Nick Howitt wrote:

Are you just trying to join a normal Samba domain or are you going for the docker/samba solution further down the post? I suspect the former.

At a very strong guess, you have not done the two registry updates. Click on the Windows Networking documentation to find out more. There is also a KB article. You probably can't do the KB4458469 update as your Version and OS Build Version are substantially later than the minimum required and already have the necessary updates.

Can I also check you have Win10 Pro and not Home as Home can't join a domain of any type.

Samba server PAN is now a domain master browser for workgroup NDHS on subnet UNICAST_SUBNET

*****
[2018/11/01 01:28:55.028095, 0] ../source3/nmbd/nmbd_become_dmb.c:294(become_domain_master_browser_bcast)
become_domain_master_browser_bcast:
Attempting to become domain master browser on workgroup NDHS on subnet 192.168.20.1
[2018/11/01 01:28:55.028146, 0] ../source3/nmbd/nmbd_become_dmb.c:307(become_domain_master_browser_bcast)
become_domain_master_browser_bcast: querying subnet 192.168.20.1 for domain master browser on workgroup NDHS
[2018/11/01 01:28:57.034193, 0] ../source3/nmbd/nmbd_namequery.c:109(query_name_response)
query_name_response: Multiple (2) responses received for a query on subnet 192.168.20.1 for name NDHS<1d>.
This response was from IP 192.168.20.117, reporting an IP address of 192.168.20.117.
[2018/11/01 01:28:59.038173, 0] ../source3/nmbd/nmbd_logonnames.c:123(become_logon_server_success)
become_logon_server_success: Samba is now a logon server for workgroup NDHS on subnet 192.168.20.1
[2018/11/01 01:29:03.044543, 0] ../source3/nmbd/nmbd_become_dmb.c:112(become_domain_master_stage2)
*****

Samba server PAN is now a domain master browser for workgroup NDHS on subnet 192.168.20.1

*****
[2018/11/01 01:29:18.066578, 0] ../source3/nmbd/nmbd_become_lmb.c:397(become_local_master_stage2)
*****

Samba name server PAN is now a local master browser for workgroup NDHS on subnet 192.168.20.1

*****
[2018/11/01 05:35:48.017395, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.20.117(138) ERRNO=Opération non permise
[2018/11/01 06:50:49.822350, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.20.117(138) ERRNO=Opération non permise
[2018/11/01 07:40:55.599647, 1] ../librpc/ndr/ndr.c:612(ndr_pull_error)
ndr_pull_error(11): Pull bytes 2 (../librpc/ndr/ndr_basic.c:107)
[2018/11/01 07:40:55.599714, 1] ../source3/nmbd/nmbd_processlogon.c:352(process_logon_packet)
process_logon_packet: Failed to pull logon packet
[2018/11/01 09:50:54.670858, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.20.117(138) ERRNO=Opération non permise

max protocol = SMB2

Nick Howitt wrote:
/etc/resolv-peerdns.conf should have been correct all along and refers to your upstream resolver.

Nick Howitt wrote:
Have you checked you can resolve correctly the DC's FQDN both from inside and outside the container? Unfortunately for me, my set up has suddenly started resolving the DC's FQDN into 2 IP's, the container's internal and external IP. This has only been happening today, I think, or possibly yesterday after I did the domain join.

-e "DNSFORWARDER=172.22.22.1" \

Nick Howitt wrote:

@Cameron,
I think I have found the issue. Please make sure the Default Domain in Webconfig > Network > Settings > IP Settings is the same as the domain you are joining. Then /etc/resolv.conf and /etc/resolv-peerdns.conf get set as I'd expect.

# Please do not edit this file.

# See http://www.clearcenter.com/support/documentation/clearos_guides/dns_and_resolver

domain howitts.co.uk

nameserver 127.0.0.1

; generated by /usr/sbin/dhclient-script

search howitts.co.uk test.lan

nameserver 172.17.2.1

Failed to join domain: failed to lookup DC info for domain 'DOMAIN' over rpc: {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation.

1. Decide on a LAN IP for your Docker/Samba installation. This should be a fixed IP on your LAN, so outside if DHCP scope. My ClearOS LAN interface is 172.17.2.1/24 and I am going to use 172.17.2.2 for my Docker/Samba installation. Wherever you see 172.17.2.2 in this guide substitute it for your chosen LAN IP and 172.17.2.1 for your ClearOS LAN interface IP.
   


2. In Webconfig > Network > Settings > IP Settings > Add Virtual button set up your Docker LAN IP as a virtual IP, attached your LAN interface with the same Netmask as your LAN. Note the name of the name if the interface it creates.
   


3. Add a file /etc/sysconfig/network-scripts/ifcfg-docker0 and in it put:
   

DEVICE=docker0

TYPE="Bridge"

ONBOOT="yes"

USERCTL="no"

BOOTPROTO="none"



4. Note, if you're doing a fresh install with Community, do not install Windows Networking before you activate the AD Conector.
   
Change the ClearOS Samba port bindings to bind so it does not bind to the virtual interface. Edit /etc/samba/smb.conf and set:


bind interfaces only = yes

interfaces = lo enp2s0f1

nmbd bind explicit broadcast = yes 

socket address = 172.22.22.1

In the "interfaces" section, list all your normal LAN interfaces and possibly the tun interfaces and docker0 interface. If you do an "ifconfig" you'll see a full list from which to make your choice. Do not add the virtual interface. For the "socket address", just set it to one of your LAN interface IP's. this is a bit of a kludge.

[edit]
Note that the Gateway Management/DNSThingy manager, dnsthingymgr, must not be running before you start the docker samba container as that also binds to udp:137 and will stop the docker samba container from starting. To disable it, disable Gateway Manager/DNSThingy. If they are already disabled, enable them and disable them again. Gateway Manager/DNSThingy can be started after docker/samba starts. Alternatively, for a permanent fix you can:


echo "disable-neighbour-discovery" > /etc/dnsthingy/dnsthingymgr.conf


or change the netbios ports in dnsthingymgr to something silly. In /etc/dnsthingy/dnsthingymgr.conf:


netbios-listen-port=54321

netbios-reply-port=54322


[/edit]


5. Now we have to adjust a ClearOS routine which kills Winbind each time you visit the Users of Groups screen a while after you join the domain. The edits need to be made to /usr/clearos/apps/samba_common/libraries/Winbind.php. In the "// Classes" section, add a line:

   clearos_load_library('base/Shell');

   and near the end of the file, change:

               $this->set_running_state(TRUE);

   to

               $shell = new Shell();
   
   

$shell->Execute('/usr/bin/systemctl', 'start winbind', TRUE);
The forum formatting is playing tricks here. Both lines are needed, including the one in red (the forum has split the lines into two sections and made the second line red - there is nothing I can do about it )


6. Add a guest user or Samba won't start
   

useradd -r guest

Then start smb, nmb and winbind.
If smb won't start you may need to add a /var/samba/drivers folder manually:


mkdir /var/samba/drivers -p



7. Change the port bindings in dnsmasq not to bind on the virtual interface and, jumping ahead of ourselves set up a split DNS. Create a file /etc/dnsmasq.d/docker-samba (you can call it what you want as long as it is in this folder) and add the lines:
   

bind-dynamic

except-interface=enp2s0f1:0

server=/howitts.local/172.22.22.2

enp2s0f1:0 is my virtual interface and howitts.local is my domain. Instead of "except-interfaces=" you can do "interfaces=" and list all your interfaces, including docker0. Restart dnsmasq with a:

systemctl restart dnsmasq.service



8. Install app-docker, set it to start on boot and start it, then restart the firewall and dnsmasq:
   

yum install app-docker --enablerepo=clearos-updates

systemctl enable docker.service

systemctl start docker.service

systemctl restart firewall.service

systemctl restart dnsmasq.service

Note that if you already had docker installed and running, you'll need to restart it after creating your virtual interface

Also note that it is best to at least use app-docker v2.6.1 which is currently only available from clearos-updates so you may want to add the "--enablerepo-clearos-updates" to your yum command. The package has better firewall treatment.

Also note that Docker tries to choose a free /16 network for its docker0 interface. It may be worth at this point doing an "ifconfig" and checking it has chosen a subnet which does not clash with any of yours. It does not seem to spot VLAN subnets in use and can have other issues (mine, obscurely, is a VM running with natted interfaces on my desktop which has a local IP in the 172.17.2.0/24 subnet). If this is the case, see the "Configure the default bridge network" section of this doc and add a line between the braces:


"bip": "your_manual_subnet"

in /etc/docker/daemon.json and restart the docker service and dnsmasq. Note that the IP address you use should be the IP address you want to give the docker0 interface, so 172.16.0.1/16 would give the docker interface an address of 172.16.0.1, and assign a /16 subnet to the interface. If you use 172.16.0.0/16, docker will not start as 172.16.0.0 is not a valid NIC IP. A /24 subnet should be big enough for just a domain controller docker container.


9. Now install the docker container from https://github.com/Fmstrat/samba-domain:
   

docker pull nowsci/samba-domain



10. Prep your data folders:
    

mkdir -p /var/clearos/samba/data

mkdir -p /var/clearos/samba/config



11. Start your Docker/Samba container which will be called "samba":
    

docker run -t -i -d \

	-e "DOMAIN=HOWITTS.LOCAL" \

	-e "DOMAINPASS=SomeC0mplexPassword" \

	-e "DNSFORWARDER=172.22.22.1" \

	-e "HOSTIP=172.22.22.2" \

	-e "NOCOMPLEXITY=true" \

	-p 172.22.22.2:53:53 \

	-p 172.22.22.2:53:53/udp \

	-p 172.22.22.2:88:88 \

	-p 172.22.22.2:88:88/udp \

	-p 172.22.22.2:135:135 \

	-p 172.22.22.2:137-138:137-138/udp \

	-p 172.22.22.2:139:139 \

	-p 172.22.22.2:389:389 \

	-p 172.22.22.2:389:389/udp \

	-p 172.22.22.2:445:445 \

	-p 172.22.22.2:464:464 \

	-p 172.22.22.2:464:464/udp \

	-p 172.22.22.2:636:636 \

	-p 172.22.22.2:1024-1044:1024-1044 \

	-p 172.22.22.2:3268-3269:3268-3269 \

	-v /etc/localtime:/etc/localtime:ro \

	-v /var/clearos/samba/data:/var/lib/samba \

	-v /var/clearos/samba/config:/etc/samba/external \

	--dns-search howitts.local \

	--dns 172.22.22.2 \

	--dns 172.22.22.1 \

	--add-host localdc.howitts.local:172.22.22.2 \

	-h localdc \

	--name samba \

	--privileged \

	--restart unless-stopped \

	nowsci/samba-domain

Notes:
DOMAIN is the name of your domain. Best practice says to use a subdomain of your proper external domain which does not resolve externally. As an example, my proper domain is howitts.co.uk so a best practice AD domain could be ad.howitts.co.uk and not howitts.local as in my example. This domain name should also be the one you put into your /etc/dnsmasq.d/samba-domain.
Change all occurrences of howitts.local to your domain name.
I have set password complexity off but the start script only changes the settings after the administrator password is set so you must use a complex administrator password. You can leave complexity on by removing the "COMPLEXITY" line. You can also change the administrator password to something else (non-complex) later on. I am not sure what the restrictions are for complexity but I had to have at least one upper case character, one lower case character and a number. 16 mixed lower case and number characters did not work.
localdc is the name given to the domain controller (not very imaginative. I've just used their example for now)
Compared to the example, I've added "--restart unless-stopped \" to enable the container to start automatically when docker starts.

[edit]
It may be worth leaving out:


	-e "DNSFORWARDER=172.22.22.1" \

from the start up command. This will remove the ability of samba to resolve IP's externally, but is should not have to as the normal ClearOS dnsmasq DNS server looks after everything except domain lookups which must be handled by Docker/Samba. The container itself can still resolve externally because of the "--dns" lines.
I have noticed high loads at times and it may be because of DNS lookups going round and round between ClearOS/dnamasq and Docker/Samba.
[/edit]


12. After a few seconds check the container is running with a:
    

docker ps

If you have just a number of capitalised headers wrapped over a couple of lines, it is not running. You should see some output where you can match a lot of it to the start up command. If it fails, for me it was due to lack of password complexity and you'll see the error in /var/log/messages. If that is the case, the best thing to do is to do a:


docker rm samba

Then remove everything in /var/clearos/samba/data and /var/clearos/samba/config and try again with a different password.


13. You now need to add some rules to the firewall. Create a file /etc/clearos/firewall.d/11-docker-samba (the name is unimportant but must begin with a number greater than 10) and in it put:
    

if [ "$FW_PROTO" == "ipv4" ]; then true

    DOCKER_IP=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "samba" 2>/dev/null)

    if [ -z "$DOCKER_IP" ]; then

        return

    fi



    $IPTABLES -I DOCKER ! -i docker0 -o docker0 -d $DOCKER_IP -j ACCEPT

    $IPTABLES -A POSTROUTING -t nat -s $DOCKER_IP -d $DOCKER_IP -j MASQUERADE

    $IPTABLES -A DOCKER -t nat ! -i docker0 -d 172.22.22.2 -j DNAT --to-destination $DOCKER_IP

fi

Then restart the firewall with a:


service firewall restart



14. Check that you can get the domain controller's IP address from ClearOS:
    

host localdc.howitts.local

This must resolve to the IP correctly (172.22.22.2 in my case) before you proceed to the next step as it checks if the DC is resolving names correctly.

15. Add an entry to the /etc/hosts file for the DC or you will fail to join the domain:
    

172.22.22.2 localdc.howitts.local localdc

Then, just to make sure the addition is used:


service dnsmasq restart

service nscd restart

docker exec -it samba /bin/bash

samba-tool group add ftp_plugin

samba-tool group add imap_plugin

samba-tool group add openfire_plugin

samba-tool group add openvpn_plugin

samba-tool group add pptpd_plugin

samba-tool group add print_server_plugin

samba-tool group add smtp_plugin

samba-tool group add user_certificates_plugin

samba-tool group add web_proxy_plugin

samba-tool domain passwordsettings show

samba-tool domain passwordsettings set --complexity=off

samba-tool domain passwordsettings set --max-pwd-age=0

samba-tool domain passwordsettings set --history-length=0

samba-tool domain passwordsettings set --min-pwd-age=0

samba-tool domain passwordsettings set --min-pwd-length=4

samba-tool user setpassword administrator

docker stop samba

docker rm samba

docker stop samba

docker rm samba

/var/clearos/samba/data

/var/clearos/samba/config

tomas wrote:

Hi

Anyone tried to share a printer on domain members running W10 1803 (1507 domain joined then upgraded to 1803)?.The client is visible, but can't be accessed most of the time...

docker run -t -i -d \

	-e "DOMAIN=SAMDOM.LOCAL" \

	-e "DOMAINPASS=SomeComplexPassword" \

	-e "DNSFORWARDER=172.22.22.1" \

	-e "HOSTIP=172.22.22.2" \

	-p 172.22.22.2:53:53 \

	-p 172.22.22.2:53:53/udp \

	-p 172.22.22.2:88:88 \

	-p 172.22.22.2:88:88/udp \

	-p 172.22.22.2:135:135 \

	-p 172.22.22.2:137-138:137-138/udp \

	-p 172.22.22.2:139:139 \

	-p 172.22.22.2:445:445 \

	-p 172.22.22.2:464:464 \

	-p 172.22.22.2:464:464/udp \

	-p 172.22.22.2:636:636 \

	-p 172.22.22.2:1024-1044:1024-1044 \

	-p 172.22.22.2:3268-3269:3268-3269 \

	-v /var/lib/docker/containers/samba/data:/var/lib/samba \

	-v /var/lib/docker/containers/samba/config/samba:/etc/samba/external \

	--dns-search samdom.local \

	--dns 172.22.22.2 \

	--dns 172.22.22.1 \

	--add-host localdc.samdom.local:172.22.22.2 \

	-h localdc \

	--name samba \

	--privileged \

	nowsci/samba-domain

	

Mansoor wrote:

I'm trying to access clearOS shares from Windows 10 but without success! The SMBv1 is enabled in Windows 10. The clearOS server is 7.5 beta and running Samba in "Simple Server" mode with "Windows 10 Domain Logons" disabled.

The server appears in the Windows file manager and in "nbtstat -A 192.168.0.1" output. When I double click on the server's icon, Windows asks for username and password. All usernames and passwords I enter are rejected! I tried to login with "winadmin" and with normal users, but always the same result.

EDIT: Just after posting this reply I was abel to login from Windows by entering "WORKGROUP\username" instead of just username