[Samba] Make a share owned by a service account available to members of an AD group
Tovey, Mark
MTovey at go2uti.com
Sun Oct 11 04:16:30 UTC 2015
I made my configuration look identical to what is in the Samba Wiki, and still the same results: everything works perfectly as long as the user account is in both AD and the local passwd file. If I remove the account from the local passwd file, I cannot map the share.
While looking around, I encountered this: https://bugzilla.samba.org/show_bug.cgi?id=9862. This bug refers to Samba 4.1 and above, but the description very closely matches what I am encountering. I think this is what I am up against now.
So, I guess I just have to put the user accounts into both systems until the patch can be rolled into the vendor released version I am using.
-Mark
________________________________________________________________
Mark Tovey - UNIX Engineer | Service Strategy & Design
UTi | 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA
MTovey at go2uti.com | O / C +1 503 953-1389
-----Original Message-----
From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland Penny
Sent: Friday, October 9, 2015 2:55 PM
To: samba at lists.samba.org
Subject: Re: [Samba] Make a share owned by a service account available to members of an AD group
On 09/10/15 22:42, Tovey, Mark wrote:
> Here is my configuration:
>
> smb.conf:
>
> [global]
> server string = Samba Server Version %v
>
> log file = /var/log/samba/log.%m
> max log size = 500
>
> log level = 3
>
> workgroup = DEVTST-CORP
> realm = DEVTST-CORP.GO2UTI.COM
> security = ADS
Remove these lines
password server = sinmdp04.devtst-corp.go2uti.com
passdb backend = tdbsam
>
> domain master = no
> local master = no
> preferred master = no
>
> disable netbios = yes
> dns proxy = no
>
> dedicated keytab file = /etc/krb5.keytab
> kerberos method = secrets and keytab
>
> idmap config *:backend = tdb
> idmap config *:range = 5000-29999
> idmap config DEVTST-CORP:backend = ad
> idmap config DEVTST-CORP:schema_mode = rfc2307
> idmap config DEVTST-CORP:range = 30000-99999
>
> winbind nss info = rfc2307
> winbind trusted domains only = no
> winbind use default domain = yes
> winbind enum users = yes
> winbind enum groups = yes
> winbind refresh tickets = Yes
> winbind normalize names = Yes
>
> map untrusted to domain = yes
> map to guest = Bad Uid
> guest account = nobody
>
> load printers = no
> printcap name = /dev/null
> printing = bsd
>
>
> [data]
> path = /opt/app/data
> read only = no
> writable = yes
> browseable = no
> guest ok = yes
> hide dot files = yes
> hide special files = yes
> force user = webserv
> force group = webserv
> create mask = 0644
> directory mask = 0755
> valid users = @DEVTST-CORP\smbgrp
> write list = @DEVTST-CORP\smbgrp
>
>
> resolv.conf:
>
> domain devtst.go2uti.com
> search devtst.go2uti.com devtst-corp.go2uti.com
>
> nameserver 10.240.4.100
> nameserver 10.254.4.125
> nameserver 10.8.246.38
>
Remove the domain line from resolv.conf and any of the nameserver lines that isn't the AD DC
> /krb5.conf:
>
> [logging]
> default = FILE:/var/log/samba/krb5libs.log
> kdc = FILE:/var/log/samba/krb5kdc.log
> admin_server = FILE:/var/log/samba/kadmind.log
>
> [libdefaults]
> default_realm = DEVTST-CORP.GO2UTI.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
> ticket_lifetime = 24h
> forwardable = true
>
> [realms]
> DEVTST-CORP.GO2UTI.COM = {
> kdc = sinmdp04.devtst-corp.go2uti.com:88
> admin_server = sinmdp04.devtst-corp.go2uti.com:749
> default_domain = DEVTST-CORP
> }
>
> [domain_realm]
> .devtst-corp.go2uti.com = DEVTST-CORP.GO2UTI.COM
> devtst-corp.go2uti.com = DEVTST-CORP.GO2UTI.COM
>
> [appdefaults]
> pam = {
> debug = false
> ticket_lifetime = 36000
> renew_lifetime = 36000
>
> forwardable = true
> krb4_convert = false
> }
>
change krb5.conf to just this:
[libdefaults]
default_realm = DEVTST-CORP.GO2UTI.COM
dns_lookup_realm = false
dns_lookup_kdc = true
> net ads testjoin:
> Join is OK
>
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
More information about the samba
mailing list