Messages

1

Installation and Upgrades / Re: Persistent Default Gateway

« on: August 12, 2013, 02:07:44 pm »

Go to network -> Gateways and add your default gateway there

2

Installation and Upgrades / Re: Get ride of that eth3 that breaks my zentyal gateway feature

« on: June 17, 2013, 04:53:14 pm »

I had this problem once when I had a failure in the ethernet module of my server's motherboard. what I did was to comment out the part that refers to said network interface in /etc/udev/rules.d/70-persistent-net.rules

It worked ok for me because I added other network cards that took over the names of the previously configured cards.

Also, I think before setting eth3 to unused in the web UI, it would be good to set it with a static ip that is not used in any other interface.

3

Installation and Upgrades / Re: Local Subnet prioritizing in DNS

« on: June 14, 2013, 02:33:14 pm »

Ok.. lets forget about the DHCP stuff

I'm just saying the default behaviour for MS servers is to prioritize the dns answes, and that windows workstations expect this behaviour:

http://technet.microsoft.com/en-us/library/cc787373(v=ws.10).aspx

I set up my aditional domain controler exactly as described in this document:

http://trac.zentyal.org/wiki/Documentation/Community/Document/MultipleZentyal

The only difference is that I had 3 local networks connected to a separate ethernet port in each server. Maybe you can try to set this config up and see for yourself. Any device that is connected in paralel to more than one local network and is set to be reached by a single name would face that same problem.

Maybe the problem is with windows 8, but I just know that before adding those 2 lines of configuration, the users many times had to wait a very very long time to login, and also to get an authentication window when trying to run an installation with elevated privileges.

4

Installation and Upgrades / Re: allowing local DNS to resolve across subnets

« on: June 13, 2013, 08:41:34 pm »

In DHCP options for each local interface, under WINS server: select local zentyal. this way you can reach other machines by name across your router.

5

Installation and Upgrades / Re: Local Subnet prioritizing in DNS

« on: June 13, 2013, 08:30:18 pm »

what is preventing you to reach 192.168.38.22

I don't know. I just know I couldn't reach it, and instead of creating NAT rules in the firewall, I thought it was easier to just have the clients try to reach the correct interface.

do you need IP address for your domain ?

Ip resolution for the domain is needed for Windows DC

default gateway that is now down, they will not access internet

then it is just a matter of the clients clicking on "repair my connection", but this is only my thought... maybe it wouldn't be appliable to other situations, but I think it is easier to configure than a cluster, and then one can keep domain, internet and routing across networks up if the main server is down. More than one time I had my main server stop working and all the employees had to go home because they couldn't access the files in the server. this way they could have read only access to the backup files kept in the second server (updated nightly), work locally and then feed them to the main server when it is back.

6

Installation and Upgrades / Re: Local Subnet prioritizing in DNS

« on: June 13, 2013, 06:03:19 pm »

The thing is if my machine has IP 192.168.37.19 and default gateway 192.168.37.1 and the first server has IPs (192.168.37.1, 192.168.38.1, 192.168.39.1) and the second server has IPs (192.168.37.22, 192.168.38.22, 192.168.39.22), if the nslookup results a list that has the ip 192.168.38.22 as the first element, when I ping that address, the client is in a different network than the destination so the connection will fail.

Even if one could reach the other machine through the router, the behaviour that I'm proposing would lower cross network connections, improving the overall bandwidth and reducing the load on the router.

As for DHCP, If I setup the 2 servers to answer DHCP requests, with the only difference being that each server points at itself as the default router, about half the machines will connect to each server and use it as a router. if one of the server goes down, the other will take over all the DHCP requests and act as a router for all the clients. Mail and jabber may stop working, but still the clients won't lose all network connectivity. That can be configured with split DHCP scopes, but it is a PITA to do by hand and limits the number of clients in a single network.

7

Installation and Upgrades / Local Subnet prioritizing in DNS

« on: June 13, 2013, 03:05:14 pm »

I have my zentyal server configured to act as a central point for my 3 internal networks as a domain controler and gateway with load balance for 2 internet connections. In order to achieve a higher availability, I set up another server in paralel to the first one, and configured it as an aditional domain controller and also as a router as illustrated below:

Code: [Select]

                       192.168.0.1           192.168.0.2
                         _______              _______
                        |       |            |       |
                        | WAN 1 |            | WAN 2 |
                        |_______|            |_______|
       _____________________|____________________|______________________
      | 192.168.0.3          Network A (external)            192.168.0.4|
 _____|______                                                      _____|______
|            | 192.168.37.1  Network B (internal)  192.168.37.22  |            |
|            |----------------------------------------------------|            |
|            | 192.168.38.1  Network C (internal)  192.168.38.22  |            |
|  Server 1  |----------------------------------------------------|  Server 2  |
|            | 192.168.39.1  Network D (internal)  192.168.39.22  |            |
|            |----------------------------------------------------|            |
|____________|                                                    |____________|

My problem is that when I set it up as an aditional DC, zentyal adds the records for the 3 network interfaces of server 2 in the DNS records of server 1. That would work just fine if I had only one internal network, but having 3 of them, when I try to resolve mydomain.lan from any of the internal networks, I receive the 6 ip addresses in an order that changes at random. in that way, when I try to ping mydomain.lan from the internal nets, many times it will try to ping the interface of server2 that is in another net, and so it will fail since server1 is set as the default router.

Here is what I see from the client side:

Code: [Select]

C:\>nslookup mydomain.lan
Servidor:  seteh.mydomain.lan
Address:  192.168.37.1

Nome:    mydomain.lan
Addresses:  ::1
          192.168.38.1
          192.168.39.1
          192.168.39.22
          192.168.38.22
          192.168.37.22
          192.168.37.1


C:\>ipconfig /flushdns

Configuração de IP do Windows

Liberação do Cache do DNS Resolver bem-sucedida.

C:\>ping mydomain.lan

Disparando mydomain.lan [192.168.38.1] com 32 bytes de dados:
Resposta de 192.168.38.1: bytes=32 tempo<1ms TTL=64
Resposta de 192.168.38.1: bytes=32 tempo<1ms TTL=64
Resposta de 192.168.38.1: bytes=32 tempo<1ms TTL=64
Resposta de 192.168.38.1: bytes=32 tempo<1ms TTL=64

Estatísticas do Ping para 192.168.38.1:
    Pacotes: Enviados = 4, Recebidos = 4, Perdidos = 0 (0% de
             perda),
Aproximar um número redondo de vezes em milissegundos:
    Mínimo = 0ms, Máximo = 0ms, Média = 0ms

C:\>ipconfig /flushdns

Configuração de IP do Windows

Liberação do Cache do DNS Resolver bem-sucedida.

C:\>ping mydomain.lan

Disparando mydomain.lan [192.168.39.22] com 32 bytes de dados:
Esgotado o tempo limite do pedido.
Esgotado o tempo limite do pedido.
Esgotado o tempo limite do pedido.
Esgotado o tempo limite do pedido.

Estatísticas do Ping para 192.168.39.22:
    Pacotes: Enviados = 4, Recebidos = 0, Perdidos = 4 (100% de
             perda),

That resulted in the clients taking a very long time to autenticate during login, trying to apply GPOs and also when trying to run some program as administrator.

Windows implements automatically Local network prioritizing, so that when resolving an address, the IP addresses that are in the same network as the client are always the first in the list. With bind, we have to set up The sortlist Statement (http://www.net.cmu.edu/groups/netdev/docs/bind9/Bv9ARM.ch06.html#the_sortlist_statement) in the configurations for the server to behave like that.

Here is what I added in my config to make it work apropriately (I think it would be very easy for it to be implemented by default in zen. or maybe through a checkbox in DHCP configs asking if they should prioritize local networks or round robin the adresses):

Code: [Select]

me@server1:~$ cat /etc/zentyal/stubs/dns/named.conf.options.mas
<%args>
  @forwarders
  $keytabPath => undef
</%args>
options {
    directory "/var/cache/bind";
    sortlist {
        {192.168.37/24; {192.168.37/24; };};
        {192.168.38/24; {192.168.38/24; };};
        {192.168.39/24; {192.168.39/24; };};
    };
    // If there is a firewall between you and nameservers you want
    // to talk to, you might need to uncomment the query-source
    // directive below.  Previous versions of BIND always asked
    // questions using port 53, but BIND 8.1 and later use an unprivileged
    // port by default.

    //query-source address * port 53;
    //transfer-source * port 53;
    //notify-source * port 53;

% if ( @forwarders > 0 ) {
    // If your ISP provided one or more IP addresses for stable
    // nameservers, you probably want to use them as forwarders.
    forward first;
    forwarders {
%   foreach my $forwarder (@forwarders) {
        <% $forwarder %>;
%   }
    };
% }

% if (defined $keytabPath) {
    tkey-gssapi-keytab "<% $keytabPath %>";
% }

    auth-nxdomain no;    # conform to RFC1035

    allow-query { any; };
    allow-recursion { trusted; };
    allow-query-cache { trusted; };
    allow-transfer { internal-local-nets; };
};

I think that the absense of this configuration would also be a problem in a single server that is configured to block communications across different LANs.

Also, it would be great to be able to set up 2 zentyal servers with a DHCP shared scope, so that a true redundant server can be set up.

8

Installation and Upgrades / Re: Samba4 idmap

« on: January 11, 2013, 12:17:55 pm »

What I did was this:

Code: [Select]

root@seteh:/# id -u alice
2001
root@seteh:/# id -u bob
2003
then in windows I verified that alice has a SID ending with -1134 and bob has a SID ending with -1135

then I edit samba's idmap:

Code: [Select]

ldbedit -e mcedit -H /var/lib/samba/private/idmap.ldb

and changed

Code: [Select]

# record 66
dn: CN-S-1-5-21-#########-#########-#########-1134
cn: S-1-5-21-#########-#########-#########-1134
objectClass: sidMap
objectSid: S-1-5-21-#########-#########-#########-1134
type: ID_Type_UID
xidNumber: 2003
distinguishedName: CN=S-1-5-21-#########-#########-#########-1134
to:

Code: [Select]

# record 66
dn: CN-S-1-5-21-#########-#########-#########-1134
cn: S-1-5-21-#########-#########-#########-1134
objectClass: sidMap
objectSid: S-1-5-21-#########-#########-#########-1134
type: ID_Type_UID
xidNumber: 2001
distinguishedName: CN=S-1-5-21-#########-#########-#########-1134
And commited the changes...
Now I can change alice's homefolder ownership back to alice and she can read the files ok, but when she creates a new file inside her home folder, the owner of the file is bob

9

Installation and Upgrades / Samba4 idmap

« on: January 10, 2013, 08:29:05 pm »

Hello!

I got myself quite a big problem with the file sharing module:
During Christmas and new year holidays I shut down my server, and when I return I found out that the integrated ethernet broke in some way. after installing a new ethernet card, the workstations didn't recognize the server to authenticate domain users, and when I tried to remove them from the domain and add again they wouldn't find the domain specified... So I read in a topic here in the forum that a guy removed the users and groups module and reinstalled it. that's what I did.

After that I could add the computers to the domain again, but I encountered another problem: some of the users had mixed up the UIDs with the SIDs and also the groups are kind of crazy. (when I log in as user alice and create a file, it creates as uses bob being the owner, and that makes the workstations crazy because they cannot read back what they write in the logon folders)

So I had the idea to fix the UIDs in idmap.ldb... but that didn't change much of the problem for me. so I would like to know if there is another file that I can fiddle to correct the UID / GID / SID associations.

Thanks a lot

10

Installation and Upgrades / zentyal.log gets a lot of garbage

« on: October 15, 2012, 04:27:56 pm »

I've been having some problems with my fresh instalations of zentyal 3, and trying to diagnose what's wrong gets really hard because the file /var/log/zentyal/zentyal.log is getting a lot of garbage dumped into it, making it unreadable (the last one grew to 11GB in a couple of days!) most of it is apparently some pearl script that gets dumped over and over. Here are the last 100 lines of my zentyal.log:

Code: [Select]

        </tr>

        <tr>
          <td>INTERNAL_IPS</td>
          <td class="code"><pre>()</pre></td>
        </tr>

        <tr>
          <td>STATIC_URL</td>
          <td class="code"><pre>&#39;/static/&#39;</pre></td>
        </tr>

        <tr>
          <td>EMAIL_PORT</td>
          <td class="code"><pre>25</pre></td>
        </tr>

        <tr>
          <td>SHORT_DATETIME_FORMAT</td>
          <td class="code"><pre>&#39;m/d/Y P&#39;</pre></td>
        </tr>

        <tr>
          <td>ABSOLUTE_URL_OVERRIDES</td>
          <td class="code"><pre>{}</pre></td>
        </tr>

        <tr>
          <td>DATABASE_OPTIONS</td>
          <td class="code"><pre>{}</pre></td>
        </tr>

        <tr>
          <td>CACHE_MIDDLEWARE_SECONDS</td>
          <td class="code"><pre>600</pre></td>
        </tr>

        <tr>
          <td>BANNED_IPS</td>
          <td class="code"><pre>()</pre></td>
        </tr>

        <tr>
          <td>ANONYMOUS_USER_ID</td>
          <td class="code"><pre>-1</pre></td>
        </tr>

        <tr>
          <td>DATETIME_INPUT_FORMATS</td>
          <td class="code"><pre>(&#39;%Y-%m-%d %H:%M:%S&#39;,
 &#39;%Y-%m-%d %H:%M&#39;,
 &#39;%Y-%m-%d&#39;,
 &#39;%m/%d/%Y %H:%M:%S&#39;,
 &#39;%m/%d/%Y %H:%M&#39;,
 &#39;%m/%d/%Y&#39;,
 &#39;%m/%d/%y %H:%M:%S&#39;,
 &#39;%m/%d/%y %H:%M&#39;,
 &#39;%m/%d/%y&#39;)</pre></td>
        </tr>

        <tr>
          <td>DATABASE_PASSWORD</td>
          <td class="code"><pre>&#39;********************&#39;</pre></td>
        </tr>

        <tr>
          <td>COMMENTS_MODERATORS_GROUP</td>
          <td class="code"><pre>None</pre></td>
        </tr>

        <tr>
          <td>PROFANITIES_LIST</td>
          <td class="code"><pre>&#39;********************&#39;</pre></td>
        </tr>

        <tr>
          <td>EMAIL_HOST_USER</td>
          <td class="code"><pre>&#39;&#39;</pre></td>
        </tr>

        <tr>
          <td>COMMENTS_BANNED_USERS_GROUP</td>
          <td class="code"><pre>None</pre></td>
        </tr>

    </tbody>
  </table>

</div>

  <div id="explanation">
    <p>
      You're seeing this error because you have <code>DEBUG = True</code> in your
      Django settings file. Change that to <code>False</code>, and Django will
      display a standard 500 page.
    </p>
  </div>

</body>
</html>

Is that a way to stop this behaviour? It is my 5th fresh install and it happens every time.

11

Installation and Upgrades / Re: Domain name x Samba realm

« on: October 09, 2012, 09:11:45 pm »

There was a post about a clash between the internal dns in samba and the zentyal dns where the zentyal dns records need to be removed.

Strangely it gone as I posted the above link and it the thread doesn't seem to exist now.

I think That is my problem, as I configured named to log to syslog, I realized that every time samba tried to update some DNS settings it froze...

I'll try to reinstall fresh tomorrow and see if it works. That's why I'm asking which names I should use. For you it seems to be fine running the same domain for samba and DNS, but maybe I'll run samba as MBMENGENHARIA.LAN and dns as mbmengenharia.com.br

12

Installation and Upgrades / Domain name x Samba realm

« on: October 09, 2012, 07:55:33 pm »

Hello,

I've been trying the new zentyal, but I ran into a lot of problems installing it. I narrowed it down to a conflict between the DNS server and Samba. I wish there was a better explanation during instalation about what names I should and shouldn't use for a samba realm, as I had to reinstall the whole thing once after typing the full domain name for the server (fix.mbmengenharia.com.br) as a realm, and now it seems that I can't also use the same root adress (mbmengenharia.com.br) for both domain name and realm. Could someone throw me a bone and explain a bit where I should use each name? Also I think it would be a very good idea to explain better in the instalation screens.

13

Installation and Upgrades / Re: Bug with Zentyal 2.2

« on: March 22, 2012, 07:32:24 pm »

Sorry to revive this topic, but I also have the same problem that resolv.conf gets overwritten by dhclient.

In my situation, I have two isp's. one of them I'm using a router between the modem and the zentyal box, since I could never get pppoe to work properly. The other connection is DHCP.

The problem is that the name servers that the second ISP gives me don't respond to queries that go out from my first ISP. That way I cannot resolve names in my internal network, since all the machines are configured to use zentyal as DNS.

14

Installation and Upgrades / Re: pppoe failover

« on: March 21, 2012, 05:08:58 pm »

Ok.. I think this might be the problem:

Right after I connect, I can see in network->gateways the ppoe connection gateway (ppp0/xxx.xxx.xx.xx). After a few minutes it vanishes (see image attached)

Also, here are some errors from zentyal.log from moments after I reconnect to pppoe (by changing somenthing and clicking save changes)

Code: [Select]

2012/03/21 12:00:55 INFO> Service.pm:716 EBox::Module::Service::restartService - Restarting service for module: firewall
2012/03/21 12:00:59 INFO> Base.pm:250 EBox::Module::Base::__ANON__ - Saving config for module: network
2012/03/21 12:01:01 ERROR> Sudo.pm:213 EBox::Sudo::_rootError - root command set -e
/usr/share/zentyal-network/flush-fwmarks
/sbin/ip route flush table 102
/sbin/ip rule add fwmark 2/0xFF table 102
/sbin/ip rule add from 201.81.204.1 table 102
/sbin/ip rule add from 201.81.206.152 table 102
/sbin/ip route add default via 201.81.204.1 dev eth4 src 201.81.206.152 table 102
/sbin/ip route flush table 101
/sbin/ip rule add fwmark 1/0xFF table 101
/sbin/ip rule add from 189.78.154.47 table 101
/sbin/ip rule add from  table 101
/sbin/ip route add default dev ppp0 table 101
/sbin/ip rule add table main
/sbin/iptables -t mangle -A PREROUTING -m mark --mark 0/0xff -i ppp0 -j MARK --set-mark 1
/sbin/iptables -t mangle -A POSTROUTING -o ppp0 -j MARK --set-mark 1
/sbin/iptables -t mangle -A PREROUTING -m mark --mark 0/0xff -i eth4 -j MARK --set-mark 2
/sbin/iptables -t mangle -A POSTROUTING -o eth4 -j MARK --set-mark 2
/sbin/iptables -t mangle -A POSTROUTING -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/sbin/iptables -t mangle -A PREROUTING -p tcp  --destination-port 20  -i eth0 -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A PREROUTING -p tcp  --destination-port 21  -i eth0 -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A OUTPUT -p tcp  --destination-port 20  -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A OUTPUT -p tcp  --destination-port 21  -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A PREROUTING -p gre  -i eth0 -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A PREROUTING -p tcp  --destination-port 1723  -i eth0 -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A OUTPUT -p gre  -m mark --mark 0/0xff -j MARK --set-mark 1
/sbin/iptables -t mangle -A OUTPUT -p tcp  --destination-port 1723  -m mark --mark 0/0xff -j MARK --set-mark 1 failed.
Error output: Error: an inet prefix is expected rather than "table".

Command output: .
Exit value: 1
2012/03/21 12:01:01 ERROR> ppp-set-iface.pl:40 main::__ANON__ - Call to setRealPPPIface for eth1 failed

I also get a lot of those:

Code: [Select]

2012/03/21 13:46:54 INFO> Service.pm:716 EBox::Module::Service::restartService - Restarting service for module: firewall
and millions of this:

Code: [Select]

2012/03/21 13:38:01 DEBUG> Base.pm:241 EBox::RemoteServices::Base::_queryServicesNameserver - Server backup.internal.cloud.zentyal.com not found via DNS server 10.200.0.4. Reason: query timed out

15

Installation and Upgrades / pppoe failover

« on: March 21, 2012, 02:15:27 pm »

Hello,

I searched a lot and could not find a solution to my problem.

Is there a way to configure the failover in a way that when my pppoe connection stops responding, it tries to disconnect and dial again until it is successeful?