[Samba] AD DC lost sub.conf

[Rowland Penny]

On 02/12/2022 11:15, Callum MacEwan via samba wrote:
> 
>>
>> On 2/12/2022, at 8:26 PM, Rowland Penny via samba <samba at lists.samba.org> wrote:
>>
>> 
>>
>>> On 30/11/2022 20:57, Callum MacEwan via samba wrote:
>>> I have checked all my smb.conf on the AD DC and Dom member
>>> On the AD DC
>>> wbinfo -u and -g respond normally with users and groups prefixed with Domain
>>> Starting samba with -i -d 4 reveals no obvious error it chats to DOM members
>>> The only error I saw was invalid SID (not sure if that is an error or warning )
>>> On Dom Member
>>> wbinfo -u returns nothing but Wbinfo -g returns domain\groups as expected
>>> I have started all modules with -i -d 4 and don’t see any obvious errors
>>> wbinfo -p pings winbindd successfully
>>> wbinfo -P returns an error
>>>> checking the NETLOGON for domain[SAND] dc connection to "" failed
>>>> failed to call wbcPingDc: WBC_ERR_DOMAIN_NOT_FOUND
>>> All the DNS test are good
>>> Any guidance on what to do next appreciated
>>
>> Would you like to answer the question I asked:
> Sorry Rowland with all the restarts the mail server had a meltdown
> 
>>
>> Can you clarify where you where getting those numbers.
> Initially on the DC
> It changed mapping to 3000017 and 100

 From looking at your smb.conf files below, this is what I would expect 
on a DC, unless you added uidNumber & gidNumer attributes.

> The domain controller is also my web server so I login with my domain account and mount the file server so I don’t have permission issues this had been working perfectly for 5 weeks +

It is not really a good idea to use a Samba DC (or any DC for that 
matter) for anything other than authentication.

>>
>> I suppose I should also have asked, how you are getting those numbers ?
> I have remote cameras capturing frames and saving to the server via ftp they started failing with permission issues

Which server ?

>>
>> I think you need to post the smb.conf from the DC and the Unix domain member.
> AD DC sub.conf minus two system volume mounts
> These configs might not be exactly what the working confs were I lost some lines due to a sticky keyboard and lag
> [global]
> bind interfaces only = Yes
> dns forwarder = 210.55.111.1
> interfaces =  127.0.0.1 192.168.50.0/24
> dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool
> netbios name = SAND
> realm = BEACH.PEGASUSNZ.COM
> workgroup = BEACH
> server role = active directory domain controller
> apply group policies = yes
> template shell = /bin/bash
> winbind enum users = yes
> winbind enum groups = yes

I keep telling people this, but nobody seems to listen, you only need 
the 'winbind enum' lines for testing purposes, Samba works perfectly 
well without them.

> log level = 4
> 
> 
> Dom Member
> 
> [global]
> bind interfaces only = Yes
> interfaces = lo 192.168.50.0/24
> netbios name = DUNE
> workgroup = BEACH
> realm = BEACH.PEGASUSNZ.COM
> server role = member server
> security = ADS
> #kerberos method = secrets and keytab
> #dedicated keytab file = /etc/krb5.keytab
> #winbind refresh tickets = Yes
> log file - /var/log/samba/%m.loglog level = 1
> idmap config *: backend = autorid
> idmap config *: range = 100000-2999999
> idmap config BALEWAN : backend = rid
> idmap config BALEWAN : range =10000-99999
> idmap config BALEWAN : unix_nss_info = yes

ARGGGGHHHH!

If you are going to use the 'autorid' idmap backend, you only use the 
'autorid' idmap backend, the other 'rid' lines should be removed (I take 
it you have set up a two trust to BALEWAN), also, you only use 'unix nss 
info' with the 'ad' idmap backend. To put it bluntly, you couldn't have 
got it more wrong.

> template shell = /bin/bash
> #template homedir = /media/home/%U
> username map = /usr/local/samba/etc/user.map

I take that you you used to compile Samba yourself.

Rowland