[Samba] DNS problems (still) with Linux domain members - using Samba's internal DNS backend
gary at extremeground.com
Fri Apr 28 04:13:30 UTC 2023
On 2023-04-27 10:39, Rowland Penny via samba wrote:
> On 27/04/2023 14:37, Gary Dale via samba wrote:
>> If you don't have Unix users then the UIDs and GIDs can't interfere.
>> The idea of interference requires the existence of both sets.
> What happens if something goes wrong, AD doesn't work and you cannot
> log on because you do not have any local Unix users because YOU chose
> to start the AD id's at 1000 ???
I could always log in as root - the one uid that does get mapped.
Besides, there is nothing magic about 1000. It's where Debian starts
numbering users but I've seen other distros use 500.
More to the point, the current Samba variant seems to be incompatible
with local Unix users anyway. Previously Samba used the Unix accounts.
Now they seem to be redundant. I can't even give my Unix account and my
Windows account the same name.
Under previous versions, my Windows account mapped to my Unix account.
Without user mapping, I can only access Samba shares that Windows-only
users access through my Windows account. Unix accounts can't be members
of Windows groups and Windows group can't map to Unix groups either.
In any mixed environment, it seems that the two systems can no longer
co-exist. Instead you have two solitudes. If you want to access things
available to Windows users, you need a Windows account. If you want a
local Unix account, you can't access Windows shares with it. User and
group mapping used to bridge that gap.
> Gary this is getting us nowhere, you say something, I try to help you,
> alter the wiki in some cases, but you keep coming up with more and
> more problems, objections etc, so welcome to my banned list.
I'm just trying to understand the reasoning behind what appears to be a
bizarre set of decisions made by the Samba developers in the last year
that go against a quarter century of Samba practises. Did Microsoft
suddenly inject a lot of money into the project on the condition that
they make it incompatible with a normal Linux infrastructure?
I'm not arguing against what you are telling me. I'm accepting that is
an accurate reflection of the state of Samba. I'm just saying this is a
really bad direction for Samba to take.
Anyway, I now have working a Samba share again, using the ad idmap
backend. However I'm thinking seriously about just using AD for my
Windows VMs to handle their accounts while doing my file sharing to them
with a USB stick kept plugged into the File & Print server. It seems
preferable to ditching all my Unix accounts and moving my Linux machines
More information about the samba