Page 1 of 1
[RESOLVED] Minor error in the documentation
Published: October 7, 2025 - 7:27 PM
by Vincent38
Hello,
just a quick message to point out a slight error in the documentation for installing a secondary Active Directory. In krb5.conf, you need to set "dns_lookup_kdc = true" and not "false", otherwise it causes some problems.
Regards
Re: Minor error in the documentation
Published: October 8, 2025 - 9:22 AM
by yalemu
Good morning,
No, it's not a mistake
The KDC servers are defined below for the Kerberos realm of the domain:
Code: Select all
[libdefaults]
default_realm = NOM_DE_DOMAINE_LONG
dns_lookup_kdc = false
dns_lookup_realm=false
[realms]
NOM_DE_DOMAINE_LONG = {
kdc = 127.0.0.1
kdc = IP_SERVUR_AD1
}
Normally, kinit should work. Otherwise, there might be a problem with /etc/resolv.conf, depending on your error?
Good day,
Yohannes
Re: Minor error in the documentation
Published: October 8, 2025 - 10:12 AM
by dcardon
Hi Vincent,
The nss library (which handles routing system DNS queries) isn't site-aware by default, so if we let it perform DC detection, we're not guaranteed it will find the one we want. There's a module to add (winbind_krb5_locator), but there were bugs in previous versions of the pre-packaged modules, so hardcoding it (especially on a DC) is the most robust solution.
Re: Minor error in the documentation
Published: October 9, 2025 - 12:42 PM
by Vincent38
Hello
, sorry, it's my fault. I went a bit too fast; I forgot to replace "MYDOMAIN.LAN" in the "realms" section with the correct domain, so of course it wasn't going to work.
Quick question: the official Samba documentation recommends putting the DC's IP address in resolv.conf after joining the domain, rather than 127.0.0.1. Do you know why?
Regards
Re: Minor error in the documentation
Published: October 9, 2025 - 2:29 PM
by dcardon
Hello Vincent,
Vincent38 wrote: ↑Oct 9, 2025 - 12:42
Sorry, it's my fault, I went a bit too fast, I forgot to replace "MYDOMAIN.LAN" in the "realms" section with the correct domain, so of course it wasn't going to work.
Quick question: the official Samba documentation recommends putting the IP address of the DC in question in resolv.conf after joining the domain, rather than 127.0.0.1. Do you know why?
It's a convenient way to write the text. It ensures it's the correct IP address and it works very well
Sincerely,
Denis
Re: Minor error in the documentation
Published: October 10, 2025 - 1:40 PM
by Vincent38
That's what I thought,
thank you!
Regards