Cannot assign permissions for Active Directory users

[tareco]

Hello,

My system information:

Code:

Build: FreeNAS-8.3.1-RELEASE-x64 (r13452)
Platform: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
Memory: 990MB

I have connected FreeNAS to the Active Directory server (SBS2003) and the log seems ok:

Code:

Mar 26 10:27:49 freenas ActiveDirectory: AD_status_domain: net ads status -U Administrator
Mar 26 10:27:52 freenas ActiveDirectory: AD_status_domain: Okay

From the shell I can list users and groups in the AD:

Code:

[root@freenas] ~# wbinfo -u
FREENAS\root
administrator
guest
iusr_newserver
iwam_newserver
(etc...)

Code:

[root@freenas] ~# wbinfo -g
iis_wpg
telnetclients
wins users
(etc...)

The connection test is successful:

Code:

[root@freenas] ~# wbinfo -t
checking the trust secret for domain TEST via RPC calls succeeded

The problem is when I go to the volume permissions, I don't see the AD users or groups anywhere. The user/Group Listboxes only show local users.
I don't see anything relevant in the logs that might cause this, can someone help?

Here is the full log when I enable Active Directory:

Code:

Mar 26 10:27:22 freenas ActiveDirectory: /usr/local/bin/python /usr/local/www/freenasUI/middleware/notifier.py stop cifs
Mar 26 10:27:24 freenas notifier: Stopping dbus.
Mar 26 10:27:24 freenas avahi-daemon[22328]: Disconnected from D-Bus, exiting.
Mar 26 10:27:24 freenas notifier: dbus not running? (check /var/run/dbus/dbus.pid).
Mar 26 10:27:24 freenas notifier: Starting dbus.
Mar 26 10:27:24 freenas notifier: Stopping avahi-daemon.
Mar 26 10:27:24 freenas notifier: Failed to kill daemon: No such file or directory
Mar 26 10:27:24 freenas notifier: Stopping avahi-daemon.
Mar 26 10:27:24 freenas notifier: Failed to kill daemon: No such file or directory
Mar 26 10:27:24 freenas notifier: Starting avahi-daemon.
Mar 26 10:27:24 freenas avahi-daemon[23536]: WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Mar 26 10:27:24 freenas notifier: winbindd not running? (check /var/run/samba/winbindd.pid).
Mar 26 10:27:24 freenas notifier: Stopping smbd.
Mar 26 10:27:24 freenas notifier: Stopping nmbd.
Mar 26 10:27:24 freenas notifier: Waiting for PIDS: 23246.
Mar 26 10:27:24 freenas notifier: False
Mar 26 10:27:24 freenas ActiveDirectory: /usr/sbin/service ix-kerberos quietstart
Mar 26 10:27:24 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:24 freenas ActiveDirectory: generate_krb5_conf: krbhost=adserver.test.local, kpwdhost=adserver.test.local, domainname=test.local
Mar 26 10:27:24 freenas ActiveDirectory: /usr/sbin/service ix-nsswitch quietstart
Mar 26 10:27:24 freenas ActiveDirectory: /usr/sbin/service ix-pam quietstart
Mar 26 10:27:24 freenas ActiveDirectory: /usr/sbin/service ix-kinit quietstart
Mar 26 10:27:24 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:24 freenas ActiveDirectory: kerberos_start: kinit --password-file=/tmp/tmp.Pqr16STf Administrator@TEST.LOCAL
Mar 26 10:27:24 freenas ActiveDirectory: kerberos_start: Successful
Mar 26 10:27:35 freenas ActiveDirectory: /usr/sbin/service ix-kinit status
Mar 26 10:27:35 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:35 freenas ActiveDirectory: kerberos_status: klist -l | grep -q ^Administrator@TEST.LOCAL
Mar 26 10:27:35 freenas ActiveDirectory: kerberos_status: Successful
Mar 26 10:27:35 freenas ActiveDirectory: /usr/sbin/service ix-samba quietstart
Mar 26 10:27:35 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:35 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: checking testparm issues
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: Load smb config files from /usr/local/etc/smb.conf
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: max_open_files: increasing sysctl_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: rlimit_max: increasing rlimit_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap uid" option is deprecated
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap gid" option is deprecated
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: Loaded services file OK.
Mar 26 10:27:35 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The setting 'security=ads' should NOT be combined with the 'password server' parameter.
Mar 26 10:27:36 freenas ActiveDirectory: generate_smb_config: testparm: (by default Samba will discover the correct DC to contact automatically).
Mar 26 10:27:36 freenas ActiveDirectory: generate_smb_config: testparm: Server role: ROLE_DOMAIN_MEMBER
Mar 26 10:27:36 freenas ActiveDirectory: generate_smb_config: testparm: Press enter to see a dump of your service definitions
Mar 26 10:27:36 freenas ActiveDirectory: /usr/local/bin/python /usr/local/www/freenasUI/middleware/notifier.py start cifs
Mar 26 10:27:37 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:37 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: checking testparm issues
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: Load smb config files from /usr/local/etc/smb.conf
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: max_open_files: increasing sysctl_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: rlimit_max: increasing rlimit_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap uid" option is deprecated
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap gid" option is deprecated
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: Loaded services file OK.
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The setting 'security=ads' should NOT be combined with the 'password server' parameter.
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: (by default Samba will discover the correct DC to contact automatically).
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: Server role: ROLE_DOMAIN_MEMBER
Mar 26 10:27:37 freenas ActiveDirectory: generate_smb_config: testparm: Press enter to see a dump of your service definitions
Mar 26 10:27:37 freenas notifier: dbus already running? (pid=23511).
Mar 26 10:27:37 freenas notifier: Starting avahi-daemon.
Mar 26 10:27:37 freenas notifier: Daemon already running on PID 23536
Mar 26 10:27:37 freenas notifier: Removing stale Samba tdb files: ....... done
Mar 26 10:27:37 freenas notifier: Starting nmbd.
Mar 26 10:27:37 freenas notifier: Starting smbd.
Mar 26 10:27:37 freenas notifier: Starting winbindd.
Mar 26 10:27:37 freenas notifier: True
Mar 26 10:27:37 freenas ActiveDirectory: /usr/sbin/service ix-activedirectory quietstart
Mar 26 10:27:37 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:37 freenas ActiveDirectory: activedirectory_start: trying to join domain
Mar 26 10:27:37 freenas ActiveDirectory: AD_join_domain: net ads join -U Administrator
Mar 26 10:27:38 freenas notifier: Using short domain name -- TEST
Mar 26 10:27:38 freenas notifier: Joined 'freenas' to dns domain 'Test.local'
Mar 26 10:27:38 freenas ActiveDirectory: AD_join_domain: Successful
Mar 26 10:27:39 freenas ActiveDirectory: /usr/sbin/service ix-activedirectory status
Mar 26 10:27:39 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:39 freenas ActiveDirectory: activedirectory_status: checking status
Mar 26 10:27:39 freenas ActiveDirectory: AD_status_domain: net ads status -U Administrator
Mar 26 10:27:43 freenas ActiveDirectory: AD_status_domain: Okay
Mar 26 10:27:43 freenas ActiveDirectory: /usr/local/bin/python /usr/local/www/freenasUI/middleware/notifier.py stop cifs
Mar 26 10:27:44 freenas notifier: Stopping dbus.
Mar 26 10:27:44 freenas avahi-daemon[23536]: Disconnected from D-Bus, exiting.
Mar 26 10:27:44 freenas notifier: dbus not running? (check /var/run/dbus/dbus.pid).
Mar 26 10:27:44 freenas notifier: Starting dbus.
Mar 26 10:27:44 freenas notifier: Stopping avahi-daemon.
Mar 26 10:27:44 freenas notifier: Failed to kill daemon: No such file or directory
Mar 26 10:27:44 freenas notifier: Stopping avahi-daemon.
Mar 26 10:27:44 freenas notifier: Failed to kill daemon: No such file or directory
Mar 26 10:27:44 freenas notifier: Starting avahi-daemon.
Mar 26 10:27:44 freenas avahi-daemon[26100]: WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Mar 26 10:27:44 freenas notifier: winbindd not running? (check /var/run/samba/winbindd.pid).
Mar 26 10:27:44 freenas notifier: Stopping smbd.
Mar 26 10:27:44 freenas notifier: Stopping nmbd.
Mar 26 10:27:44 freenas notifier: Waiting for PIDS: 25466.
Mar 26 10:27:44 freenas notifier: False
Mar 26 10:27:44 freenas ActiveDirectory: /usr/local/bin/python /usr/local/www/freenasUI/middleware/notifier.py start cifs
Mar 26 10:27:46 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:46 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: checking testparm issues
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: Load smb config files from /usr/local/etc/smb.conf
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: max_open_files: increasing sysctl_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: rlimit_max: increasing rlimit_max (11095) to minimum Windows limit (16384)
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap uid" option is deprecated
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The "idmap gid" option is deprecated
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: Loaded services file OK.
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: WARNING: The setting 'security=ads' should NOT be combined with the 'password server' parameter.
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: (by default Samba will discover the correct DC to contact automatically).
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: Server role: ROLE_DOMAIN_MEMBER
Mar 26 10:27:46 freenas ActiveDirectory: generate_smb_config: testparm: Press enter to see a dump of your service definitions
Mar 26 10:27:46 freenas notifier: dbus already running? (pid=26075).
Mar 26 10:27:46 freenas notifier: Starting avahi-daemon.
Mar 26 10:27:46 freenas notifier: Daemon already running on PID 26100
Mar 26 10:27:46 freenas notifier: Removing stale Samba tdb files: ...... done
Mar 26 10:27:46 freenas notifier: Starting nmbd.
Mar 26 10:27:46 freenas notifier: Starting smbd.
Mar 26 10:27:46 freenas notifier: Starting winbindd.
Mar 26 10:27:46 freenas notifier: True
Mar 26 10:27:46 freenas ActiveDirectory: /usr/sbin/service ix-cache quietstart &
Mar 26 10:27:48 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:49 freenas ActiveDirectory: kerberos_status: klist -l | grep -q ^Administrator@TEST.LOCAL
Mar 26 10:27:49 freenas ActiveDirectory: kerberos_status: Successful
Mar 26 10:27:49 freenas ActiveDirectory: AD_init: config exists, loading values from /etc/ActiveDirectory/config
Mar 26 10:27:49 freenas ActiveDirectory: activedirectory_status: checking status
Mar 26 10:27:49 freenas ActiveDirectory: AD_status_domain: net ads status -U Administrator
Mar 26 10:27:52 freenas ActiveDirectory: AD_status_domain: Okay

 

[James]

I think it may be RAM related. From the Hardware Recommendations of the Guide:
If you use Active Directory with FreeNAS®, add an additional 2 GB of RAM for winbind's internal cache.

 

[cyberjock]

Yeah.. you have WAY too little RAM.

 

[tareco]

Thanks for the tip, I am going to try that. Nevertheless, there should be an error somewhere... And underneath, the command line tools work...

 

[jschaller]

I am using FreeNAS-8.3.0-RELEASE-p1-x64 (r12825) on a maching with 16Gb RAM so that is not my particular problem. I am seeing the same issue. Everything using wbinfo at the shell looks fine. All my AD users, groups and wbinfo -t. When I go into Storage/Volumes/Permissions I only see the FreeNAS users and groups.

Any thought on this? This is my first attempt at using FreeNAS and I'm struggling with the permissions issue.

Thanks,

John

 

[tareco]

I can confirm it is not RAM related. I upgraded the system to 4Gb RAM and I still have the issue. This is really a blocker... :(

 

[tareco]

Bump.

Is there anything I can do to debug where the problem lies?

 

[ihlavaty.cz]

Hi, same problems with me. I am trying to use AD/LDAP with MS SBS 2003 with no success for more than two days. I tried to increase AD timeout which has not been mentioned here yet ( http://forums.freenas.org/showthread.php?11602-Freenas-can-t-join-AD-AD_status_domain-Not-okay ), but no success too. Does anyone have any hint ?

I have found a workaround by setting permission using cli:

Code:

chown “DOMAIN\Domain User1″:”DOMAIN\domain admins” /mnt/freenas/home/domainuser1

It works great, but you cannot use gui any more, because it keeps saying that file owner is root, cli output of "ls -l" is like this: drwxr-xr-x+ 2 MYDOMAIN\me wheel 4 Apr 9 16:11 STORAGE/
see http://blog.kernbits.com/2012/freenas-active-directory/

 

[tareco]

This is my first experience with FreeNAS and I have to say I am not very impressed so far, considering my hardware spec.
Active Directory does not work, wich is a blocking issue for those who require storage access managed by the domain controller.
And I am finding everything very very slow! It starts with the boot time, over 15 minutes. It doesn't matter if starting from USB or HDD.
I see lots of time wasted, for example dhclient is running on unsed and disconnected interfaces, dhclient on unused usb ports also takes a lot of time.
Then the web interface, the minute I start using it, python processes taking over the CPU appear resulting in load rising above 2 for some minutes.
I see periodic high cpu usage in the charts, but this is a fresh install - not a single volume created yet.
I will give it another try with the 32 bit version just in case it's related with the architecture, but I feel I'll be wasting my time.
Is anyone else having the same experience? I was expecting a stable FreeNAS, but this release is very far from that, at least for me.

Refreshing the hardware specs:

Build: FreeNAS-8.3.1-RELEASE-p1-x64 (r12686+99c3e76)
Platform: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
Memory: 4006MB
Load Average: 0.99, 1.19, 1.15 ----> while doing mostly nothing, not a single volume created yet

Is it that bad for FreeNAS?
(yes, I realize I could have a server mobo with a xeon, ecc, 32GB Ram, etc - but for common fileserving tasks, I feel the 6420 and 4GRam should be enough for a simple raid3 volume)

To finish, something out of the process list:
root 13557 90.4 0.7 74148 30072 ?? Rs 3:18PM 0:20.87 /usr/local/bin/python /usr/local/www/freenasUI/tools/autosnap.py

I presume autosnap is responsible for snapshoting the volumes. Bu why is it running and consuming so much CPU without any volumes configured, or snapshot jobs?

 

[cyberjock]

I upgraded to the new version last night and I have had no problems at all.. so far.

If it's taking 15 minutes to bootup then something is terribly wrong. Either bad hardware, bad configuration, or something.

I realize you said that you haven't created a single volume yet, but considering you don't even have the minimum RAM required per 1.4 of the manual, I don't think you can complain about performance. 1.4 tells you that you can expect the system to be unstable and perform poorly with less than the recommended RAM. Despite that, if you have no volumes created yet and its taking 15 minutes to boot up not having enough RAM isn't your problem. Something else is wrong. Your hardware may not be compatible.

I will tell you that if Active Directory settings aren't properly setup it can hang for long periods of time at bootup while it tries to connect to the domain.

 

[tareco]

Thank you for your pointers.
About the RAM, I have upgraded it to 4GB (I had only 1GB initially).
I just tried the same FreeNAS version in Virtualbox with 1GB Ram and it boots in less than 1 minute.
Active Directory still doesn't work... everything looks good in the logs and in the shell I can list the AD users and groups, but cannot assign to volumes from the Web interface.
Load in this system is normal ~ 0.2

 

[tareco]

The journey continues..
It seems my Intel mobo had a very old BIOS. I have upgrade to the most recent and the system load "while doing nothing" is near 0.0 so that's solved.
But I still cannot put Active Directory to work.
Everything is properly configured, I am sure of it. I have other systems connected to the same AD which work ok.
What can I do to debug this? Why can't I see AD users in the user select box for volume permissions?

 

[tareco]

Bump.

Shal I raise a defect for Active Directory?
I simply can't put it to work and I don't know where to look deep in FreeNAS to debug this.
Commands in the shell work, but the GUI does not show any AD users. It is a bug to me.

Thanks

 

[tareco]

Hi.

I have filled a bug report on this issue and I have moved forward with another solution for now.
I feel FreeNas has everyting to be a great solution, but the lack of AD makes it unsuable for me.
I'll keep an eye open on this :)

Thank you for all your support.

 

[eibbor]

When I started to use FreeNAS (v8.3.0) - initially I had exactly the same issue.

when I ran wbinfo -u/-g, I could see all applicable AD objects​

However when trying to set storage permissions - I could only see the local users/groups in the drop down. A few days later I tried again...and could see them!! It was working perfectly; I made a GPO to map the CIFS storage, and anyone part of the right group who logged into Windows could read/write to the drive. After upgrading to v8.3.1-p1, everything was still working as it should.

I recently changed domains however...and now I'm back where I was :(
Even after making the necessary changes, wbinfo -u/-g pulls the right info...but now again can't select them in the permissions drop down.

I have no idea if I did something last time that made it work...but FreeNAS PLEASE offer a solution :)

 

[adrian7]

Same problem with 8.3.1.

leave capture

As you can see in the terminal are not in the list

- - - Updated - - -




Same problem with 8.3.1.

leave capture

As you can see in the terminal are not in the list

 

[dcfnet]

All I can say is "me too". I have AD Integration on an 8.3.0 FREENAS box. But, no go on 8.3.1-p2
I get proper returns from wbinfo -u, -g, -t
But no user/group listing in the GUI.
If I try to force it through the CLI using:
chown “DOMAIN\Domain User1″:”DOMAIN\domain users” /mnt/freenas/home/domainuser1
I get: chown: DOMAIN\domain users: Invalid argument

 

[dcfnet]

I toggled "verbose logging" in the AD Service config screen and Viola!

 

[OmnipotentOwl]

I'm still having this issue with the bug and have since i built my freenas system. I've managed to get it to attach to AD but as above the user groups do not show up in the GUI. Looking through the /var/log/messages i can see the following errors when the GUI tries to access the AD users or groups.

Code:

manage.py: [common.freenasusers:329] FreeNAS Directory Users could not be retrieved: 'NoneType' object has no attribute '__getitem__'
manage.py: [common.freenasusers:212] FreeNAS Directory Groups could not be retrieved: 'NoneType' object has no attribute '__getitem__'
manage.py: [common.freenasusers:329] FreeNAS Directory Users could not be retrieved: 'NoneType' object has no attribute '__getitem__'
manage.py: [common.freenasusers:212] FreeNAS Directory Groups could not be retrieved: 'NoneType' object has no attribute '__getitem__'
manage.py: [common.freenasusers:329] FreeNAS Directory Users could not be retrieved: 'NoneType' object has no attribute '__getitem__'
manage.py: [common.freenasusers:212] FreeNAS Directory Groups could not be retrieved: 'NoneType' object has no attribute '__getitem__'

Also to even get freenas to talk to AD i had to define several auxiliary parameters in the CIFS section because the AD configuration does not possess the ability to include custom parameters for connecting. This seems like a flaw in the design of the AD web config as it prevents AD from starting properly in most cases.

Code:

client ldap sasl wrapping = sign
server signing = mandatory
client signing = mandatory
ntlm auth = No
lanman auth = No
client ntlmv2 auth = yes
disable netbios = yes
smb ports = 445

System: FreeNAS-8.3.1-RELEASE-x64 (r13452)
Ram: 12263MB
AD Server: Windows Server 2008 R2 SP1

 

[mitchell]

I toggled "verbose logging" in the AD Service config screen and Viola!

to clarify/expand

its sorcery, but turning verbose logging on in the active directory service menu should give you all your users and groups.

it worked for me, and it worked for someone else, so i am going to abandon logic, reason, and science, this will work for you because it worked for me. if it doesnt work for you, we need a duck and a scale, going further off the path of sanity, you are probably a witch and we need to make sure you aren't made of wood. why this works? no idea. thats for google to tell me when im done writing this. but for kicks and giggles i tried it, because it already didn't work, what could possibly go wrong... right?

anyhow. if you turn on verbose logging you should get your users and groups (your logs may or may not be more verbose i haven't checked yet, probably wont until something else breaks), at least i did, and i am guessing dcfnet did as well. i am guessing "verbose logging" is code for "this has nothing to do with logs, and everything to do with me working".

again, i dont know why, and i probably wont be back to explain it after i google an answer out of the internet, but it worked for me, turning verbose logging on in the active directory services menu resolved this issue.

to get to the verbose logging toggle you may need to select advanced options. turn it on.

all praises to the finder of the workaround, paraphraser of results, dcfnet.

freenas 8.3.1
some more bold text
now some italics

stopped working.