[Samba] Samba ADS-member-server: FQDNs in /etc/hosts

Stefan G. Weichinger lists at xunil.at
Tue Jul 11 11:37:35 UTC 2017

Am 2017-07-11 um 13:28 schrieb Rowland Penny:

>>> Of course, using the 'rid' backend means that you do not need to add
>>> anything to AD and you do not need this line in smb.conf:
>>>   idmap config BUERO:schema_mode = rfc2307
>>> Or you could just change 'idmap config BUERO:backend = rid' to
>>> 'idmap config BUERO:backend = ad' and use the rfc2307 attributes in
>>> AD.
>> I would prefer not to have to decide this. You understand? ;-)
> I think the decision has been made for you, if anything has been stored
> on the DM, it will belong to the IDs that the 'rid' backend has
> created/allocated to your users & groups.


After browsing




I would prefer "rid" to be honest ... ;-)

It's a "one fileserver" environment for now and will be for a long time,
so I think rid does fulfill the requirements.

So it would be simply:

* remove line "idmap config BUERO:schema_mode = rfc2307" on DM

* reload/restart smbd/nmbd/winbind on DM


Would that affect sessions?
Should I order all users to log out first or so?

>> What's the recommendation here, I don't have a clue, I would just like
>> to be able to change this to a working config without doing damage to
>> active sessions, if possible. This is productive environment right
>> now.
> If you want to use the 'ad' backend, you are going to have to do some
> work. You will have to find out what is stored on the DM and who owns
> it. You will then have to find (from AD) the correct ID number. Stop
> Samba, change smb.conf, restart Samba then change the ownership of the
> files etc.

No, see above. I think I go "rid".

>> To me it sounds preferable to have everything in AD, right? At least
>> that is what I expect from having all that: all in one place somehow
> Having everything in AD, gives you the possibility of using different
> Unix home dirs etc per person.

Not needed. I am the only UNIX user there.

I only need separate [home] dirs for a group of users:

some customers of my customer come by to do some work with a specific
software and I want to connect them to a specific user-folder on the
server, using the [homes] mechanism.

? Would that be impossible then ?

>> Can't remember exactly where rid comes from, I think it was a
>> recommendation by Louis for my test VM (which then was migrated to
>> this DC).
> It should work, but only if the users or groups RID + 10000 is inside
> the range you have set in smb.conf (in your case 10000-99999)
> You can change the upper number in the range to a higher number without
> affecting anything else, but you will need to reload or restart Samba


The mentioned user with 10029 was within that range (*scratch*), did the
schema mode make things crash here?

>> Pls also advise if there are any additional steps needed for any of
>> these solutions. I always feel unsure if and if not to add some ids
>> and mappings somewhere ....
> You could ensure that winbind is installed and running (I know it
> probably is, but...)

It is, it is.

thanks a lot for your help and patience.
But be honest: all that ain't easy stuff, right?


More information about the samba mailing list