ERROR: CIFS server communication error: Memory allocation error (both may be "None") upon establishing trust
Hi all,
I have been trying to set up one-way trust for quite a while. I thought I have everything sorted out but when I tried to move from test environment to production, I received error below upon trying to set up trust with ipa trust add:
ipa trust-add --type=ad my.domain.com --admin adminaccount --password
ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None")
Googling returned some results that suggested upgrading samba and freeipa versions. I did so and now I am using: freeipa - 4.5.3-1.fc26 samba - 2:4.6.7-0.fc26
This however didn't change the result.
What can be important here is that my.domain.com is a child domain of domain.com in terms of AD (it is a separate domain controller).
Can you please advise how to fix it?
On to, 07 syys 2017, Bart J via FreeIPA-users wrote:
Hi all,
I have been trying to set up one-way trust for quite a while. I thought I have everything sorted out but when I tried to move from test environment to production, I received error below upon trying to set up trust with ipa trust add:
ipa trust-add --type=ad my.domain.com --admin adminaccount --password
ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None")
Googling returned some results that suggested upgrading samba and freeipa versions. I did so and now I am using: freeipa - 4.5.3-1.fc26 samba - 2:4.6.7-0.fc26
This however didn't change the result.
What can be important here is that my.domain.com is a child domain of domain.com in terms of AD (it is a separate domain controller).
This is not going to work without --external=true. Forest trust is always established to forest root domain.
I invoked this command with --external=true, but result is the same:
ipa trust-add --type=ad my.domain.com --admin adminaccount --password --external=true Active Directory domain administrator's password: ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None")
On pe, 08 syys 2017, Bart J via FreeIPA-users wrote:
I invoked this command with --external=true, but result is the same:
ipa trust-add --type=ad my.domain.com --admin adminaccount --password --external=true Active Directory domain administrator's password: ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None")
Again, adding [global] log level = 50
to /usr/share/ipa/smb.conf.empty and re-doing 'ipa trust-add ...' would produce debug output in /var/log/httpd/error_log that can be analysed.
I found out that the reason why establishing trust didn't work was IPv6 stack. It wasn't fully configured on FreeIPA's side as we didn't use it but there were IPv6 DNS entries with AD domain controller name present. I remember that I read somewhere that you need to be able to reach all of the AD's DNS entries for trust to work. I can't find a link to that piece of information right now, though.
The steps I took to fix this problem were:
1) Disable IPv6 for currently used network interfaces in /etc/sysctl.conf with entries below and make these entries work by issuing sysctl -p command. You don't need (and should not) disable whole IPv6 stack as it is required by FreeIPA (again, read it somewhere but can't find the source).
net.ipv6.conf.lo.disable_ipv6 = 1 net.ipv6.conf.eth0.disable_ipv6 = 1 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1
2) Configure directory server to use IPv4 only as described here:
http://gsr-linux.blogspot.com/2010/06/enforcing-directory-server-instances-t...
3) Restart ipa with ipactl restart
Then I was able to successfully establish trust to AD domain.
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Bart J