Hi Rowland,
Thank you.
The actual production domain name is resolvs
The AD migration stage is still being tested and we need to get this
sorted to get a go ahead :)
I've managed to get rid of the message that comes up post the password
change, now it says the password has changed. Only issue is that it doesn't
actually change it. Tailing the /var/log/syslog gives the following
sladp [pid] Entry (uid=psmith,ou=users,ou=resolvs) , attribute
'userPassword; not allowed
entry failed schema check : attribute 'userPassword'
not
allowed
The above comes up right at the time user is changing the password.
This seems to the crux of the issue.
The samba.ldif file was obtained from the 4.3.1 binaries as it is the
version of Samba that we have
sladp is version 2.4.2
-When we change the password using LDAP itself (php console) the user can
login with the new password.
- If try changing password using smbldap-tools it gives us user doesn't
exist.
- If we change using smbpasswd it gives us ( Please note we are using the
root to run this command)
WARNING: The "syslog" option is deprecated
smbldap_search_domain_info: Searching
for:[(&(objectClass=sambaDomain)(sambaDomainName=RESOLVS))]
smbldap_open_connection: connection opened
New SMB password:
Retype new SMB password:
init_sam_from_ldap: Entry found for user: psmith
init_ldap_from_sam: Setting entry for user: psmith
ldapsam_update_sam_account: successfully modified uid = psmith in the LDAP
database
Only that it doesn't.
Here is our smb.conf. We also tried removing all the bits about smldap and
used the editposix option
[global]
workgroup = RESOLVS
netbios name = DC1
security = USER
obey pam restrictions = yes
local master = yes
domain master = yes
preferred master = yes
domain logons = yes
os level = 50
passdb backend = ldapsam:ldap://192.168.1.1
ldap admin dn = cn=admin,dc=resolvs
ldap suffix = dc=example,dc=com
ldap group suffix = ou=groups
ldap machine suffix = ou=computers
ldap user suffix = ou=users
idmap config *: backend = ldap
idmap config *: range = 11000-12999
idmap config *: ldap_url = ldap://localhost/
idmap config *: ldap_base_dn = ou=idmap, dc=resolvs
idmap config *: ldap_user_dn = cn=admin,dc=resolvs
ldap password sync = yes
ldapsam:editposix = yes
ldapsam:trusted = yes
unix password sync = No
Have ran the smbpasswd -w ldappassword
olcSuffix: dc=resolves
olcAccess: {0}to attrs=sambaNTPassword,sambaPwdLastSet,sambaPwdMustChange
by dn="cn=admin,dc=resolvs" write by self write by * none
olcAccess: {1}to attrs=shadowLastChange by self write by * read
Robin
On Thu, Apr 26, 2018 at 8:08 PM, Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Thu, 26 Apr 2018 13:57:12 +1000
> Robin G via samba <samba at lists.samba.org> wrote:
>
> > Hi Rowland,
> >
> > I tried that but didn't work.
> > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
> > # CRC32 9033b998
> > dn: olcDatabase={1}hdb
> > objectClass: olcDatabaseConfig
> > objectClass: olcHdbConfig
> > olcDatabase: {1}hdb
> > olcDbDirectory: /var/lib/ldap
> > olcSuffix: dc=testdom
> > olcAccess: {0}to
> > attrs=sambaNTPassword,sambaPwdLastSet,sambaPwdMustChange by
> > dn="cn=admin,dc=testdom" write by self write by * none
olcAccess:
> > {1}to attrs=shadowLastChange by self write by * read olcLastMod: TRUE
> >
> > smb.conf
> > add user script = /usr/sbin/smbldap-useradd -m '%u'
> > delete user script = /usr/sbin/smbldap-userdel '%u'
> > add group script = /usr/sbin/smbldap-groupadd -p '%g'
> > delete group script = /usr/sbin/smbldap-groupdel '%g'
> > add user to group script = /usr/sbin/smbldap-groupmod -m
'%g'
> > '%u' delete user from group script =
/usr/sbin/smbldap-groupmod -x
> > '%g' '%u'
> > add machine script = /usr/sbin/smbldap-useradd -t 0 -w
"%u"
> > set primary group script = /usr/sbin/smbldap-usermod -g
'%g'
> > '%u' passwd program = /usr/sbin/smbldap-passwd -u %u
> > passwd chat = *Enter\snew\s*\spassword:* %n\n
> > *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully*
> >
> > I get the same message whatever I try, even using smbpasswd %u
doesn't
> > work. If I do ctrl+alt+del and put some rubbish entry in the existing
> > password, it doesn't even tell me that the existing password is
wrong.
> >
>
> One problem (and Louis has already pointed this out) smbldap-tools
> appears to be a dead project, so it is highly unlikely you will get
> this fixed, if it is the culprit.
>
> The thing is, you have this: olcSuffix: dc=testdom
>
> Are you using this in production ? or is this just a test domain ?
> If it is a test domain, then can I suggest you replace it with a test
> AD domain. If it is production, can I urge you to upgrade to an AD
> domain.
>
> It seems that either your ldap setup is totally incorrect or your
> windows machines cannot talk to your ldap server, I would go with the
> later.
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>