Tips Samba : Migrating From Windows Server To Samba 4 Part 2

1. salam Mas Bro,

   Saya menggunakan Bind sbb:
   Installed Packages
   Name : bind
   Arch : i686
   Epoch : 32
   Version : 9.8.2
   Release : 0.17.rc1.el6_4.4
   Size : 7.2 M
   Repo : installed
   From repo : updates
   Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
   URL : http://www.isc.org/products/BIND/
   License : ISC
   Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS
   : (Domain Name System) protocols. BIND includes a DNS server (named),
   : which resolves host names to IP addresses; a resolver library
   : (routines for applications to use when interfacing with DNS); and
   : tools for verifying that the DNS server is operating properly.

   pada file : /usr/local/samba/private/named.conf

   # This DNS configuration is for BIND 9.8.0 or later with dlz_dlopen support.
   #
   # This file should be included in your main BIND configuration file
   #
   # For example with
   # include “/usr/local/samba/private/named.conf”;

   #
   # This configures dynamically loadable zones (DLZ) from AD schema
   # Uncomment only single database line, depending on your BIND version
   #
   dlz “AD DNS Zone” {
   # For BIND 9.8.0
   database “dlopen /usr/local/samba/lib/bind9/dlz_bind9.so”;

   # For BIND 9.9.0
   # database “dlopen /usr/local/samba/lib/bind9/dlz_bind9_9.so”;
   };

   Saya coba implementasi artikel ini, ketika
   service named restart
   terjadi failed

   error yang saya dapat pada /var/log/message
   ad named: dns_master_load: dynamic/emi.inet:15: unknown $ directive ‘${NTDSGUID}._msdcs’

   apakah syntaxnya berbeda dengan bind versi 9.9.0

   atas pencerahannya saya ucapkan terima kasih.

   regards
   Yogi

   Reply

2. @Yogi : Sudah lakukan hal yang ini belum “Ganti ${NTDSGUID} dengan angka+huruf yang dihasilkan dengan perintah berikut :” dan “Lihat tulisan yang diberi warna
   dan ganti ${DOMAINGUID} dengan angka+huruf yang dihasilkan dengan perintah berikut :”

   Reply

   1. Maaf Mas Bro, belum.
      Setelah saya ubah sesuai saran Mas Bro, named tetap tidak dapat start
      error lognya :
      Jun 18 13:23:07 ad named-sdb[21675]: samba_dlz: Failed to configure zone ’emi.inet’
      Jun 18 13:23:07 ad named-sdb[21675]: loading configuration: already exists
      Jun 18 13:23:07 ad named-sdb[21675]: exiting (due to fatal error)
      berikut konfigurasinya :
      /etc/named.conf
      options {
      tkey-gssapi-keytab “/usr/local/samba/private/dns.keytab”;
      listen-on port 53 { 127.0.0.1; 192.168.0.7; };
      listen-on-v6 port 53 { ::1; };
      directory “/var/named”;
      dump-file “/var/named/data/cache_dump.db”;
      statistics-file “/var/named/data/named_stats.txt”;
      memstatistics-file “/var/named/data/named_mem_stats.txt”;
      allow-query { localhost; any; };
      recursion yes;

      dnssec-enable yes;
      dnssec-validation yes;
      dnssec-lookaside auto;

      /* Path to ISC DLV key */
      bindkeys-file “/etc/named.iscdlv.key”;

      managed-keys-directory “/var/named/dynamic”;
      };

      logging {
      channel default_debug {
      file “data/named.run”;
      severity dynamic;
      };
      };

      zone “.” IN {
      type hint;
      file “named.ca”;
      };

      zone “emi.inet” {
      type master;
      file “dynamic/emi.inet”;
      };

      include “/etc/named.rfc1912.zones”;
      include “/usr/local/samba/private/named.conf”;

      DAN /var/named/dynamic/emi.inet
      $TTL 1W
      @ IN SOA ad.emi.inet. root.emi.inet. (
      01 ; serial
      2D ; refresh
      4H ; retry
      6W ; expiry
      1W ) ; minimum

      @ IN NS ns1
      ns1 IN A 192.168.0.7
      @ IN A 192.168.0.7
      ad IN A 192.168.0.7

      gc._msdcs IN CNAME ad
      1e2e73f8-ae83-4d5a-8d8d-4a054a7703c0._msdcs IN CNAME ad

      _gc._tcp IN SRV 0 100 3268 ad
      _gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 ad
      _ldap._tcp.gc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 389 ad

      _ldap._tcp IN SRV 0 100 389 ad
      _ldap._tcp.dc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.pdc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.3e9ee78b-7979-4995-9c5d-8434e9a5971a IN SRV 0 100 389 ad
      _ldap._tcp.3e9ee78b-7979-4995-9c5d-8434e9a5971a.domains._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 ad

      _kerberos._tcp IN SRV 0 100 88 ad
      _kerberos._tcp.dc._msdcs IN SRV 0 100 88 ad
      _kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 ad
      _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 ad
      _kerberos._udp IN SRV 0 100 88 ad

      _kerberos-master._tcp IN SRV 0 100 88 ad
      _kerberos-master._udp IN SRV 0 100 88 ad

      _kpasswd._tcp IN SRV 0 100 464 ad
      _kpasswd._udp IN SRV 0 100 464 ad

      _kerberos IN TXT EMI.INET

      Reply

3. @Yogi : Coba buang file ini mas dari named.conf kemudian restart dns “include “/usr/local/samba/private/named.conf”;”

   Reply

   1. Salam,
      service named restart hasilnya “OK” (Jalan Mas Bro..Siiipp)
      tapi ketika saya check apakah ada update terbaru mengenai dynamic DNS updates dengan /usr/local/samba/sbin/samba_dnsupdate –verbose
      hasilnya
      Calling nsupdate for SRV _ldap._tcp.gc._msdcs.emi.inet ad.emi.inet 3268
      Outgoing update query:
      ;; ->>HEADER<>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
      ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
      ;; UPDATE SECTION:
      _ldap._tcp.default-first-site-name._sites.gc._msdcs.emi.inet. 0 NONE SRV 0 100 3 89 ad.emi.inet.
      _ldap._tcp.default-first-site-name._sites.gc._msdcs.emi.inet. 900 IN SRV 0 100 3 268 ad.emi.inet.

      update failed: REFUSED
      Failed nsupdate: 2
      Failed update of 2 entries

      Reply

4. @Yogi : Halo mas,
   Cara diatas memang tidak dapat melakukan otomatis update DNS apabila ada klien yang login. Jadi harus manual dibuat satu persatu

   Reply

5. Salam mas,

   Saya mau tanya : jika PC client yang sudah join ke domain windows server yang lama dan lalu kita migrasi ke samba4 … apakah setelah login PC client akan buat profile baru atau tetap ke profile yang sama (meskipun nama username login windows sama)….

   Reply

6. Salam mas,

   Saya berhasil migrasi tp ada kendala :
   Mengapa file ” /usr/local/samba/private/dns.keytab ” tidak ada ya? repot juga kalau harus input manual, clientnya buanyakk mas.. 🙂

   Ketahuannya saat mau lakukan chgrp
   ini errornya :
   [root@lab-pdc ~]# chgrp named /usr/local/samba/private/dns.keytab
   chgrp: cannot access `/usr/local/samba/private/dns.keytab’: No such file or directory

   Kalau sy baca di wikinya samba, file dns.keytab itu otomatis ada setelah kita lakukan provisioning… piye mas?

   Trimakasih

   salam

   Reply

7. kang akhmad;
   saya mengikuti semua step2 untuk migrasi,cuma pada tahap Konfigurasi kerberos DNS dynamic updates (Optional) ada erorr sehingga bind9 failed jadi saya tidak melakukan step tersebut.

   dan setelah test PC windwos join domain tidak bisa ya.
   erorrnya sbb:
   an active directory domain controler (AD DC) for domain “psg.com” couldnot be contacted.
   ensure that domain name is typed corectly
   if the name is correct,click detail troubleshooting.

   Apakah di samba server perlu dibuat DNS sendiri?

   terimakasih

   Reply

   1. @Jalaludin : Halo mas,

      Sangat perlu. Karena DNS Windows Server tidak ikut tersinkronisasi pada saat migrasi

      Reply

8. kang,sudah saya buatkan dns tapi pc client tetap gak bisa join ya,errornya sam dgn yg atas.

   kalau lihat lognya dimana ya

   Reply

9. mas Ahmad,
   saya sdg coba migrasi dari Windows AD ke linux AD, utk proses awal semua berjalan lancar. (https://imanudin.com/2013/05/22/tips-samba-migrating-from-windows-server-to-samba-4-part-1/)
   Pada tutorial ke dua ini, pada bagian transfer roles FSMO, prosesnya succes, hanya pada bagian akhir muncul pesan error:
   ERROR: Failed to delete role ‘domaindns’: LDAP error 50 LDAP_INSUFFICIENT_ACCESS_RIGHTS –
   Apakah maksud error ini?
   Terimakasih sebelumnya

   regards

   Reply

   1. Hi mas,

      Jika dilihat dari pesannya, sepertinya koneksi pada LDAP nya gagal. Silakan dicoba kembali lagi saja mas

      Reply

      1. Mas Ahmad,
         Saya sudah coba lagi, tetapi pada saat menjalankan proses trannsfer FSMO muncul pesan berikut:
         [root@addc-svr002 ~]# /usr/local/samba/bin/samba-tool fsmo seize –role=all
         This DC already has the ‘rid’ FSMO role
         This DC already has the ‘pdc’ FSMO role
         This DC already has the ‘naming’ FSMO role
         This DC already has the ‘infrastructure’ FSMO role
         This DC already has the ‘schema’ FSMO role
         Attempting transfer…
         ERROR: Failed to delete role ‘domaindns’: LDAP error 50 LDAP_INSUFFICIENT_ACCESS_RIGHTS –

         Terimakasih sebelumnya

         regards

         Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.