FreeNAS8 and ActiveDirectory

[trunglam]

Thanks for your guide this must public to all people.!

 

[cargobra]

Thanks for your How to ! It may'll help a lot of people !
just in case => winbindd restart command allow you to reload winbindd daemon. Until I found it, I had to reboot freenas everytime WB failed...! Hope it'll help somebody !

 

[mr_mike_m]

Phil-
Nice job preparing "The Guide".

regards,
MM

 

[Freeman]

to Phil:
Thank you very much for you guide!

to Developers:
Do we have any chance to see the function of choosing the AD,
introduced as in previous version? I would like to take your notice
that while working in windows-based network you can configure Samba as
"Local User" or "Active Directory", as it is described:
http://wiki.samba.org/index.php/Samba_&_Active_Directory#Setting_up_Samba
http://wiki.samba.org/index.php/Samba,_Active_Directory_&_LDAP
I've mentioned it before(http://forums.freenas.org/showthread.php?2428-Authentication-Model),
but haven't recieved any comments yet.
with best regards,
Alex.

 

[karmalicious]

Thanks but...

Thanks unclepips, your guide works indeed, but it's really just the same as I did before when I got it to work.

For some reason I can't get my current FreeNAS to display the AD users, but wbinfo and net ads and all that reports just fine. I tried to just install FreeNAS 8.02 on a new server and it works just fine, but for how long? :P

Just wanted to say thanks anyway. :)

 

[trunglam]

Can see user in wbinfo but can not in permissions

I am having an issue applying permissions to my volume. I successfully joined my FreeNAS system to a domain. If I type 'wbinfo -u' or 'wbinfo -g' I can see all of my users and groups. However, when I click the permissions button on the volume I do not see AD users and groups. Is there anything else I should do or check?

I have same problem like this in some case and still not solved this problem.

What is solution?

Thanks.

 

[karmalicious]

I have same problem like this in some case and still not solved this problem.

What is solution?

Thanks.

I had the same problems with 8.0. Upgrading to 8.0.2 solved the problem. Don't know which version you run, but everything looks more like you except in 8.0.2 too. :)

 

[trunglam]

I had the same problems with 8.0. Upgrading to 8.0.2 solved the problem. Don't know which version you run, but everything looks more like you except in 8.0.2 too. :)

Thanks I will report after give it a try

 

[iou72824]

thanks but...

thanks a lot for unclepips's guide.
i have joined domain now, but i get new problem.
i can't get next step when that has ran 「waiting for http...Done」.
just like freeze ,but web gui was normal for a short time, then all system freeze....

after long test, i get some information as below.
at shell, i type 「wbinfo -u」 and 「wbinfo -g」 just show one message as error balabala(sorry, i forget it)
but type 「net ads info」 that show i connect LDAP server
i setting use AD but it's connect LDAP server, so is it right?

 

[mattx]

This link:

http://www.raindropsoftware.co.uk/freenassetup

Does not show the guide which I really need !! I've spent a good few hours today trying every method to get AD talking to a NAS box [ 8.0.4 ] but to no avail. Does anyone have an update to this link or the actual guide they can post. Thanks.

Failing that - anyone know of some command line options to force it to join AD ? I tried a net join but again no luck making it into a member.

Does this release actually work for AD ?

 

[mr_mike_m]

Matt-
Looks like UnclePips (aka Phil) has updated his web site, and lost the link to the guide.
Best try to PM him.

My AD is working under FreeNAS-8.0.3-RELEASE-x86 (9395)
I have not done the upgrade to 8.0.4 yet.

This thread is the culmination of a group of us with 2+ weeks of trial and error to get it going, and it was very frustrating, so I feel your pain!

I have a "mostly" 2008 domain with one 2003 box that I point FreeNAS to for authentication.

 

[mattx]

Thanks - I'll send him a PM.
FYI - we are on a 2003 Domain with a few 2008 servers around.
I've been using FreeNAS since it was first released many many years ago now. Only just gone back to it as I left two boxes running ok in my last job. In fact I have a screen shot of an uptime of almost two years for one box !!
I really want to get AD working on this latest setup as I have a offices around the globe I want to get these into for some simple backup jobs which will sync back to a single box in the UK.

 

[mattx]

Thanks to Phil for posting back up the guide - I followed to the letter but have come to the conclusion that this release simply does not work with MS AD. No matter what I try it fails everytime I try to start the AD service. I'm now going back to a version that perhaps works correctly - ver 7. Such a shame. This is a log of the problem if anyone can chuck any ideas my way before I start to DL and install an older version !!

ar 29 16:06:30 freenas freenas[1717]: Executing: /usr/sbin/service ix-kerberos quietstart
Mar 29 16:06:31 freenas freenas: Could not parse LDAP URI(s)=ldap://in:retrying (5)
Mar 29 16:06:31 freenas freenas[1717]: Executing: /usr/sbin/service ix-nsswitch quietstart
Mar 29 16:06:31 freenas freenas: Generating host.conf.
Mar 29 16:06:31 freenas freenas[1717]: Executing: /usr/sbin/service ix-pam quietstart
Mar 29 16:06:31 freenas freenas[1717]: Executing: /usr/sbin/service ix-samba quietstart
Mar 29 16:06:31 freenas freenas: Could not parse LDAP URI(s)=ldap://in:retrying (5)
Mar 29 16:06:31 freenas freenas[1717]: Executing: /usr/sbin/service ix-kinit quietstart
Mar 29 16:06:31 freenas freenas: Could not parse LDAP URI(s)=ldap://in:retrying (5)
Mar 29 16:06:31 freenas freenas: kinit: krb5_get_init_creds: unable to reach any KDC in realm MYDOM.COM
Mar 29 16:06:41 freenas freenas[1717]: Executing: /usr/sbin/service ix-kinit status
Mar 29 16:06:41 freenas freenas[1717]: Executing: /usr/sbin/service ix-kinit status
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-kerberos quietstart
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-nsswitch quietstart
Mar 29 16:06:42 freenas freenas: Generating host.conf.
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-pam quietstart
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-samba quietstart
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-kinit forcestop
Mar 29 16:06:42 freenas freenas[1717]: Executing: /usr/sbin/service ix-activedirectory forcestop
Mar 29 16:06:42 freenas freenas: Could not parse LDAP URI(s)=ldap://in:retrying (5)
Mar 29 16:06:43 freenas freenas: No realm set, are we joined ?
Mar 29 16:06:43 freenas freenas[1717]: Executing: /usr/sbin/service winbindd forcestop
Mar 29 16:06:43 freenas freenas: winbindd not running? (check /var/run/samba/winbindd.pid).
Mar 29 16:06:43 freenas freenas[1717]: Executing: /usr/sbin/service ix-kinit status

 

[mimmus]

Same problem here.
String "in" in LDAP url probably is a typo error somewhere, I had also in /etc/krb5.conf file and I was forced to correct base templates.

 

[mimmus]

Same problem here.
String "in" in LDAP url probably is a typo error somewhere, I had also in /etc/krb5.conf file and I was forced to correct base templates.

No help??

Where can I find description of how config files are created? I'd like to find who is that insert this "in"

 

[madstupid]

Hi All,

I managed to get AD working on latest release(8.2) and i would like to share my experience with you all. I had issues and i just could not join AD and I was about to give up on it. Somewhere on the threads i saw that '$' could not be used on the password but i had space and question mark on my password and i could not get AD to work.

I am quite surprised wrt the error message thrown out by the system they did not come close to giving me a clue as to where my problem lies.

error messages from /var/log/messages:

[: in]
'(' invalid
winbindd not running
kinit...password
logon servers not found
etc

When all this was happening i verified that i could ping my domain by name and all the ports needed were open on the network(i.e telnet x.x.x.x 389).

on the forum, somebody highlighted you can start winbindd service by issuing the command: winbindd start
you can verify that winbindd is running by issuing the command: service winbindd status

once i had winbindd running i used gui to try AD and on my logs winbindd was getting disabled.

I used other options for troubleshooting but i was not getting anywhere:

net ads ?
wbinfo ?
service ? restart
/usr/local/bin/freenas-debug ?
editing files manually --- /etc/krb5.conf ../smb.conf etc
resetting local root password
rebooting a lot...
changing hostnames and deleting records on dns and restarting netlogon service...

Then out of the blue, thought about resetting the password of the administrator account to something simple: Password1

guess what after everything i tried the password trick worked. i could get the freenas to register to the domain.

I am not 100% this did it but worth a try in your case.

@Developers: Please check why a password i was using would cause an issue with freenas. I remember some limitations on old systems were a space could not be used on the password and you were limited to 8 characters.

My password was: Do u really need a password?

The same password works for my root account. hmmm, i could not figure out this one!!!

My test environment:

DC: windows server 2008 R2

I can provide some logs i had later...Sorry for the long post. It took me very long to get this working and i would not like to see another person wasting time on this if the issue is similar to what i had.

Good luck folks...Au revoir.

 

[paleoN]

@Developers: Please check why a password i was using would cause an issue with freenas. I remember some limitations on old systems were a space could not be used on the password and you were limited to 8 characters.

If you want them to see it perhaps you should file a ticket. Actually, there is one already. Though perhaps your problem was slightly different?

 

[zul]

Confirmed that a administrator password with ! and % characters didn't work, but another one with dots (..) did.

 

[Slavisa]

This is old thread but I have the same problems on 9.2.1 release.
I am trying to set it up and the guide here i good, but without success.

Will try few more times, probably it is my mistake.

Is there anybody that has the same problem in 9.2.1?

Wbinfo -u (-g) gives complete AD but in combo box of FreeNAS GUI AD objects are missing.
There is nothing in /var/log/messages that would show the error. Verbose logging s turned on.