Use correct netbios name when leaving a domain joined with net ads

Bug #1894340 reported by Andreas Hasenack
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
realmd (Ubuntu)
Fix Released
Undecided
Andreas Hasenack

Bug Description

WHen a domain was joined using samba as the join software (i.e., net ads join was used), and a custom computer name was specified, then this same name should be used when leaving the domain with the -r option, to remove the computer. Otherwise the "net ads leave" command will try to use the hostname and won't find it in AD:

# joining with a custom name of GG, whereas hostname is g-adclient1:
root@g-adclient1:~# realm -v join ad1.example.com --client-software=winbind --computer-name=GG
 * Resolving: _ldap._tcp.ad1.example.com
 * Performing LDAP DSE lookup on: 10.51.0.5
 * Successfully discovered: ad1.example.com
 * Unconditionally checking packages
 * Resolving required packages
 * Joining using a manual netbios name: GG
 * LANG=C LOGNAME=root KRB5CCNAME=/var/cache/realmd/realm-ad-kerberos-8GVPQ0 /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.6BYEQ0 -k ads join ad1.example.com
DNS update failed: NT_STATUS_INVALID_PARAMETER
Using short domain name -- AD1
Joined 'GG' to dns domain 'ad1.example.com'
No DNS domain configured for gg. Unable to perform DNS Update.
 * LANG=C LOGNAME=root KRB5CCNAME=/var/cache/realmd/realm-ad-kerberos-8GVPQ0 /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.6BYEQ0 -k ads keytab create
 * /usr/sbin/update-rc.d winbind enable
 * /usr/sbin/service winbind restart
 * Successfully enrolled machine in realm

Computer entry created with the name GG:
root@g-adclient1:~# ldapsearch '(|(cn=GG)(cn=G-ADCLIENT1))' dn
dn: CN=GG,CN=Computers,DC=ad1,DC=example,DC=com

Leaving fails to find the computer, as it looks for g-adclient1:
root@g-adclient1:~# realm -v leave ad1.example.com --client-software=winbind -r
Password for Administrator:
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.JRDKQ0 -U Administrator ads leave
Enter Administrator's password:Host account for g-adclient1 does not exist.

Failed to leave domain: failed to leave realm: No such object
 ! Leaving the domain ad1.example.com failed
 * Removing entries from keytab for realm
 * Updating smb.conf file
 * /usr/sbin/update-rc.d winbind disable
 * /usr/sbin/service winbind stop
 * Successfully unenrolled machine from realm

root@g-adclient1:~# ldapsearch '(|(cn=GG)(cn=G-ADCLIENT1))' dn
dn: CN=GG,CN=Computers,DC=ad1,DC=example,DC=com

Related branches

summary: - Use correct netbios name when leaving a domain
+ Use correct netbios name when leaving a domain joined with net ads
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.3 KiB)

This bug was fixed in the package realmd - 0.16.3-3ubuntu1

---------------
realmd (0.16.3-3ubuntu1) groovy; urgency=medium

  * d/p/0001-LDAP-don-t-close-LDAP-socket-twice.patch: don't close LDAP
    socket twice.
  * d/p/0001-Fix-man-page-reference-in-systemd-service-file.patch: the
    manpage is realm(8), not realmd(8)
  * d/p/0001-Use-current-idmap-options-for-smb.conf.patch: use the
    idmap options in smb.conf for modern versions of samba (LP: #1894153)
  * d/p/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch: find
    NetBIOS name in keytab while leaving the domain (LP: #1894340)
  * d/p/0001-Fix-issues-found-by-Coverity.patch: fix issues found by
    Coverity
  * d/p/0002-Change-qualified-names-default-for-IPA.patch: change
    qualified names default for IPA
  * d/p/0003-discover-try-to-get-domain-name-from-hostname.patch: if
    there is no domain name returned by DHCP check if the hostname
    contains a domain part and use this to discover a realm.
  * d/p/0001-IPA-do-not-call-sssd-enable-logins.patch: IPA: do not call
    sssd-enable-logins
  * d/p/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch:
    install the latest version of a package when resolving packages with
    PackageKit
  * d/p/0001-doc-make-sure-cross-reference-ids-are-predictable.patch: make
    sure cross-reference ids are predictable
  * d/p/0002-tools-remove-duplicated-va_start.patch: remove duplicated
    va_start()
  * d/p/0003-service-remove-dead-code.patch: remove unused code
  * d/p/0004-service-check-return-value-of-fcntl.patch: check return
    value of fcntl()
  * d/p/0005-service-avoid-dereference-of-a-null-pointer.patch: avoid
    dereference of a null pointer
  * d/p/0006-service-avoid-dereferencing-a-NULL-pointer.patch: avoid
    dereferencing a NULL pointer
  * d/p/0001-Add-missing-xsl-file-to-Makefile.am.patch: add missing xsl
    file to Makefile.am
  * d/p/0002-configure-do-not-inherit-DISTRO-from-the-environment.patch:
    do not inherit DISTRO from the environment
  * d/p/0003-doc-extend-user-principal-section.patch: doc: extend
    user-principal section
  * d/p/0004-doc-fix-discover-name-only.patch: doc: fix discover
    name-only parameter
  * d/p/0005-doc-add-see-also-to-man-pages.patch: doc: add see also to
    man pages
  * d/p/0006-doc-extend-description-of-config-handling.patch: doc: extend
    description of config handling
  * d/p/0007-service-use-kerberos-method-secrets-and-keytab.patch: when
    using Samba with Winbind, set "kerberos method" to "secrets and keytab"
  * d/p/install-libnss-winbind.patch: install libnss-winbind when needed
    (LP: #1894150)
  * d/p/dont-add-services-line.patch: in Ubuntu and Debian, the sssd_*
    services are socket activated and don't need a "services" line in
    sssd.conf (LP: #1880157)
  * d/p/0004-service-use-additional-dns-hostnames-with-net-ads-jo.patch:
    when using samba to join a domain, and the client is from a different
    domain, also set "additional dns hostnames"
  * d/p/0002-Use-startTLS-with-FreeIPA.patch: attempt StartTLS first
    when talking to FreeIPA
  * d/p/0003-service-use-net-ads-join-with-k-for-user-join-as-wel.patch:
    when joining using samba, ...

Read more...

Changed in realmd (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.