Hi everyone,
I had posted recently about getting Samba4 to work on CentOS 6.4 but
having changes only replicating in one direction, from the Win2k3 AD but
not back to it. I solved the problem, this time, by disabling iptables.
I find it a bit hard to understand. These are the rules I have set up:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [52:5888]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -m udp -p udp --dport 53 -m comment --comment "DNS" -j ACCEPT
-A INPUT -m udp -p udp --dport 123 -m comment --comment "NTP" -j ACCEPT
-A INPUT -m udp -p udp --dport 135 -m comment --comment "RPC UDP" -j ACCEPT
-A INPUT -m udp -p udp --dport 389 -m comment --comment "LDAP UDP" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 88 -m comment
--comment "Kerberos" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 464 -m comment
--comment "Kerberos Password Management" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -m comment
--comment "SMB CIFS" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -m comment
--comment "LDAP TCP" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -m comment
--comment "LDAP SSL" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3268 -m comment
--comment "LDAP Global Catalog" -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3269 -m comment
--comment "LDAP Global Catalog SSL" -j ACCEPT
-A INPUT -p udp -m udp --dport 631 -m comment --comment "CUPS" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 631 -m comment --comment "CUPS" -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Additionally, I used to have -s 10.0.0.0/8 on all of the samba-related
ones, but then I couldn't connect to the new DC via the Windows AD Users
and Computers tool. Take away -s, and it works. So the above is now
what I have, but when iptables is enabled, I get "Warning: No NC
replicated for Connection!" on outbound when I run "samba-tool drs
showrepl" and I get errors like this in Windows Event Viewer:
Event Type: Warning
Event Source: NTDS KCC
Event Category: Knowledge Consistency Checker
Event ID: 1925
Date: 2013-08-15
Time: 10:21:27 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: OLDDC
Description:
The attempt to establish a replication link for the following writable
directory partition failed.
Directory partition:
DC=mydomain,DC=lan
Source domain controller:
CN=NTDS
Settings,CN=NEWDC,CN=Servers,CN=mydomain-office,CN=Sites,CN=Configuration,DC=mydomain,DC=lan
Source domain controller address:
fb9ec5fd-28a7-44a0-a784-933a41dd830a._msdcs.mydomain.lan
Intersite transport (if any):
This domain controller will be unable to replicate with the source
domain controller until this problem is corrected.
User Action
Verify if the source domain controller is accessible or network
connectivity is available.
Additional Data
Error value:
1722 The RPC server is unavailable.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
------------- (end quote)
Also, the AD Replication Status Viewer tool will say that NEWDC cannot
be contacted. Disable iptables, and voila, it starts reporting
successful replication.
IIUC it's the port 135 that allows RPC contact, which I believe my
iptables config above should correctly open. If not, could someone show
me where I've gone wrong here?
Thanks,
Kev
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
