[Samba] Problem with Samba as Member to AD
Mr Typo
euroregistrar at gmail.com
Tue Jul 20 11:03:44 UTC 2021
Hello Louis,
i followed the configuration you posted before and i have a working
system: (same smb.conf)
[root at smbtest-andi ~]# wbinfo -i srvadmsar
srvadmsar:*:1001626:1001013:Server Admin S:/home/srvadmsar:/bin/bash
wbinfo -i itxadmin
itxadmin:*:1001606:1001013::/home/itxadmin:/bin/false
idmap.conf is default on both systems
cat /etc/idmapd.conf |egrep -v '(^#|^$)'
[General]
[Mapping]
[Translation]
[Static]
[UMICH_SCHEMA]
LDAP_server = ldap-server.local.domain.edu
LDAP_base = dc=local,dc=domain,dc=edu
On Tue, Jul 20, 2021 at 12:53 PM L.P.H. van Belle via samba
<samba at lists.samba.org> wrote:
>
> 2 questions?
>
> Did you assign an UID and GID to the users. ( and "domain users" )
> Please read and adjust where needed :
> https://wiki.samba.org/index.php/Idmap_config_ad
>
> If that all correct and you already did set UID/GID
> And if its available, what is in /etc/idmap.conf
>
> Greetz,
>
> Louis
>
>
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Mr
> > Typo via samba
> > Verzonden: dinsdag 20 juli 2021 12:36
> > Aan: Rowland Penny
> > CC: sambalist
> > Onderwerp: Re: [Samba] Problem with Samba as Member to AD
> >
> > Hey Rowland,
> >
> > i hope you can help me again. I cant find the error. I did install a
> > fresh centos and used the same config as we discussed last week.
> >
> > no sssd and no ncsd is configured. i can to a SID to uid lookup, but i
> > cant lookup uids to SID
> >
> > i hope you can help me again, i have no idea where to look..
> >
> > best regards
> >
> > Typo
> >
> > [root at sv2-ftp01p ~]# wbinfo -s S-1-1-0
> > \Everyone 5
> > [root at sv2-ftp01p ~]# wbinfo -s S-1-5-2
> > NT Authority\Network 5
> > [root at sv2-ftp01p ~]# wbinfo -u | head -5
> > administrator
> > gast
> > krbtgt
> > itxadmin
> > itxuser
> > [root at sv2-ftp01p ~]# wbinfo --ping-dc
> > checking the NETLOGON for domain[PFW] dc connection to
> > "sv1-dc01p.pfw.local" succeeded
> > [root at sv2-ftp01p ~]# net ads info
> > LDAP server: 10.40.130.10
> > LDAP server name: sv1-dc01p.pfw.local
> > Realm: PFW.LOCAL
> > Bind Path: dc=PFW,dc=LOCAL
> > LDAP port: 389
> > Server time: Tue, 20 Jul 2021 12:14:29 CEST
> > KDC server: 10.40.130.10
> > Server time offset: 0
> > Last machine account password change: Tue, 20 Jul 2021 11:28:26 CEST
> > [root at sv2-ftp01p ~]# cat /etc/nsswitch.conf|grep winbi
> > passwd: files winbind systemd
> > group: files winbind systemd
> >
> > [root at sv2-ftp01p ~]# id itxadmin
> > id: 'itxadmin': no such user
> > [root at sv2-ftp01p ~]# getent passwd itxadmin
> > [root at sv2-ftp01p ~]# wbinfo -s
> > S-1-5-21-4080695503-475066264-1108356078-1110
> > PFW\adadmsar 1
> > [root at sv2-ftp01p ~]# id adadmsar
> > id: 'adadmsar': no such user
> > [root at sv2-ftp01p ~]# wbinfo -i srvadmsar
> > failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
> >
> >
> >
> >
> > smb.conf
> >
> > [global]
> > workgroup = PFW
> > realm = PFW.LOCAL
> > security = ads
> > idmap config * : backend = tdb
> > idmap config * : range = 3000-7999
> > idmap config PFW:backend = ad
> > idmap config PFW:schema_mode = rfc2307
> > idmap config PFW:range = 10000-999999
> > idmap config PFW:unix_nss_info = yes
> > template homedir = /home/%U
> > template shell = /bin/false
> > winbind use default domain = true
> > winbind enum users = yes
> > winbind offline logon = true
> > log file = /var/log/samba/log.%m
> > max log size = 50
> > log level = 9
> > load printers = no
> > printing = bsd
> > printcap name = /dev/null
> > disable spoolss = yes
> >
> > winbind refresh tickets = Yes
> > vfs objects = acl_xattr
> > map acl inherit = Yes
> > store dos attributes = Yes
> > dedicated keytab file = /etc/krb5.keytab
> > kerberos method = secrets and keytab
> >
> > On Sun, Jul 18, 2021 at 12:27 PM Mr Typo
> > <euroregistrar at gmail.com> wrote:
> > >
> > > Hey Rowland,
> > >
> > > thank you for your answers and help. I found another Layer8 problem
> > > and now it is working as expected.
> > >
> > > thank you again!
> > >
> > > Typo
> > >
> > > On Sun, Jul 18, 2021 at 12:04 PM Rowland Penny via samba
> > > <samba at lists.samba.org> wrote:
> > > >
> > > > On Sun, 2021-07-18 at 11:55 +0200, Mr Typo wrote:
> > > > > Yeah reading attributes from ad, like unixHomeDirectory and
> > > > > loginShell
> > > > >
> > > > > When i understand it right, i can use
> > > > > template homedir = /home/%U
> > > > >
> > > > > for default values and setting the unixHomeDirectory
> > and loginShell
> > > > > if
> > > > > i want another value, correct?
> > > >
> > > > Yes and no :-)
> > > >
> > > > Yes, you can add them to AD, but no they will not be used
> > unless you
> > > > use the winbind ad backend, try reading this:
> > > >
> > https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member
> > > >
> > > > and this:
> > > > https://wiki.samba.org/index.php/Idmap_config_ad
> > > >
> > > > >
> > > > > currently i play with the below configuration but i just the the
> > > > > template values for every user. Any ideas?
> > > > >
> > > > > [global]
> > > > > workgroup = PFW
> > > > > realm = PFW.LOCAL
> > > > > security = ads
> > > > > idmap config * : backend = tdb
> > > > > idmap config * : range = 3000-7999
> > > > > idmap config PFW:backend = ad
> > > > > idmap config PFW:schema_mode = rfc2307
> > > > > idmap config PFW:range = 10000-999999
> > > > > idmap config PFW:unix_nss_info = yes
> > > > > template homedir = /home/%U
> > > > > template shell = /bin/bash
> > > > > # idmap config PFW : backend = rid
> > > > > # idmap config PFW : range = 500-19999999
> > > > > # idmap config PFW : rangesize = 1000000
> > > > > winbind use default domain = true
> > > > > winbind enum users = no
> > > > > winbind offline logon = true
> > > > > log file = /var/log/samba/log.%m
> > > > > max log size = 50
> > > > > log level = 3
> > > > > load printers = no
> > > > > printing = bsd
> > > > > printcap name = /dev/null
> > > > > disable spoolss = yes
> > > > >
> > > >
> > > > That looks okay.
> > > >
> > > > Rowland
> > > >
> > > >
> > > >
> > > > --
> > > > To unsubscribe from this list go to the following URL and read the
> > > > instructions: https://lists.samba.org/mailman/options/samba
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions: https://lists.samba.org/mailman/options/samba
> >
> >
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
More information about the samba
mailing list