[Samba] Samba 4.8.3 - Stand-alone server

[Rowland penny]

On 19/08/2019 21:29, Bob Wyatt wrote:
> Rowland,
>
> I wish to thank you for your patience with me and your responses...
> This note is also to seek some clarity, if I may...
> The clarity desired is prefixed with [BW]...
>
> Bob Wyatt
> -----Original Message-----
> From: Rowland penny <rpenny at samba.org>
> Sent: Saturday, August 17, 2019 1:26 PM
> To: samba at lists.samba.org
> Subject: Re: [Samba] Samba 4.8.3 - Stand-alone server
>
> On 17/08/2019 17:47, Bob Wyatt via samba wrote:
>> The network administrator added the guest parameter when we could not
>> successfully connect otherwise.
>>
>> It is not desired to acquire access as a guest.
> Then remove 'map to guest = Bad User' from [global] and make
> 'AXIARListen' look like this:
>
> [AXIARListen]
>         comment = Axiar Listen directory Retrieval
>         path = /AXIAR/listen
>         read only = no
>         create mask = 0770
>
>>   From my experience with Samba3, I was expecting Windows to cache the
>> credentials until the next user workstation reboot.
> It would, if you create users correctly, which brings us to 'unix
> password sync = no', change the 'no' to 'yes' and create Unix users and
> then make them Samba users with 'smbpasswd -a username' run by root or
> with sudo.
>
>
> [BW] In the STA domain, unix, and samba, using userid bwyatt; passwords
> are the same for the three users. Trying to map the share failed before the
> initial post here, and before the network administrator added the guest clause
> to AxiarListen. I'll test this again after the adjustments recommended.
> Setting passwd sync = 'yes' can be done easily; the current application changes
> the unix password separately from the samba password (as they were version 3).
>
>> The samba login credentials for users added were not in the domain\username
>> format; they were local (to RHEL) login I.D.'s, such as bwyatt.
> Yes, I supposed that they were Unix users.
>> When the user credentials box pops up, I have no way to be rid of the domain
>> part of the credentials; we want to use the same login I.D. (such as bwyatt)
>> for both RHEL/database access and Samba share access.
> on a standalone server another name for 'domain' is 'workgroup' so you
> need to be entering 'STA' here
>> This server's user login is not a domain user I.D.; aside from me, the
>> logins are totally disparate.
> Hard luck, they need to be Unix & Samba users that match your Windows
> users.
>
> [BW] We don’t want Samba being a DC; we were doing standalone to maintain
> some degree of separation between the domain and the database. The issue we'd
> like to avoid is forcing the user to change their samba and unix user passwds
> whenever they change the domain passwd; we fear it will be the forgotten step.
> If we join the database server to the domain (no more separation), and configure
> for single sign-on, will we still need to update samba passwd?
>    
> Two final thoughts, your email client is terrible and if you reply to
> this, please reply to the thread, do not open a new one.
> [BW] Yea, that was my fault. I normally use Outlook (I know) for work, and I
> use gmail for other stuff. It just so happens this address is sync'd in Outlook
> (sorry).
> Rowland
>
>
> Thanks again for your patience and assistance!
>
I think your problems all stem from your efforts to keep everything 
separate ;-)

Even if you do use a standalone server, then your windows users (if you 
want to use authentication) will have to be known to the standalone 
server with the same password (unless they want to be asked for their 
password every time).

If you are running a domain, I do not understand why you do not just 
join the standalone server to the domain as a Unix domain member, all 
your authentication problems would then go away.

Another name for a Windows PC that is not joined to a domain is a 
standalone server, would you run a Windows machine in the same way that 
you are running this Samba machine ?

If you insist on running Samba as a standalone server, then you should 
create any Windows users, that you want to access it, as Unix & Samba 
users using the Same password as the Windows user. You will then need to 
come up with some way to change the passwords on the standalone server 
when the users Window password is changed. Still want to run Samba as a 
standalone server ?

Just one final thought, a group of standalone servers (Unix and/or 
Windows) is called a workgroup and they were terrible to maintain once 
you got past a dozen users/computers because of the user password 
problem, why do you think Microsoft came up with domains in the first 
place, they do not scale.

Rowland