headers
Andrew Bartlett | 1 Jan 2012 04:36
Picon
Favicon

Re: [PROPOSAL] Require builtin or system krb5 libs

On Sat, 2011-12-31 at 09:30 -0500, simo wrote:
> On Sat, 2011-12-31 at 20:58 +1100, Andrew Bartlett wrote: 
> > Back in October, I wrote the the list suggesting that we should adopt an
> > explicit policy that we require at least some level of Kerberos support
> > to build Samba:
> > 
> > On Mon, 2011-10-24 at 21:03 +1100, Andrew Bartlett wrote:
> > 
> > > I would actually like us to consider if there are systems that we care
> > > about without krb5-devel, and which cannot use the waf build.  If we
> > > could always expect at least some kind of Kerberos library (internal or
> > > system heimdal from the waf build, or any system from autoconf), we
> > > could make our code much simpler in parts.
> > 
> > I would like to make that a firm proposal.  For me at least, Samba both
> > 3.5.11 and current master do not compile without krb5-devel.  As such,
> > it seems no testing is done on systems without a kerberos library, and
> > our users have not been inconvenienced by this requirement. 
> > 
> > Therefore, as we have a way to build Samba without a system kerberos
> > (the waf build), I would like us to require that users either build with
> > waf, or build with a system krb5-devel.
> > 
> > Doing so would remove a lot of dead, untested #ifndef HAVE_KRB5 stub
> > functions, and make our code easier to follow and simpler to develop. 
> > 
> > What do others think?
> 
> I am ok in always requireing kerberos libraries, but given we are making
> a requirement I would go further and specify a minimum MIT Kerberos or
(Continue reading)

Permalink | Reply | 20 comments |
headers
Jeremy Allison | 1 Jan 2012 05:25
Picon
Favicon

Re: [PROPOSAL] Require builtin or system krb5 libs

On Sun, Jan 01, 2012 at 02:36:49PM +1100, Andrew Bartlett wrote:
> On Sat, 2011-12-31 at 09:30 -0500, simo wrote:
> > On Sat, 2011-12-31 at 20:58 +1100, Andrew Bartlett wrote: 
> > > Back in October, I wrote the the list suggesting that we should adopt an
> > > explicit policy that we require at least some level of Kerberos support
> > > to build Samba:
> > > 
> > > On Mon, 2011-10-24 at 21:03 +1100, Andrew Bartlett wrote:
> > > 
> > > > I would actually like us to consider if there are systems that we care
> > > > about without krb5-devel, and which cannot use the waf build.  If we
> > > > could always expect at least some kind of Kerberos library (internal or
> > > > system heimdal from the waf build, or any system from autoconf), we
> > > > could make our code much simpler in parts.
> > > 
> > > I would like to make that a firm proposal.  For me at least, Samba both
> > > 3.5.11 and current master do not compile without krb5-devel.  As such,
> > > it seems no testing is done on systems without a kerberos library, and
> > > our users have not been inconvenienced by this requirement. 
> > > 
> > > Therefore, as we have a way to build Samba without a system kerberos
> > > (the waf build), I would like us to require that users either build with
> > > waf, or build with a system krb5-devel.
> > > 
> > > Doing so would remove a lot of dead, untested #ifndef HAVE_KRB5 stub
> > > functions, and make our code easier to follow and simpler to develop. 
> > > 
> > > What do others think?
> > 
> > I am ok in always requireing kerberos libraries, but given we are making
(Continue reading)

Permalink | Reply | 18 comments |
headers
Volker Lendecke | 1 Jan 2012 11:53
Picon
Favicon

Re: [PROPOSAL] Require builtin or system krb5 libs

On Sat, Dec 31, 2011 at 08:58:34PM +1100, Andrew Bartlett wrote:
> I would like to make that a firm proposal.  For me at least, Samba both
> 3.5.11 and current master do not compile without krb5-devel.  As such,
> it seems no testing is done on systems without a kerberos library, and
> our users have not been inconvenienced by this requirement. 

If our code does not compile without Kerberos libraries, I
would consider this a bug. Can you file a bug at bugzilla
and assign it to me? I'll see if I can fix it.

Volker

--

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt <at> sernet.de
Permalink | Reply | 0 comments |
headers
Michael Wood | 1 Jan 2012 14:29
Picon

Re: upgradeprovision --full fails to find CN=NTDS Settings

On 18 December 2011 18:50, Michael Wood <esiotrot <at> gmail.com> wrote:
> Hi
>
> On 18 December 2011 18:12, Matthieu Patou <mat <at> samba.org> wrote:
>> Hi Micheal,
>>
>> Please file me a bug and try to ping me within a week on this subject I have
>> to take a deep look on this subject ...

ping :)

and Happy New Year.

> Thanks, its https://bugzilla.samba.org/show_bug.cgi?id=8669
>
> Bugzilla would not let me assign it to you or Cc you (using either of
> your addresses).

--

-- 
Michael Wood <esiotrot <at> gmail.com>
Permalink | Reply | 5 comments |
headers
Matthieu Patou | 1 Jan 2012 19:21
Picon
Favicon

Re: Migrating S4 DC

On 30/12/2011 23:04, titantoppler <at> gmail.com wrote:
> Hi all,
>
> Thanks for the insights so far.
>
> As far as I understand things:
> 1) I can use the built-in replication - but what about GPOs? Will they
> propogate to the backup DC as well?
No replication for the moment, setup your own replication scheme ....
> 2) Files (profiles and shared files) will have to be done manually, as will
> the permissions. A hassle, but nothing unmanageable
> 3) S3 isn't ideal for an AD set up since the configuration of the file
> permissions will have to be done from smb.conf - I'd prefer to do it all
> from the Windows management tools (I know, I know...)
No no, I encourage you to use the acl_xattr module so that you have a 
good NTACLs mapping and then you can use the Window explorer to set the 
ACLs.
> Andrew: If I understand you correctly, if I want to retain the correct file
> permissions without having to reapply them (because of the migration from
> posix:eadb to built-in file attributes) I should do the following:
> a) Set up the appropriate shares in the new file server
> b) Copy the files from share to share using Windows - this will preserve
> the file permissions (esp. for user profiles), thus saving me from having
> to reconfigure the permissions again.
> c) Re-map the users' home and profile shares on the AD side of things.
>
> Is there anything else that I should be considering but am not?
>
> Cheers, and happy holidays!
Matthieu.
(Continue reading)

Permalink | Reply | 0 comments |
headers
simo | 1 Jan 2012 23:32
Picon
Favicon

Re: [PROPOSAL] Require builtin or system krb5 libs

On Sat, 2011-12-31 at 20:25 -0800, Jeremy Allison wrote: 
> On Sun, Jan 01, 2012 at 02:36:49PM +1100, Andrew Bartlett wrote:
> > On Sat, 2011-12-31 at 09:30 -0500, simo wrote:
> > > On Sat, 2011-12-31 at 20:58 +1100, Andrew Bartlett wrote: 
> > > > Back in October, I wrote the the list suggesting that we should adopt an
> > > > explicit policy that we require at least some level of Kerberos support
> > > > to build Samba:
> > > > 
> > > > On Mon, 2011-10-24 at 21:03 +1100, Andrew Bartlett wrote:
> > > > 
> > > > > I would actually like us to consider if there are systems that we care
> > > > > about without krb5-devel, and which cannot use the waf build.  If we
> > > > > could always expect at least some kind of Kerberos library (internal or
> > > > > system heimdal from the waf build, or any system from autoconf), we
> > > > > could make our code much simpler in parts.
> > > > 
> > > > I would like to make that a firm proposal.  For me at least, Samba both
> > > > 3.5.11 and current master do not compile without krb5-devel.  As such,
> > > > it seems no testing is done on systems without a kerberos library, and
> > > > our users have not been inconvenienced by this requirement. 
> > > > 
> > > > Therefore, as we have a way to build Samba without a system kerberos
> > > > (the waf build), I would like us to require that users either build with
> > > > waf, or build with a system krb5-devel.
> > > > 
> > > > Doing so would remove a lot of dead, untested #ifndef HAVE_KRB5 stub
> > > > functions, and make our code easier to follow and simpler to develop. 
> > > > 
> > > > What do others think?
> > >
(Continue reading)

Permalink | Reply | 17 comments |
headers
Richard Sharpe | 2 Jan 2012 08:03
Picon

A Samba VFS Module for Amazon's S3

Hi folks,

For anyone interested in looking at the code, such as it is at the
moment, you can find it at:

     git://github.com/RichardSharpe/Amazon-S3-VFS.git

--

-- 
Regards,
Richard Sharpe
Permalink | Reply | 1 comment |
headers
Andrew Bartlett | 2 Jan 2012 12:56
Picon
Favicon

[PATCH] Implement GSE as a gensec module for GSSAPI in s3

On Tue, 2011-12-27 at 12:07 +1100, Andrew Bartlett wrote:
> On Thu, 2011-12-22 at 13:44 +0100, Stefan (metze) Metzmacher wrote:
> > Hi Andrew,
> > 
> > > This patch series generalises the auth_ntlmssp code into a more generic
> > > infrastructure, with the aim to have GSSAPI handled via GENSEC in the
> > > smb sealing, rpc server and eventually session setup code.  
> > > 
> > > The patches so far are just the start, but take a very measured, one
> > > small change at a time approach without intentional behaviour change,
> > > and are at: 
> > > http://git.samba.org/?p=abartlet/samba.git/.git;a=shortlog;h=refs/heads/s3-rpc-gensec
> > 
> > Thanks! I plan to sign-off and push this too.
> 
> Thanks for pushing that.  I've updated the branch with a new set of
> changes.  These follow in the same pattern, making the code more
> generic, but not intentionally changing behaviour.  This set of changes
> introduces a new way to specify the gensec modules list.  
> 
> My hope is that once we make the use of NTLMSSP totally generic (ie,
> just specified with a parameter rather than via dedicated functions), it
> will be much easier to call other modules and even the SPNEGO we
> discussed via the same, tested call stack. 

I've been busy over the break, and again updated the branch.
http://git.samba.org/?p=abartlet/samba.git/.git;a=shortlog;h=refs/heads/s3-rpc-gensec

The big thing I've been working towards is that with these patches, we
now call into the GSE GSSAPI abstraction layer via GENSEC, rather than
(Continue reading)

Permalink | Reply | 17 comments |
headers
Daniele Dario | 2 Jan 2012 16:57
Picon

Re: Domain join as BDC

On Fri, 2011-12-30 at 14:35 +0100, Daniele Dario wrote:
> Hi samba team,
> which is the right way to join a new samba4 DC to a domain with a samba4
> PDC having also DNS zones replicated?
> 
> PDC is running samba4 Version 4.0.0alpha18-GIT-32317b0 provisioned with
> --dns-backend=BIND9_DLZ and with bind 9.9.0b1.
> 
> The secondary DC is running samba4 Version 4.0.0alpha18-GIT-c2d6509 and
> bind 9.9.0b1.
> 
> I tried to join it with
> samba-tool domain join SAITELITALIA DC -U administrator
> --realm=saitelitalia.local
> and join has worked but DNS zones where not replicated between the two
> DCs.
> 
> With samba-tool I added replication for
> DC=DOMAINDNSZONES,DC=SAITELITALIA,DC=LOCAL
> DC=FORESTDNSZONES,DC=SAITELITALIA,DC=LOCAL
> but it does not work for the copy in private/dns/sam.ldb and
> private/dns/sam.ldb.d/ .
> 
> Cheers,
> Daniele.
> 
> P.S.
> Happy new year to all of you.
> 
ping
(Continue reading)

Permalink | Reply | 0 comments |
headers
Catalin Patulea | 3 Jan 2012 00:47
Picon
Picon
Favicon

[PATCH] tevent: First stab at a glib backend

Hi,

Here is a glib backend for tevent. This backend lets single-threaded
GTK apps embed parts of Samba which use tevent for I/O. These apps
will also be able to make async calls into, say, smbclient-raw. In
particular, this is the first step towards a Samba 4 backend for GVFS.

fds and timers are mapped to the corresponding glib GSources, and the
main loop is implemented using GMainContext. The dependency of tevent
on glib is optional and auto-detected at configure time. The tevent
ABI change was necessary to expose tevent_common_timed_destructor, and
should not break anything.

I have tested this using the test suite (waf test
--tests=samba4.local.event), and the backend passes with comparable
numbers of pipe events/sec as other backends (172492.00 ev/s for glib
vs 178985.50 ev/s for poll).

I have also tried forcing smbclient to use this backend
(source4/lib/events/tevent_s4.c) and I was able to open a session to a
share as guest (XP SP3 64-bit server), list the current directory, and
download a file.

Catalin
Attachment (0001-tevent-First-stab-at-a-glib-backend.patch): text/x-patch, 24 KiB
Permalink | Reply | 3 comments |

Gmane