headers
Chris Cooper | 1 Dec 2007 02:00
Picon

ADS - Not recognizing Domain Admin group membership (from 1 workstation only)

I've been running a couple Centos5 and RHEL4/5 servers with samba for a
while now and everything has been working great with our Windows 2003 AD.

All of a sudden though I'm experience something really weird on one of the
RHEL5 boxes.  Whenever I try to connect as a Domain Admin from one
particular Vista client, I get access denied and repeated prompts for a
username/password - this has always worked in the past, and still does using
any domain admin account from any other computer (XP or Vista).

Looking at the log I see this when connecting as a Domain Admin from a good
client:
connect to service Reports initially as user XXXXX+yyyyyy (uid=0,
gid=16777220)
and when connecting as a the same Domain Admin from the bad vista client:
connect to service Reports initially as user XXXXX+yyyyyy (uid=16777222,
gid=16777220)

The other share, with a force user=localuser option set produces the
following:
connect to service htdocs initially as user XXXXX+yyyyyy (uid=501,
gid=16777220)
and when connecting as a the same Domain Admin from the bad vista client:
connect to service htdocs initially as user XXXXX+yyyyyy (uid=16777222,
gid=16777220)

So it appears that any connections coming from this one workstation are not
recognised as Domain Admin members.

This particular workstation can connect to any of our other samba servers
(same version 3.0.26a-SerNet-RedHat or older 3.0.21b-2) with
(Continue reading)

Permalink | Reply | 0 comments |
headers
Ryan Novosielski | 1 Dec 2007 07:45
Favicon

Re: serverbased profiles doesnt load at winxp login


Christian wrote:
>  
> 
> hi, ive installed samba 3 on a debian 4, the samba server should act like a
> pdc. 
> 
>  
> 
> at the moment it work that user can login on my clients (all windows xp pro
> sp2), the homedrive is mapped corretly, the only thing that doesn't work, is
> that the serverbased profile is saved automatically on the server, so that
> the user can downlad the profile at login.
> 
>  
> 
> here is my smb.conf:
> 
> [global] 
> 
>          workgroup = lecture 
> 
>          server string = %h server 
> 
>          netbios name = samba_pdc 
> 
>          interfaces = 127.0.0.1, 192.168.10.0/24 
> 
>          hosts allow = 127.0.0.1, 192.168.10.0/24 
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Ed Murray | 1 Dec 2007 08:36

Samba AD & LDAP

Hi,
    I have windows XP clients that do domain login against a Windows SBS
2003 server. I also have a samba server using LDAP for authentication.
Is is possible to use groups on the LDAP server for file permissions on
the samba server? The samba server has previously been set up as a PDC
so all the relevant schema should already be applied.

Regards
Ed  Murray

--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 1 comment |
headers
Helmut Hullen | 1 Dec 2007 08:06
Picon
Favicon

Re: blocked ports 445 and 139 make printer-shares very slow

Hallo, Marcus,

Du (lists) meintest am 30.11.07:

> here is a part of the samba log for the connecting WinXP client to
> the local samba domain, trying to open the spool for a print share.
> Port 445 is blocked by the WinXP client, so samba can't connect,
> which seems to be the reason for aboved slow behavior at client side.

> --------
> [2007/11/30 23:07:49, 2] lib/access.c:check_access(323)
>   Allowed connection from  (192.168.239)
> [2007/11/30 23:07:49, 2] lib/access.c:check_access(323)
>   Allowed connection from  (192.168.239)
> [2007/11/30 23:07:57, 1] lib/util_sock.c:open_socket_out(896)
>   timeout connecting to 192.168.239:445
                          ^a  ^b  ^c  ^port

Where ist the 4th byte of the ip address?

Viele Gruesse!
Helmut
--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 1 comment |
headers
Marcus Sobchak | 1 Dec 2007 11:50
Picon

Re: blocked ports 445 and 139 make printer-shares very slow

Am Samstag, den 01.12.2007, 08:06 +0100 schrieb Helmut Hullen:
> Hallo, Marcus,
> 
> Du (lists) meintest am 30.11.07:
> 
> > here is a part of the samba log for the connecting WinXP client to
> > the local samba domain, trying to open the spool for a print share.
> > Port 445 is blocked by the WinXP client, so samba can't connect,
> > which seems to be the reason for aboved slow behavior at client side.
> 
> > --------
> > [2007/11/30 23:07:49, 2] lib/access.c:check_access(323)
> >   Allowed connection from  (192.168.239)
> > [2007/11/30 23:07:49, 2] lib/access.c:check_access(323)
> >   Allowed connection from  (192.168.239)
> > [2007/11/30 23:07:57, 1] lib/util_sock.c:open_socket_out(896)
> >   timeout connecting to 192.168.239:445
>                           ^a  ^b  ^c  ^port
> 
> Where ist the 4th byte of the ip address?

Ups, sorry, just I typo. Didn't want to post my public IPs. All IPs are
correct.

Ciao!

--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
(Continue reading)

Permalink | Reply | 0 comments |
headers
David Lee | 1 Dec 2007 18:34
Picon
Picon

Re: Strange file permissions

This problem appeared to have been sorted, but came back today. I have set the directives valid
users and force group.
Any advice on what log level setting I should set to try and pick this problem up in the logs?

Is there any plans to improve the on-line help for problem solving with Samba? How about a
website/wiki with columns:

Symptom | Perform check | Action if ok | Action if fail |

where the action columns could be hyperlinked to other symptom/check lines as needed. At present it
is limited to the part V of the "The Official Samba-3 HOWTO and Reference Guide" A Wiki would allow
such a table to be easily updated, probably with answered queries from the mailing list. I regret I
do not have the available time to try working on such a project.

Mark Adams wrote:
> In my opinion even your no access folder should use a group. Make your 
> lowest permissions group nogroup then add all users to the group. Then 
> change smb conf user security entry to valid users =  <at> nogroup
> 
> Mark.
> 
> 
> On 26 Nov 2007, at 22:59, DNL <dnl <at> livstones.freeserve.co.uk> wrote:
> 
>>
>>
>> Mark Adams wrote:
>>> Is sgid on the top level dir?
>> Set for subdirectory cp, but not for projects as different directories 
>> at that level require no access control
(Continue reading)

Permalink | Reply | 0 comments |
headers
Marcin Kucharczyk | 1 Dec 2007 19:46
Picon

Re[2]: INTERNAL ERROR: Signal 11 in pid xxxx (3.0.26a)

Hello,

Sunday, November 25, 2007, 2:48:23 PM, Volker Lendecke wrote:

VL> This particular bug report is highly unlikely to be a Samba
VL> problem. Also, I have a hard time to believe that you have
VL> to really deinstall Samba after a system crash. It *is*
VL> definitely possible to restart Samba from whatever state the
VL> system is in, possibly by removing tdb files. Removing and
VL> recompiling the daemons is definitely unnecessary. You might
VL> want to see what this removing/reinstalling really does.

Ok, I made few more test. Looks like reinstall is not neccessary. I
CAN'T delete /var/db/samba/ directory, because samba doesen't want to
start. But I CAN delete contents of the directory and start samba
again. Not the best conclusions after first samba 3.0.26a crash and
problems with the system :(

Like you wrote on the list: the problem is caused by damaged
filesytem or damaged tdb files after system crash [unexpected shutdown
because of power failure]. But next samba makes the crash and
unexpected system utilization :(

Partial resolution of the problem: additional lines in samba startup
script which clears contents of the /var/db/samba/ directory on
startup...

Additional questions: What functions does Samba use to open tdb files?
Some internal functions or external program? I've upgraded all ports
when upgrading samba from 3.0.23c to 3.0.26a, so maybe some external
(Continue reading)

Permalink | Reply | 0 comments |
headers
Sven Schnelle | 1 Dec 2007 21:48

[3.2.0pre1] net ads join fails with NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Hi List,

i'm trying to join a Windows 2000 SP4 Domain (Native mode). I'm getting
the following error while joining:

# net ads join -U 'Administrator%password'
Using short domain name -- W2K
Could not connect to server dc.w2k.bitebene.org
Connection failed: NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
Failed to verify membership in domain: NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT!
Failed to join domain: No logon workstation trust account

my smb.conf:

[global]
realm = W2K.BITEBENE.ORG
netbios name = asg
security = ADS
idmap uid = 15000-20000
idmap gid = 15000-20000
winbind separator = +
winbind use default domain = yes
private dir = /etc/samba/private
use kerberos keytab = yes
client use spnego = yes
workgroup = W2K

(i'm only using winbindd)

The NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT above is probably
(Continue reading)

Permalink | Reply | 0 comments |
headers
Marco De Vitis | 1 Dec 2007 22:11
Picon
Favicon
Subject: Re: Big problems with 3.0.24-6etch6 Debian packages

Re: Big problems with 3.0.24-6etch6 Debian packages

Il 30/11/2007 6:46, Christian Perrier ha scritto:

> New packages have been rolled out which claim to fix the long
> directory listings regression. It turned out that a chunk from

Yes I've seen the DSA, thanks. But...

> Feedback about these packages is currently quite low so I would suggest
> people to run them carefully on their production servers. They

...I think I'll wait a bit before upgrading again, for this exact reason ;)
After all, I didn't see many reports around the web for the problem I 
had, although it really was a showstopper for me. So, I'll better wait 
for some testing from others this time.

Thanks anyway for the infos.

-- 
Ciao,
   Marco.

--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 0 comments |
headers
Dane Shea | 2 Dec 2007 08:56
Picon

Making a public drive where admin has write access

Hello I am trying to make a public drive where an admin has write access but
other users only have read access. I want to be able to mount the drive
automatically for the users and admin but I want the admin to automount with
write access using a batch file.  This is what my share looks like tell me
if it is right.

[public]
comment = Public Shared Folder
path = /home/public
write list = DShea
create mask = 0775
guest ok = Yes

Then the batch file looks like this:

NET USE J: \\192.168.1.109\public <file:///\\192.168.1.109\public>
/USER:daneshea.com\DShea dane

For some reason it mounts it but not with write access. I can't figure out
why.

Thanks in advance

--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 0 comments |

Gmane