[Samba] [solved] Re: re-using a member server?

[Derek Shaw]

Just back from my clown college classes with David Thompson...

After a little time away from the screen, I did a review of my steps. 
The obvious thing I missed was that I re-activated not the last instance 
of the member-server VM, but a slightly earlier instance, one where I 
had not edited the /etc/nsswitch.conf file to have winbind as the 2nd 
method.

the member server works just as it did before.  I will now try it with 
the production AD-DC.

My apologies for lowering the signal to noise ratio.
d.

On 15-01-18 04:34 PM, BISI wrote:
> OK - I must be close, but I'm lost...
>
> I have a sernet member server that I built and joined to a test
> win2008R2 AD Domain Controller ("the AD-DC").
> (Version 4.1.14-SerNet-Debian-9.wheezy)
>
> I used Louis van Belle's setup script (manually executed, just 'cause
> I'm that kind of guy).
>
> https://secure.bazuin.nl/scripts/4-setup-sernet-samba4-MEMBER-wheezy.sh
>
> The install, configuration and testing of the member server went very
> smoothly, (also teaching me, I thought, that you need to install the
> deprecated IdMU service to the AD-DC server first, and set up the NIS
> information (GIDs and UIDs on the AD-DC). Everything worked as expected.
> One wrinkle here -- In my ignorance, I did not accept the default 10000
> starting point for NIS UIDs and GIDs.  I followed the lead of one of the
> example smb.conf scripts, and started at 500.
>
> After testing was complete, I did a
>     net ads leave -U administrator
> to remove the member server from the domain.
>
> I am now trying to get the same member server (it is an esxi VM) working
> with a production AD-DC, and it's no longer working.  So I've built yet
> another test windows AD-DC and I can't get the member server working
> properly with that one, either.
>
> Clearly I'm missing something obvious.  Any help to identify what it is
> would be greatly welcomed.
>
> A collection of maybe-relevant information:
>   - I made the original test windows AD-DC with the same forest/domain
> name.  The new test windows AD-DC has the same (HO.EXAMPLE.ORG)
>   - The member server joins the domain with the usual statements of
> success (and creates a new krb5.keytab file).
>   - The server shows up in DNS properly, and is visible in the windows
> explorer/browser but if one of the joined-up windows 7 machines attempts
> to access the server, the dialog asking for credentials comes up.
>   - the wbinfo -u and -g commands work
>   - id domainUser does not (no such user)
>   - wbinfo -i testuser responds with information put in the NIS fields
> on the AD-DC, but is clearly assigning the user to the wrong domain
>       testuser:*:50002:50003:testuser:/home/testuser:/bin/false
>
> smb.conf on the member server:
>> # /etc/samba/smb.conf
>> [global]
>>    workgroup = HO
>>    security = ADS
>>    realm = HO.EXAMPLE.ORG
>>
>>    netbios name = sernetmember
>>    domain master = no
>>    host msdfs = no
>>
>>    dedicated keytab file = /etc/krb5.keytab
>>    kerberos method = secrets and keytab
>>    client signing = if_required
>>
>>    ## map id's outside to domain to tdb files.
>>    idmap config *:backend = tdb
>>    idmap config *:range = 50001-80000
>>    ## map ids from the domain
>>    ## the two ranges MUST not overlap !
>>    idmap config INTERNAL:backend = ad
>>    idmap config INTERNAL:schema_mode = rfc2307
>>    idmap config INTERNAL:range = 2000-40000
>>
>>    winbind nss info = rfc2307
>>    winbind trusted domains only = no
>>    winbind use default domain = yes
>>    winbind enum users  = yes
>>    winbind enum groups = yes
>>    winbind refresh tickets = yes
>>    winbind offline logon = yes
>>
>>    wins server = 192.168.21.1
>>
>>    template shell = /bin/bash
>>    template homedir = /home/samba/HO/users/%USERNAME%
>>
>>    # user Administrator workaround, without it you are unable to set
>> privileges
>>    username map = /etc/samba/samba_usermapping
>>
>>    # For ACL support on member file server
>>    vfs objects = acl_xattr
>>    map acl inherit = yes
>>    store dos attributes = yes
>>
>>    # Share Setting Globally
>>    usershare allow guests = no
>>    unix extensions = no
>>    wide links = no
>>    reset on zero vc = yes
>>    veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
>>    hide unreadable = yes
>>
>>    # disable printing completely
>>    load printers = no
>>    printing = bsd
>>    printcap name = /dev/null
>>    disable spoolss = yes
>>
>>
>> [home]
>>    path = /mnt/smbshares/home
>>    read only = no
>>
>> [profiles$]
>>    path = /mnt/smbshares/profiles
>>    read only = no
>>    admin users = +"HO\Domain Admins"
>>    profile acls = yes
>>    csc policy = disable
>>
>> [public]
>>    path = /mnt/smbshares/public
>>    read only = no
>>
>> [install$]
>>    path = /mnt/smbshares/install
>>    read only = no
>>
>
>
>