UCS 4.3 Samba 4.7 - Probleme beim Authentizieren (war: Änderungen bei NTLM?)

Ich kann das erst ab Freitag Nachmittag genauer analysieren,

was mit bereits aufgefallen ist, das Problem tritt bei mir nur auf Systemen auf welche ursprünglich ein AD Takeover von einer MS SBS AD hatten, in Univention neu installierte/angelegte AD Domains haben bei mir nach dem Upgrade auf 4.3 kein derartiges Problem.

Und ja meine Systeme sind auch seit 4.0 - 4.1 - 4.2 - 4.3 upgedatet worden.

LG
Christian

Can this help

[2018/03/29 17:05:08.524442,  2, pid=16424] ../source4/lib/socket/interface.c:195(interpret_interface)
  interpret_interface: Can't find address for eth0_1
[2018/03/29 17:05:12.669347,  0, pid=16663] ../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
  NTLMSSP NTLM2 packet check failed due to invalid signature!
[2018/03/29 17:05:12.669502,  2, pid=16663] ../source4/smbd/process_standard.c:473(standard_terminate)
  standard_terminate: reason[ldapsrv_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_IO_DEVICE_ERROR]
[2018/03/29 17:05:12.674506,  2, pid=16421] ../source4/smbd/process_standard.c:157(standard_child_pipe_handler)
  Child 16663 () exited with status 0
[2018/03/29 17:05:12.695031,  0, pid=16664] ../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
  NTLMSSP NTLM2 packet check failed due to invalid signature!
[2018/03/29 17:05:12.695221,  2, pid=16664] ../source4/smbd/process_standard.c:473(standard_terminate)
  standard_terminate: reason[ldapsrv_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_IO_DEVICE_ERROR]
[2018/03/29 17:05:12.700494,  2, pid=16421] ../source4/smbd/process_standard.c:157(standard_child_pipe_handler)
  Child 16664 () exited with status 0
[2018/03/29 17:05:13.480749,  2, pid=16424] ../source4/lib/socket/interface.c:195(interpret_interface)
  interpret_interface: Can't find address for eth0_0
[2018/03/29 17:05:13.480880,  2, pid=16424] ../source4/lib/socket/interface.c:195(interpret_interface)
  interpret_interface: Can't find address for eth0_1

Debug level 2

ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.120.2  netmask 255.255.255.0  broadcast 192.168.120.255
        inet6 fe80::d7:71ff:fed1:fbf0  prefixlen 64  scopeid 0x20<link>
        ether 02:d7:71:d1:fb:f0  txqueuelen 1000  (Ethernet)
        RX packets 6629168  bytes 2251508838 (2.0 GiB)
        RX errors 0  dropped 2351  overruns 0  frame 0
        TX packets 7032341  bytes 3007224669 (2.8 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.120.20  netmask 255.255.255.0  broadcast 192.168.120.255
        ether 02:d7:71:d1:fb:f0  txqueuelen 1000  (Ethernet)

Zumindest das Remotedesktop Problem konnte ich einkreisen.
Es ist ein DNS Problem auf dem AD.
Die Anmeldung dauert ja bis zu einer Minute. Wenn ich auf dem Client als DNS nicht das AD eintrage sondern unseren DNS eintrage dann steht die Verbindung innerhalb einer Sekunde.
Ich schaue mir das nach den Feiertagen genauer an.

Peter

Allerdings ist das keine Lösung da er damit das AD nicht mehr findet.

Peter

@pixelpeter Dann würde ich stattdessen testweise mal das DNS-Backend auf OpenLDAP umstellen:

ucr set dns/backend='ldap'
systemctl restart bind9.service

@SirTux,

Backend gewechselt von samba4 -> ldap.
Bringt leider nichts. Problem ist genau so da.

Gibt es irgend ein Tool wo man von Windows aus den DNS testen kann?
Bin leider kein DNS Spezi.

Peter

nslookup kenne ich natürlich, bringt mich aber nicht weiter.
Rechnernamen lösen zumindest hier sauber auf.
Es gibt aber sicher noch Einträge wo der AD Controller hinterlegt ist etc.

Ich habe zum testen jetzt einen UCS Server neu installiert und gabe einen Server 2012 beitreten lassen. Das sieht auf den ersten Blick alles gut aus aber auch hier dauert die Verbindung mit RDP fast eine Minute. Zumindest dieses eine Problem tritt schon bei einer Core Installation auf
Ich habe verschiedene Loglevel erhöht ohne jedoch irgend welche Auffälligkeiten zu finden.

Peter

Ein wenig zu still. Ich habe das gleiche Problem. Bei mir hat die gesamte Warenwirtschaft mit SQL Server gestanden.
Ich warte dringend auf einen Lösungsansatz :sweat:

Huhu,

wenn es um kritische Systeme geht und wirklich dringend eine Lösung benötigt wird, dann kann ich echt nur empfehlen, den kostenpflichtigen Univention-Support in Anspruch zu nehmen. Hier im Forum gibt’s halt nur freiwilligen Support auf Best-Effort-Basis, und gerade bei so vertrakten Problemen wie diesen hier gibt’s keinerlei Garantie für eine Lösung, geschweige denn eine schnelle Lösung.

Nachdem ich das gesagt habe: können die Betroffenen bitte mal…

  1. …die Ausgabe von folgendem Befel vom DC Master posten: samba-tool fsmo show
  2. …auf einem betroffenen Windows-Client das NetLogon-Debugging einschalten, den Client rebooten, anmelden und anschließend die erzeugte %windir%\debug\netlogon.log vom Client hier posten?

Achtung: ich weiß nicht, wie viele sensitive Informationen in der netlogon.log drinstehen. Sinnvollerweise also erst mal reinschauen und evtl. anonymisieren, bevor sie hier öffentlich gepostet wird.

Gruß
mosu

I don’t know if help, but view event viewer of my TErminal Server i’m getting logon error 4625 in windows secutiry auditing

the security id: shoulb by something like domain\user and appear as NULL SID

Just to explain a little bit my context

1 UCS server (4.3)
1 MSSQL server (win 2016)
1 TS Server (win 2008)

The TS is used to using some shared folders from MSSQL Server and is running an intranet site.

The problems are:
From TS the users cannot access shared folders via ipaddres (only fqdn)
From others computers, the users cannot open protected intranet site (cannot login), for instance from MSSQL Server cannot open intranet that runs in TS Server
GPO aren’t by applied in the TS Server

Hier ein paar Daten für die Experten. Es handelt sich hier um das Windows 7 - System, das seit neuestem deutlich länger “Negotiating Credentials …” anzeigt, wenn ich mich remote vom Mac aus einwähle. Der Master DC heißt “userver” und zeigt folgendes:

root@userver:~# samba-tool fsmo show
SchemaMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
InfrastructureMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
RidAllocationMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
DomainNamingMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
DomainDnsZonesMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local
ForestDnsZonesMasterRole owner: CN=NTDS Settings,CN=USERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msbe,DC=local

Logge ich mich auf dem Windows 7 Rechner per RDP ein, sieht man im NETLOGON.LOG folgendes:

04/04 16:56:53 [LOGON] SamLogon: Network logon of msbe\ms from mbp3.local Entered
04/04 16:56:53 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:56:53 [MAILSLOT] NetpDcPingListIp: msbe.local.: Sent UDP ping to 192.168.0.3
04/04 16:56:53 [MISC] NlPingDcNameWithContext: Sent 1/1 ldap pings to vserver.msbe.local
04/04 16:56:53 [MISC] NlPingDcNameWithContext: vserver.msbe.local responded over IP.
04/04 16:56:53 [PERF] NlSetServerClientSession: Not changing connection (0000000001D88628): "\\vserver.msbe.local"
    ClientSession: 0000000001DAEA90NlPrintRpcDebug: Dumping extended error for I_NetLogonSamLogonWithFlags with 0xc0020017
04/04 16:57:14 [CRITICAL]  [0] ProcessID is 800
04/04 16:57:14 [CRITICAL]  [0] System Time is: 4/4/2018 14:57:14:969
04/04 16:57:14 [CRITICAL]  [0] Generating component is 18
04/04 16:57:14 [CRITICAL]  [0] Status is 1722
04/04 16:57:14 [CRITICAL]  [0] Detection location is 1442
04/04 16:57:14 [CRITICAL]  [0] Flags is 0
04/04 16:57:14 [CRITICAL]  [0] NumberOfParameters is 1
04/04 16:57:14 [CRITICAL]      Unicode string: vserver.msbe.local
04/04 16:57:14 [CRITICAL]  [1] ProcessID is 800
04/04 16:57:14 [CRITICAL]  [1] System Time is: 4/4/2018 14:57:14:969
04/04 16:57:14 [CRITICAL]  [1] Generating component is 18
04/04 16:57:14 [CRITICAL]  [1] Status is 1722
04/04 16:57:14 [CRITICAL]  [1] Detection location is 323
04/04 16:57:14 [CRITICAL]  [1] Flags is 0
04/04 16:57:14 [CRITICAL]  [1] NumberOfParameters is 0
04/04 16:57:14 [CRITICAL]  [2] ProcessID is 800
04/04 16:57:14 [CRITICAL]  [2] System Time is: 4/4/2018 14:57:14:969
04/04 16:57:14 [CRITICAL]  [2] Generating component is 18
04/04 16:57:14 [CRITICAL]  [2] Status is 1237
04/04 16:57:14 [CRITICAL]  [2] Detection location is 313
04/04 16:57:14 [CRITICAL]  [2] Flags is 0
04/04 16:57:14 [CRITICAL]  [2] NumberOfParameters is 0
04/04 16:57:14 [CRITICAL]  [3] ProcessID is 800
04/04 16:57:14 [CRITICAL]  [3] System Time is: 4/4/2018 14:57:14:969
04/04 16:57:14 [CRITICAL]  [3] Generating component is 18
04/04 16:57:14 [CRITICAL]  [3] Status is 10060
04/04 16:57:14 [CRITICAL]  [3] Detection location is 311
04/04 16:57:14 [CRITICAL]  [3] Flags is 0
04/04 16:57:14 [CRITICAL]  [3] NumberOfParameters is 3
04/04 16:57:14 [CRITICAL]      Long val: 49153
04/04 16:57:14 [CRITICAL]      Pointer val: 0
04/04 16:57:14 [CRITICAL]      Pointer val: 0
04/04 16:57:14 [CRITICAL]  [4] ProcessID is 800
04/04 16:57:14 [CRITICAL]  [4] System Time is: 4/4/2018 14:57:14:969
04/04 16:57:14 [CRITICAL]  [4] Generating component is 18
04/04 16:57:14 [CRITICAL]  [4] Status is 10060
04/04 16:57:14 [CRITICAL]  [4] Detection location is 318
04/04 16:57:14 [CRITICAL]  [4] Flags is 0
04/04 16:57:14 [CRITICAL]  [4] NumberOfParameters is 0
04/04 16:57:14 [SESSION] MSBE: NlStartApiClientSession: Unbind from server \\vserver.msbe.local (TCP) 0.
04/04 16:57:15 [CRITICAL] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000000d)
04/04 16:57:15 [LOGON] SamLogon: Network logon of msbe\ms from mbp3.local Returns 0xC000000D
04/04 16:57:17 [SESSION] I_NetLogonGetAuthData called: (null) MSBE (Flags 0x1)  
04/04 16:57:17 [SESSION] I_NetLogonGetAuthData called: (null) MSBE (Flags 0x1)  
04/04 16:57:17 [SESSION] I_NetLogonGetAuthData called: (null) MSBE (Flags 0x1)  
04/04 16:57:17 [MISC] DsGetDcName function called: Dom:MSBE Acct:(null) Flags: FORCE PDC NETBIOS RET_NETBIOS 
04/04 16:57:17 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:17 [MAILSLOT] NetpDcPingListIp: msbe.local.: Sent UDP ping to 192.168.0.2
04/04 16:57:17 [MISC] NetpDcGetName: NetpDcGetNameIp returned 0
04/04 16:57:17 [MISC] DsGetDcName function returns 0: Dom:MSBE Acct:(null) Flags: FORCE PDC NETBIOS RET_NETBIOS 
04/04 16:57:17 [MISC] DsGetDcName function called: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:17 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:17 [MISC] NetpDcGetName: msbe.local. cache is too old, need to redo discovery. 48216868
04/04 16:57:17 [MAILSLOT] NetpDcPingListIp: msbe.local.: Sent UDP ping to 192.168.0.3
04/04 16:57:17 [MISC] NetpDcGetName: NetpDcGetNameIp returned 0
04/04 16:57:17 [MISC] LoadBalanceDebug (Flags: RET_NETBIOS ): DC=VSERVER, SrvCount=2, FailedAQueryCount=0, DcsPinged=1, LoopIndex=0
04/04 16:57:17 [MISC] DsGetDcName function returns 0: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:17 [MISC] DsGetDcName function called: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:17 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:17 [MISC] NetpDcGetName: msbe.local. using cached information
04/04 16:57:17 [MISC] DsGetDcName function returns 0: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:17 [MISC] DsGetDcName function called: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:17 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:17 [MISC] NetpDcGetName: msbe.local. using cached information
04/04 16:57:17 [MISC] DsGetDcName function returns 0: Dom:(null) Acct:(null) Flags: RET_NETBIOS 
04/04 16:57:18 [MISC] DsGetDcName function called: Dom:msbe Acct:(null) Flags: IP KDC 
04/04 16:57:18 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:18 [MISC] NetpDcGetName: msbe.local. cache is too old. 36350011
04/04 16:57:18 [MAILSLOT] NetpDcPingListIp: msbe.local.: Sent UDP ping to 192.168.0.3
04/04 16:57:18 [MISC] NlPingDcNameWithContext: Sent 1/1 ldap pings to vserver.msbe.local
04/04 16:57:18 [MISC] NlPingDcNameWithContext: vserver.msbe.local responded over IP.
04/04 16:57:18 [MISC] NetpDcGetName: msbe.local. using cached information
04/04 16:57:18 [MISC] DsGetDcName function returns 0: Dom:msbe Acct:(null) Flags: IP KDC 
04/04 16:57:18 [MISC] DsGetDcName function called: Dom:MSBE.LOCAL Acct:(null) Flags: IP KDC 
04/04 16:57:18 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:18 [MISC] NetpDcGetName: MSBE.LOCAL using cached information
04/04 16:57:18 [MISC] DsGetDcName function returns 0: Dom:MSBE.LOCAL Acct:(null) Flags: IP KDC 
04/04 16:57:19 [MISC] DsGetDcName function called: Dom:MSBE Acct:(null) Flags: RET_DNS 
04/04 16:57:19 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:19 [MISC] NetpDcGetName: msbe.local. using cached information
04/04 16:57:19 [MISC] DsGetDcName function returns 0: Dom:MSBE Acct:(null) Flags: RET_DNS 
04/04 16:57:42 [MISC] DsGetDcName function called: Dom:cats-net Acct:(null) Flags: IP KDC 
04/04 16:57:42 [MISC] DsIGetDcName: Ignore single label DNS domain name cats-net
04/04 16:57:42 [MISC] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c01ffff1
04/04 16:57:42 [MAILSLOT] Sent 'Sam Logon' message to cats-net[1C] on all transports.

Dabei fällt mir auf, dass die Authentizierung ggf. gegenüber dem Server “vserver” erfolgt. Dies ist ebenfalls ein UCS, der als Slave konfiguriert ist. Selbstverständlich haben beide Server den derzeit aktuellen patchlevel 9. Sie befinden sich beide im selben lokalen Class C - Netzwerk.

Hilft das bei der Ursachenfindung ?

Gruß Martin

Hey,

(Edit: ups, wollte doch gar nicht auf Englisch antworten…)

@mschlee Kann es sein, dass die Logdatei irgendwo in der Mitte abgeschnitten wurde? Die letzte Zeile, die mit 04/04 16:56:53 beginnt, sieht mir verdächtig aus.

Bitte posten Sie auch die Ausgabe der folgenden Befehle vom DC Mater:

  • ip addr show
  • ucr search --brief samba/interfaces
  • grep interface /etc/samba/smb.conf

Danke.

Gruß
mosu

Ne, da ist nix abgeschnitten. Ich hab es nochmal reinkopiert. Sieht es jetzt besser aus ?

Hier die anderen Ausgaben:

root@userver:~# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 90:1b:0e:60:09:16 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.2/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::921b:eff:fe60:916/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 90:1b:0e:60:09:17 brd ff:ff:ff:ff:ff:ff
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:d4:68:90:a3 brd ff:ff:ff:ff:ff:ff
    inet 172.17.42.1/16 scope global docker0
       valid_lft forever preferred_lft forever

und

root@userver:~# ucr search --brief samba/interfaces
samba/interfaces/bindonly: <empty>
samba/interfaces: <empty>

und

root@userver:~# grep interface /etc/samba/smb.conf
	# ignore interfaces in samba/register/exclude/interfaces
	bind interfaces only = yes
	interfaces = lo eth0

Gruß - Martin

Having the same issues… my outputs are similiar

@mschlee can you try the following?

net -d3 rpc trustdom list
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
added interface lo ip=::1 bcast= netmask=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.120.2 bcast=192.168.120.255 netmask=255.255.255.0
interpret_string_addr_internal: getaddrinfo failed for name eth0_0 (flags 32) [Name or service not known]
interpret_interface: Can't find address for eth0_0
interpret_string_addr_internal: getaddrinfo failed for name eth0_1 (flags 32) [Name or service not known]
interpret_interface: Can't find address for eth0_1
resolve_wins: using WINS server 127.0.0.1 and tag '*'
name_resolve_bcast: Attempting broadcast lookup for name CCM<0x1b>
Unable to resolve PDC server address
Unable to find a suitable server for domain CCM
Couldn't connect to domain controller: NT_STATUS_UNSUCCESSFUL

In diagnotics i don’t have any error, but don’t belive this output should be normal… as i have a master and a slave DC
The getaddrinfo is weird…

I tried that and got the same until

added interface eth0 ip=192.168.120.2 bcast=192.168.120.255 netmask=255.255.255.0

then I am requested to enter the root password. This, however, is not accepted since I get

Enter root's password:
Connecting to 192.168.0.2 at port 445
got OID=1.2.840.48018.1.2.2
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Got challenge flags:
Got NTLMSSP neg_flags=0x62898215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
SPNEGO login failed: The attempted logon is invalid. This is either due to a bad username or authentication information.
Could not connect to server USERVER
The username or password was not correct.
Connection failed: NT_STATUS_LOGON_FAILURE
Couldn't connect to domain controller: NT_STATUS_LOGON_FAILURE
return code = -1

I guess that something different is going on here.

Martin

Do you have more than one ip address in the server?

I’m trying debug if that could be the issue… i have this

ifconfig -a
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.120.2  netmask 255.255.255.0  broadcast 192.168.120.255
        inet6 fe80::d7:71ff:fed1:fbf0  prefixlen 64  scopeid 0x20<link>
        ether 02:d7:71:d1:fb:f0  txqueuelen 1000  (Ethernet)
        RX packets 5061183  bytes 1771681859 (1.6 GiB)
        RX errors 0  dropped 1852  overruns 0  frame 0
        TX packets 5185067  bytes 2112377352 (1.9 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.120.20  netmask 255.255.255.0  broadcast 192.168.120.255
        ether 02:d7:71:d1:fb:f0  txqueuelen 1000  (Ethernet)

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 1580227  bytes 299776411 (285.8 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1580227  bytes 299776411 (285.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

So the error shouldn’t exist, but maybe something wrong could happen because the interface eth0:0

Hey,

yes: the problem for @codedmind is likely missing DNS entries such as SRV records for _ldap._tcp.$domainname, whereas in @mschlee’s case those entries are present: the net rpc can look up and connect to the DC. Running net -U administrator rpc trustdomain list would most likely work for @mschlee.

Different underlying causes for you two, even though the symptoms may seem similar.

Kind regards,
mosu

Mastodon