Hi Rowland, The reason is long to explain but shortly it was about huge amount of data ~20TB stored on that server with unix user ID (comming from a S3/LDAP setup). On a DC mode it seems unix ID are in use instead of idmap id. CNAME is in added indeed. Regarding the migration as said we came from S3/LDAP and go to 4.6. The entire future structure is not fixed yet but at this time we have a DC, a Fileserver and 3 other servers which should be simple fileservers (member) but currently are DC Thank you ----- Mail original ----- De: "Rowland Penny via samba" <samba at lists.samba.org> À: samba at lists.samba.org Envoyé: Mardi 29 Août 2017 17:03:59 Objet : Re: [Samba] Shares not accessible when using FQDN On Tue, 29 Aug 2017 16:27:46 +0200 (CEST) Gaetan SLONGO <gslongo at it-optics.com> wrote:> Hi, > > > "CLUSTER" is because this server is related to a computing cluster, > and is the master node of that cluster ;) No relation with Samba > infrastructure, this is just a DNS/Netbios alias. To be honnest the > reason why this server is also a DC is to solve a big issue appeared > when migrating from 3 to 4. We had no other choice because of a > couple of reasons, however it is planed to demote it in the near > future howerver at this time it needs to workOK, but netbios doesn't really work on a DC, also what was the 'big issue' that meant you had to use a DC ?> > > Ok thank you I will try by removing the winbind lines > > > Regarding the share structure I know this is not a good setup at that > time, now we are in the first step : Migrating from 3 to 4, second > step will be better share structure. This is needed to reduce > disruptions. We always operate like this until now and it was always > successful. Why do you say homes are not working on a DC ? We have a > couple of servers which are DC and fileserver at the same time (and > provide homes shares)You might think [homes] is working correctly and it might appear to be working, but it will give problems, why do think we put this: The [homes] feature is not supported running on a Samba Active Directory (AD) domain controller (DC). on the 'Users Home Folder' wiki page ?> > > For now, the biggest issue is shares are not working when using a DNS > alias because a couple of users have network drives or shortcuts > which use themYou will need a CNAME in dns on the DC, but all this seems a bit of an overkill for something that is going to be demoted. I think you need to explain what you are migrating from and what you finally hope to end up with. Rowland -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- www.it-optics.com Gaëtan SLONGO | Head of Infrastructure Department Boulevard Initialis, 28 - 7000 Mons, BELGIUM Company : +32 (0)65 84 23 85 Direct : +32 (0)65 32 85 88 Fax : +32 (0)65 84 66 76 Skype ID : gslongo.pro GPG Key : gslongo-gpg_key.asc - Please consider your environmental responsibility before printing this e-mail -
On Wed, 30 Aug 2017 09:35:29 +0200 (CEST) Gaetan SLONGO <gslongo at it-optics.com> wrote:> Hi Rowland, > > > The reason is long to explain but shortly it was about huge amount of > data ~20TB stored on that server with unix user ID (comming from a > S3/LDAP setup). > On a DC mode it seems unix ID are in use instead of idmap id.No, not really, it is just a different way of doing things. On a DC idmap.ldb is used, this allocates IDs in the '3000000' range on a first come basis, this means that users (and groups) can have different IDs on different DCs. This can be overridden by giving users a uidNumber attribute containing whatever ID you require, the same goes for groups, but with gidNumber attributes.> CNAME is in added indeed. Regarding the migration as said > we came from S3/LDAP and go to 4.6. The entire future structure is > not fixed yet but at this time we have a DC, a Fileserver and 3 other > servers which should be simple fileservers (member) but currently are > DCIf you were only a small organisation, you could use a DC as a fileserver, but you have to be aware of the limitations and backup everything on a regular basis, just how regular depends on how often you change AD, if you change it hourly, you should back it up hourly. However you seem to have large and complex requirements, so you should have at least two DCs with as many Unix domain members running as fileservers as you require. With multiple DCs, you only need to backup one DC, usually the one holding the FSMO roles. You will only need to backup the smb.conf from the fileservers and any data etc that they hold, you do not need to backup any other of the Samba files. You can (and should) use the same smb.conf on all Unix domain members, just don't set the 'netbios name' in any of them, Samba will fill this for you. Rowland
Hi Rowland,
Thank you for your answer.
I think I have found a solution which could solve the issue until the next
migration step. It tested it on another server which is not critital :
* Joining the server as a member and setup the shares as you suggest
* Use nss_ldap instead of nss_winbind (idmap) which will pick my unix ids
In this setup it seems I can access to the shares with any DNS aliases/CNAME
I know it is not a very proper setup but it seem to work and we can do it
quickly
What is your mind about this ?
Thanks
----- Mail original -----
De: "Rowland Penny via samba" <samba at lists.samba.org>
À: samba at lists.samba.org
Envoyé: Mercredi 30 Août 2017 10:06:20
Objet : Re: [Samba] Shares not accessible when using FQDN
On Wed, 30 Aug 2017 09:35:29 +0200 (CEST)
Gaetan SLONGO <gslongo at it-optics.com> wrote:
> Hi Rowland,
>
>
> The reason is long to explain but shortly it was about huge amount of
> data ~20TB stored on that server with unix user ID (comming from a
> S3/LDAP setup).
> On a DC mode it seems unix ID are in use instead of idmap id.
No, not really, it is just a different way of doing things. On a DC
idmap.ldb is used, this allocates IDs in the '3000000' range on a first
come basis, this means that users (and groups) can have different IDs
on different DCs. This can be overridden by giving users a uidNumber
attribute containing whatever ID you require, the same goes for groups,
but with gidNumber attributes.
> CNAME is in added indeed. Regarding the migration as said
> we came from S3/LDAP and go to 4.6. The entire future structure is
> not fixed yet but at this time we have a DC, a Fileserver and 3 other
> servers which should be simple fileservers (member) but currently are
> DC
If you were only a small organisation, you could use a DC as a
fileserver, but you have to be aware of the limitations and backup
everything on a regular basis, just how regular depends on how often
you change AD, if you change it hourly, you should back it up hourly.
However you seem to have large and complex requirements, so you
should have at least two DCs with as many Unix domain members running
as fileservers as you require.
With multiple DCs, you only need to backup one DC, usually the
one holding the FSMO roles. You will only need to backup the smb.conf
from the fileservers and any data etc that they hold, you do not need
to backup any other of the Samba files. You can (and should) use the
same smb.conf on all Unix domain members, just don't set the 'netbios
name' in any of them, Samba will fill this for you.
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba