Mounting a Windows DFS namespace with mount.cifs/cifs-utils

[hunterpine]

Hello,

I'm running Stretch 9.6, fully updated as of yesterday, and I'm trying to mount a DFS namespace running on a pair of Windows 2019 servers. I've confirmed these namespaces are working properly in Windows, I can connect from other domain machines as well as my non-domain laptop to the namespace with no problems, so the namespace is functioning as expected, but mounting from Debian fails.

I can connect directly to the shares on the individual servers via mount.cifs, so I know samba/cifs is working, but of course, the reason behind the namespace setup is to ensure resiliency in the event of a failure on one of the members.

I believe what is happening is that when I try to mount //domain.local/dfs/staging, cifs is trying to connect directly to one of the domain controllers which is returned from domain.local, it's not being properly redirected to one of the two servers actually hosting the namespace.

# mount.cifs //domain.local/dfs/staging --verbose -o username=username,vers=2.0
Password for username@//domain.local/dfs: ************
mount.cifs kernel mount options: ip=10.180.1.10,unc=\\domain.local\dfs,vers=2.0,user=username,pass=***********
mount error(2): No such file or directory
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

The IP address returned above above changes to various domain controllers in my domain with each attempt to connect, which is what I'm basing my theory upon, however the IP addresses of the namespace servers are 10.180.106.10 and 10.180.206.10

The following log entries are made when attempting to mount the dfs volume:
Jan 17 14:20:28 Debian kernel: [69134.865545] CIFS VFS: BAD_NETWORK_NAME: \\domain.local\dfs
Jan 17 14:20:28 Debian kernel: [69134.884298] CIFS VFS: cifs_mount failed w/return code = -2

I've installed cifs-utils, smbfs, and keyutils. I've performed the modifications to request-key.conf (adding -t to the cifs.spnego line) as suggested in numerous how-to and troubleshooting articles (however they're all from 20012 or earlier so I'm unsure of their relevance). I've confirmed "search domain.local" is in my resolv.conf, I've confirmed I'm using domain DNS servers.

I've also tried adding two lines to my hosts file to force resolution of domain.local to the namespace servers, but this results in authentication errors because Samba can no longer communicate with the actual authentication servers on domain.local.

I'm not sure what else to try at this point, so I figured I'd try here. Any suggested next steps or viable solutions would be greatly appreciated.

Thanks in advance,
-H

PS - please don't complain about my generic naming above, all share/system/domain names and IP addresses were changed for security purposes.