5   stop samba (/etc/rc.d/init.d/smb stop)

6   Join your domain.  Use following command
   smbpasswd -j {your domain} -r {your PDC (use name instead of IP address)}

7   Apply template.  (/sbin/e-smith/expand-template /etc/smb.conf)

8   Restart Samba
-------------------------------------------------------------------------

Is this a correct way to do it?

I realise that some of the items added/changed in smb.conf template is specific for a win dc.
should I change any of this? eg encrypt passwords = yes

Last night I tried this proceedure.
However, when I tried to join the domain using
smbpasswd -j domainname -r DCname, I get the following message:

"see 'net join' for this functionality"

Personally I would have liked to use smbpasswd for this functionality:)

after reading up on net join, i tried
"net join -S dcname -w domainname -U admin"
and put in my password as requested, and it returns:

"utils/net_rpc_join.c:net_rpc_join_newstyle(350)
Error in domain join verification (credential setup failed) : NT_STATUS_ACCESS_DENIED
unable to join domain domainname"


So, despite the errors, I of course continued, expanded the template and attempted to restart samba.

/etc/re.d/init.d/smb restart

and smb does not appear to start...
i get

shutting down SMB services OK
shutting down NMB services OK
starting SMB services
starting NMB services          OK

if I do a "service samba status"
"samba is not a valid service name

if I do a "service smb status"
run: /service/nmbd: (pid 8736) 184s, normally down; run: log: (pid 2718) 60345s
run: /service/smbd: (pid 8722) 184s, normally down; run: log: (pid 2722) 60345s

Is samba running? ,sorry for my lack of unix, but when I saw starting smb services without an OK, i was concerned. I'm guessing the smb service is samba, and it is running.

I guess I can reset samba by removing the smb.conf from the templates-custom directory and rebooting.

Any ideas what needs to be modified in smb.conf so I can join the domain.

It appears to correctly authenticate to the dc when I type "net join", by itself.
It prompts for a password, and if I put in the wrong one it says 'could not connect to server dcname'
'The username or password was incorrect', if I put in the right one it gives "Error in domain join verification (credential setup failed)", so it appears to verify the password correctly.

Sorry to come back with more questions.

Any help appreciated.

[raem]

joshAU

sme8 is still beta software, and may have many bugs
The only place to troubleshoot sme8 issues is in the bugtracker

If you take sme8 out of the puzzle by temporarily replacing it with a similarly configured sme7 server, then you will instantly know whether it's a sme8 bug (that you cannot necessarily do anything about at present) or whether it is a bug with your setup or WinXP etc.

I connect sme7.x boxes in server only mode to an existing network with sme7.3 in server gateway mode and W2K and WinXP boxes can access the shares OK.

[joshAU]

Hi again RayMitchell.
Sorry for the delayed reply.
Yes, I did't want too, but thats what I'm going to do.
Probably shouldn't have used the BETA anyway...for this server.

Only issue is I have to move 30gb of data, remove the second drive, setup the scsi drivers again.... as I don't have spare scsi drives to play with, and I'll stick to 7.3 once its on there.

I post results with 7.3 asap

joshAU

[joshAU]

Hi RayMitchell, not quite ASAP as I hoped... 30+ days.....
Yes I suspect somethings different in sme 8 beta, as you suspected.

Sorry for the delayed reply, I had a couple of disasters strike.....

First - power supply in domain controller started playing up - tripping the earth leakage circuit breaker. Only problem is  - HP Visualise system with proprietory HP power supply with some damn strange motherboard connectors - multiple 3.3 volt rails, etc... unlike any other ATX PSU ive seen.

No problems - as I had and identical system I use as my workstation, ripped out the psu, installed it and was up and running.... until the next morning and all the powers off again in the building..... oh oh, looks like the board, disconnected everything, swapped out voltage regulators, RAM, CPUs, to no avail.

OK, so I scrapped my Xclass visualise workstation and put the server drives in that.

Get the system booting, and everythings rosy for a day or so...
Then - no internet.....wtf,  checked the server - its frozen.
rebooted and errors about hard disk. will not boot.

Plenty of practice with data recovery under win, none under unix, but could tell it looked bad, sorry I can't remember the details of the errors, basically your hard disk is stuffed, from my interpretation.

So, I ripped out the drive and installed into my datarecovery pc, used Rlinux (free + highly recommended) to mount drives under windows and recovered all my files.

Replaced drive, installed sme 7.3 and things are up and running again.

OK, so now to turn to my fileserver that I had sme 8.0 BETA on...and OMG... hard disks corrupt too.
I guess I copped a spike during the last power outtage.... . Went through the data rec process with that to , after trying e2fsck and other tools, as I had a bit more time. Eventually got most of the data I needed back.

So thats the reason for the delay.....

NOW, back to the original question.......................................

I now have two sme 7.3 servers with absolutely no modifications other than via the web interface (oh, and setting the password strength to none).

On the XP box, which is a relatively fresh install, which I had disabled the firewall, applied the regpatch, when it tried to connect to the domain controller it errored : "Domain controller for the domain ... could not be found...

The only way i could get it working was to add the server as a wins server on the xp machine and adding the DC to the hosts file.

Now, I can log into the domain controller, and have mapped network drives onto the sme fileserver.
However, after every reboot, I have to reenter the admin password to see the contents of the mapped drives.

Short of using a batch file to map the drives with passwords, which would be a big security issue, I'm at a loss..

Any ideas???

As a test, i have just now tried to join another XP box (that was previously only ever in a workgroup) to the domain. It successfully joins the domain, but after the reboot, when I first tried to log in, and try to select the domain from the list, and a box appears stating "Please wait while the domain list is created" for a few seconds, once i select the domain, the same box appears, and is still there five minutes on, stopping me from even being able to enter a password, or changing it back to local login only...., until finally it disappears and I can then log in normally after each reboot.
This behavior is the same as exhibited by the first xp box on the first join to the domain. I never noticed this message on sme 7.0 when i first joined the domain there.

Now, after testing, both xp machines will log into the domain, and can see the mapped network drives on the second sme (fileserver). But each boot I have to re-enter the admin password to access the files within the share.

I would have expected that the fileserver would accept the dc authentication, and allow users that are in the same domain access. Do I have to duplicate all the users from the dc to the fileserver?...seems to make a dc controller a bit redundant if that is the case, or do I have to configure samba on the fileserver to accept domain accounts?  If so, what should I change in smb.conf to get it working? Do i have to set "password server =" as the dc in the smb.conf? Or is there more I have to do.

Apologies for the delay, and for the longwinded-ness of this.
Thanks for your time.
Josh

[raem]

joshAU

Do I have to duplicate all the users from the dc to the fileserver?

Yes, as far as I know.

I'm not aware of any mechanism that currently exists to automatically duplicate user accounts across multiple sme servers.
There is some work going on in the bugtracker re LDAP authentication that may lead to that functionality.

[kompupro]

Hi all,

I've just been going throught the hell of adding a Windows 2003 server to a just upgraded 6.0 to 7.3 server. After reading one of the posts above I tried to add the PDC (SME server) in the Wins settings of the Win2003 server, and what do you know that did the Trick!!!! HAPPY HAPPY HAPPY.

Now I can spend the rest of the weekend getting the windows 2003 server read for the customer to use as a 2X server.

Kurt

[joshAU]

OK, worked out how to do it with the help of gzartman.

I can now do a single login to the SME DC and then access my shares on the SME fileserver.

I reposted on this topic here:

http://forums.contribs.org/index.php?topic=41751.0

Check out gzartman's links on page 2 for information on it.

Thanks to all for your input.

joshAU