On 23/06/15 13:32, David Minard wrote:> I've Set up a DC and a Member Server for a file server. Both are
running on Centos7 and samba version 4.2.2. The Member Server is running smbd
and winbindd.
>
> I've followed the wiki and for the most part it's working.
However, after stuffing up the ranges, then fixing them up, when I create new
accounts, adding all the Unix attributes, the UID_Number is not showing the
correct value for new accounts. Existing ones are okay.
>
> Member_Server Config:
>
> [global]
>
> netbios name = MS1
> workgroup = AD
> security = ADS
> realm = SAMBADOM
> dedicated keytab file = /etc/krb5.keytab
> kerberos method = secrets and keytab
>
> idmap config *:backend = tdb
> idmap config *:range = 30000000-40000000
> idmap config SAMBADOM:backend = ad
> idmap config SAMBADOM:schema_mode = rfc2307
> idmap config SAMBADOM:range = 600-29999999
>
> winbind nss info = rfc2307
> winbind trusted domains only = no
> winbind use default domain = yes
> winbind enum users = yes
> winbind enum groups = yes
> winbind refresh tickets = Yes
>
>
>
> Existing Account:
> getent passwd fred
>
> fred:*:4999:30000000:Fred Nerks:/home/fred:/bin/tcsh
>
> New Account:
>
> fred1:*:30000002:30000000:Fred Nerks:/home/fred1:/bin/tcsh
>
> Fred1 was set up with --uid-number='5004'
>
> I've tried clearing winbindd caches as per some post I read:
>
> systemctl stop winbindd
> rm /usr/local/samba/var/locks/group_mapping.tdb*
/usr/local/samba/var/locks/winbindd_idmap.tdb*
/usr/local/samba/var/locks/winbindd_cache.tdb*
> systemctl start winbindd
>
> But no change.
>
> I've also noticed that the default group that all users are in used to
be "domain users", now for some reason they are all in
"BUILTIN\administrators" !
>
> Am I doing something wrong? If so, what. If not, how do I track down why
this is happening?
>
>
> Cheers,
> David Minard.
> Ph: 0247 360 155
> Fax: 0247 360 770
>
> School of Computing, Engineering, and Mathematics
> Building Y - Penrith Campus (Kingswood)
> Locked bag 1797
> Penrith South DC
> NSW 1797
>
> [Sometimes waking up just isn't worth the insult of the day to come.]
>
>
Yes, you do appear to doing things wrong :-)
workgroup = AD
but:
idmap config SAMBADOM:backend = ad
idmap config SAMBADOM:schema_mode = rfc2307
idmap config SAMBADOM:range = 600-29999999
'SAMBADOM' should be 'AD'
You have 'realm = SAMBADOM' , it really should be something like
'realm
= SAMBADOM.COM'
Rowland