samba - Jan 2022 - Samba on CentOS 8 with sssd and AD users/groups and local users/groups

On Fri, 2022-01-14 at 15:07 -0500, Luc Lalonde wrote:
> Interesting... You didn't have problems with missing dependancies?
No, just added the repo, installed pam_krb5 and configured
/etc/security/pam_winbind.conf
> 
> They're really pushing you to use SSSD:
Well they would, it is theirs.
> 
> pam_krb5
> 
> This PAM module provides Kerberos-based authentication. From the
> very 
> beginning of its existence the SSSD project was targeting replacing 
> pam_krb5 on the system. SSSD has offered Kerberos authentication for 
> years, but also much more. With the release of Red Hat Enterprise
> Linux 
> 7.4 SSSD has the features that we believe users need from the
> standard 
> pam_krb5 module, and we felt ready to add it to the set of
> deprecated 
> PAM modules.
> 
> Taken from (you need an account to read it, a free dev account will
> do):
> 
> https://access.redhat.com/solutions/4256011
As far as I remember, the pam_krb5 they removed was their version,
which wasn't very good, and had nothing to do with version that Debian
uses.

I just need to wait until tomorrow and see if my ticket is renewed, as
on Debian.

Rowland

On 1/14/22 14:16, Rowland Penny via samba wrote:
> On Fri, 2022-01-14 at 15:07 -0500, Luc Lalonde wrote:
>> Interesting... You didn't have problems with missing dependancies?
> 
> No, just added the repo, installed pam_krb5 and configured
> /etc/security/pam_winbind.conf
> 
Just in case, what repo did you have to add for this?

>>
>> They're really pushing you to use SSSD:
> 
> Well they would, it is theirs.
> 
>>
>> pam_krb5
>>
>> This PAM module provides Kerberos-based authentication. From the
>> very
>> beginning of its existence the SSSD project was targeting replacing
>> pam_krb5 on the system. SSSD has offered Kerberos authentication for
>> years, but also much more. With the release of Red Hat Enterprise
>> Linux
>> 7.4 SSSD has the features that we believe users need from the
>> standard
>> pam_krb5 module, and we felt ready to add it to the set of
>> deprecated
>> PAM modules.
>>
>> Taken from (you need an account to read it, a free dev account will
>> do):
>>
>> https://access.redhat.com/solutions/4256011
> 
> As far as I remember, the pam_krb5 they removed was their version,
> which wasn't very good, and had nothing to do with version that Debian
> uses.
> 
> I just need to wait until tomorrow and see if my ticket is renewed, as
> on Debian.
> 
> Rowland
>   
> 
>

On Fri, 2022-01-14 at 20:16 +0000, Rowland Penny via samba
wrote:
> On Fri, 2022-01-14 at 15:07 -0500, Luc Lalonde wrote:
> > Interesting... You didn't have problems with missing dependancies?
> 
> No, just added the repo, installed pam_krb5 and configured
> /etc/security/pam_winbind.conf
> 
> > They're really pushing you to use SSSD:
> 
> Well they would, it is theirs.
> 
> > pam_krb5
> > 
> > This PAM module provides Kerberos-based authentication. From the
> > very 
> > beginning of its existence the SSSD project was targeting
> > replacing 
> > pam_krb5 on the system. SSSD has offered Kerberos authentication
> > for 
> > years, but also much more. With the release of Red Hat Enterprise
> > Linux 
> > 7.4 SSSD has the features that we believe users need from the
> > standard 
> > pam_krb5 module, and we felt ready to add it to the set of
> > deprecated 
> > PAM modules.
> > 
> > Taken from (you need an account to read it, a free dev account will
> > do):
> > 
> > https://access.redhat.com/solutions/4256011
> 
> As far as I remember, the pam_krb5 they removed was their version,
> which wasn't very good, and had nothing to do with version that
> Debian
> uses.
> 
> I just need to wait until tomorrow and see if my ticket is renewed,
> as
> on Debian.
> 
> Rowland
Oh, I hate red-hat, No samba-tool (which I can understand because of no
DC code) and ldbsearch doesn't have '-P'

Looks like I need to find an uptodate repo with Samba DC packages.

Rowland