headers
Patrick Rynhart | 1 Jan 2008 02:02
Picon

idmap_nss: Default domain not being used

I have an existing PDC which I am attempting to move across to a new
server.  On the new server, I'm having trouble with idmap (using an LDAP
backend) and trusted domains.  The smb.conf file is the same on both
servers.  My idmap & winbind parameters are as follows:

ldap idmap suffix = ou=idmap
idmap backend = ldap:ldap://127.0.0.1
idmap uid = 10000-29000
idmap gid = 10000-29000
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes

On the new box, 'wbinfo -t' suceeds and I can list users and groups on
the foreign domain using 'wbinfo -u' and 'wbinfo -g'.  'net rpc trustdom
list' lists the trusted domain.

Comparing the winbind debug logs of the existing and new PDC, I have
discovered that the cruical difference appears to be the following line
(which is missing on the new PDC)

"SID S-1-5-21-15318837-110984162-118601546-6958 is being handled by
default domain"

On the new server I get:
------------------------

[ 3008]: lookupsid S-1-5-21-15318837-110984162-118601546-6958
refresh_sequence_number: IIST time ok
refresh_sequence_number: IIST seq number is now 60700
(Continue reading)

Permalink | Reply | 0 comments |
headers
bdehn | 1 Jan 2008 06:23

Upgrade from SLES9 3.0.20 to 3.0.26a breaks getent


All -

This evening I attempted to catch up on security releases and upgraded from
SLES9 3.0.20 to 3.0.26a and found that getent only returns local UNIX
groups and users. We are using winbind to communicate with an NT domain.
The server has been restarted and services are running. Using wbinfo -u and
-g does provide NT domain groups and users as expected and net rpc testjoin
result is OK. I have checked config files and they appear OK. What have I
missed?

Bob Dehn

--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 1 comment |
headers
Michaël Todorovic | 1 Jan 2008 12:08
Picon
Favicon

Problem with samba and ldap

Hello and happy new year :)

I have to set up a samba server as a PDC with a openldap backend. My 
openldap server is fully functionnal and it is not secured yet (so no 
problems with tls). I must use debian etch or lenny.
My server's IP is 192.168.9.10/24. I have set up a dns server (bind9) 
for my domain named "mik". It's a local domain for testing only. There 
is a piece of the configuration file of bind :
pdc             A       192.168.9.10
_ldap._tcp.dc._msdcs    IN      CNAME   pdc
This permits windows clients to find the pdc. When I try to join the 
domain under linux, it fails. I try with "net join mik -U root" on the 
pdc (no other pc than the pdc to test) and it returns :
Creation of workstation account failed
Unable to join domain MIK.
Here are the logs :
/var/log/samba/log.pdc :
[2008/01/01 11:44:47, 2] lib/smbldap.c:smbldap_open_connection(786)
  smbldap_open_connection: connection opened
[2008/01/01 11:44:47, 2] passdb/pdb_ldap.c:init_sam_from_ldap(545)
  init_sam_from_ldap: Entry found for user: root
[2008/01/01 11:44:47, 2] auth/auth.c:check_ntlm_password(309)
  check_ntlm_password:  authentication for user [root] -> [root] -> 
[root] succeeded
[2008/01/01 11:44:49, 0] passdb/pdb_interface.c:pdb_default_create_user(329)
  _samr_create_user: Running the command `/usr/sbin/smbldap-useradd -w 
"pdc$"' gave 9

smbldap-useradd returns 9 when the user already exists in the directory 
but it does not change anything if I delete it. It returns 0 (no
(Continue reading)

Permalink | Reply | 1 comment |
headers
Frédéric Notet | 1 Jan 2008 11:54
Picon

pdbmysql

Hello !

Is there anybody who use "pdbmysql" on Debian ? I can't install it  
since a week and i need some help :(

Thanks !
--

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
Permalink | Reply | 0 comments |
headers
Joachim Kieferle | 1 Jan 2008 15:31
Picon

Re: Driver installation fails on samba server - SOLVED

Joachim Kieferle wrote:
> Dear list,
>
> since days I am trying to install several HP-drivers from a XP client 
> on the samba server (DC) - 3.0.28 on OpenSuse 10.3.
>
> Installing the drivers contained in Windows works.
> Installing drivers from a disk (e.g. for a Designet 4000) does NOT 
> work. It says "Driver for Designjet .... could not be installed. 
> Access denied". It is however creating a directory under W32X86 named 
> __SKIP_xxxx (where xxxx are different figures e.g. 00DA).
>
> Linux-permissions at W32X86 are set to 777.
> The directory named __SKIP_xxxx  is created as "drwxrwxr-x root 
> ntadmin ....", so as admin root there should be sufficient access.
>
> Even log level 10 didn't show me any hints. I changed to different 
> smb.conf settings, etc.
>
> Did anybody of you experience a similar problem and has a solution?

Hi list,

there were no answers to my question from the list, however in the 
meantime I was successful and found a solution. So here I'll document it 
for other users:

- We migrated the Samba server (with existing LDAP-accounts) to a new 
server.
- After that migration "domain root" didn't have full access to the
(Continue reading)

Permalink | Reply | 0 comments |
headers
Edmundo Valle Neto | 1 Jan 2008 21:44
Picon
Favicon

Re: password

Andrea Bencini escreveu:
>> SWAT's help files are a good resource, as shown below.
>>
>> Dale
>
> I will explain you my question.
> I have installed samba-3.0.28-0 like PDC and I have only some  Xp prof 
> clients.
> In "global" section of smb.conf I have set
> passdb backend = tdbsam
> unix password sync = no
> encrypt password = yes
>
> I have NOT set  "passwd program" and "passwd chat"
> Then, with pdbedit, I have set password expired.
> I can change the password, when it is expired, from Xp prof client.
>
> The question is:
> Are "passwd program" and "passwd chat"  part of the suit to change the 
> password?

Yes.

> I have NOT used them, but I can change anyway the passwords; then when 
> should I use
> them? In which situation?

As already said, the man page are very clear. The password program is 
the program used to change UNIX passwords. And UNIX passwords are not, 
lets say, "samba passwords".
(Continue reading)

Permalink | Reply | 1 comment |
headers
Martin Zielinski | 2 Jan 2008 08:52
Picon
Favicon

Re: SLow cups printing, lots of get-printer-attributes

Hello,

This is the result of asking cups for a comment and location string to 
sync them between cups and samba.
I've allready asked the samba-team to replace it with a more general 
approach but got no response until now.

As a workaround, please set the comment and location string of every 
printer from your windows client in the printers and faxes section. When 
samba has both strings in its ntprinter.tdb database, it will no longer 
ask cups for them.

If you compile samba yourself, you can search in nt_printing.c for the
HAVE_CUPS defines and comment out the part.

Bye,

Martin

Emmanuel Lacour schrieb:
> On Fri, Dec 14, 2007 at 03:59:02PM +0100, Emmanuel Lacour wrote:
>> Hi all,
>>
>> I encounter a problem here on a samba PDC with 97 cups printers.
>>
>> When on a windows client, I click right on a printer, then select
>> "properties", it tooks about 12 secondes to open.
>> When from a spreadsheet such as M$ Excel I click on print, then try to
>> select an imprimante from my pdc, it tooks about 30 seconds.
>>
(Continue reading)

Permalink | Reply | 4 comments |
headers
John | 2 Jan 2008 09:00
Picon
Favicon

Re: Upgrade from SLES9 3.0.20 to 3.0.26a breaks getent

Hello Bob,

I recently saw similair problems updating CentOS 4 (whitle label RE4) to 
3.0.25c. See tread IDMAP RID problems and documentation started on 19 dec

But I didn't receive the answers I was looking for. For me, using the the 
new syntax with RID broke getent. With using this old syntax I got it back 
working. But this setup misses the BUILTIN groups and the  new advertised 
features......
smb.conf snipped
    [global]
        idmap backend = rid
        idmap uid = 1000-1000000
        idmap gid = 1000-1000000

So maybe one of the experts can shine a light on this, because it's looks 
like this problems occurs on several differnt  older distro's.

Regards,

John
The Netherlands

<bdehn <at> oreillyauto.com> schreef in bericht 
news:OFA617B813.708879EF-ON862573C3.001D9A7A-862573C3.001D9AAA <at> oreillyauto.com...
>
> All -
>
> This evening I attempted to catch up on security releases and upgraded 
> from
(Continue reading)

Permalink | Reply | 0 comments |
headers
Martin Zielinski | 2 Jan 2008 10:10
Picon
Favicon

Re: print command is ignored after upgrade

Hi Greg,

put the "printing = sysv" line *before* the "print command = ..." line 
in your smb.conf file.

Bye,

Martin

Greg Saunders schrieb:
> I use to have a working custom "print command =" in my smb.conf until an
> upgrade to 3.0.28.
> 
> OS: Suse 10.2
> Samba: 3.0.28
> Cups: 1.2.7
> 
> relevant smb.conf snippet
> 
> [global]
>         lpq command = lpstat -o%p
>         ldap ssl = no
>         name resolve order = host lmhosts bcast
>         idmap gid = 15000-20000
>         include = /etc/samba/dhcp.conf
>         logon drive = P:
>         map to guest = Bad User
>         public = yes
>         winbind use default domain = Yes
>         realm = CANWEST.IBIGROUP.COM
(Continue reading)

Permalink | Reply | 0 comments |
headers
Quinn Fissler | 2 Jan 2008 10:14
Picon

Re: Problem with samba and ldap

Bonjour,

I have seen this behaviour myself on more than one occasion and for
different reasons.

It took some time to diagnose at first but it was an education :-)

The first thing to remember is that samba uses two methods to talk to ldap.

As far as I remember, when you first issue the join, the client tries to log
into to the domain - this fails so it tries to create an account - this is
done by samba using the method configured in smb.conf viz:
  add machine script = /usr/sbin/smbldap-useradd -w "%u".
which itself uses a perl module to make the connection and which is
confirgured by the smbldap_bind.conf and smbldap.conf.

Once the script has been called, samba checks that it worked using the
nssldap libraries.
Here, samba does the equivalent of:
    getent passwd MyMachineName

Try running this - there are so many reasons it could fail - does it work
from the command line?

As you haven't included this in your description, I presume that it's the
bit you overlooked.

It is configured using ldap.conf  - I found that these are in /etc and
/etc/openldap so I hard linked to make one file.
(Continue reading)

Permalink | Reply | 0 comments |

Gmane