samba - Apr 2023 - logon script

Apologies for my english, I am not a native speaker. Well, Samba is an AD
DC. So, the manpage said that I need to use the LDAP
attribute scriptPath. But I don't know how?? I tried creating a new user
with the --script-path option, but it did not work. How can I set this ldap
attribute??

El mar, 4 abr 2023 a las 12:15, Rowland Penny via samba (<
samba at lists.samba.org>) escribi?:
>
>
> On 04/04/2023 16:43, Pastor Frank E. Ram?rez via samba wrote:
> > Hi, I am using Samba 4 with domain controller role.
>
>  From reading your post, I think that when you say 'domain controller
> role', you actually mean a classic domain controller or PDC and not an
> AD DC. Is this correct ?
>
> > The clients use Windows
> > 10. I am trying to run a logon script every time a user logs in to
give
> > them access to the internet automatically by updating iptables. I have
> read
> > in the smb.conf man pages that with this configuration I should use
the
> > ldap scriptpath attribute but I don't know how to do it. Does
anyone have
> > any idea how to achieve this. Thank you.
>
> The relevant part of the smb.conf has this to say about 'logon
script':
>
> If Samba is set up as an Active Directory domain controller, LDAP
> attribute scriptPath is used instead.
> For configurations where passdb backend = ldapsam is in use, this option
> only defines a default value in case LDAP attribute sambaLogonScript is
> missing.
>
>  From that you will need to use the ldap attribute 'scriptPath' if
you
> are using AD and the ldap attribute 'sambaLogonScript' if you are
using
> an ldap based PDC and it falls back to the value set with this parameter
> in smb.conf if the user doesn't have a 'sambaLogonScript'
attribute.
>
> The main problem with all that, the old NT4-style domains are now
> deprecated and will at some point in the future be removed from Samba.
> They rely on the very insecure SMBv1, which is now turned off
> everywhere, though it is still there and can be turned on again.
>
> If you go with AD, you can then start to use GPO's instead of using
> netlogon scripts.
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On 04/04/2023 17:36, Pastor Frank E. Ram?rez via samba
wrote:
> Apologies for my english, I am not a native speaker.
Never apologise for not speaking English like a native, I am English and 
whilst I haven't got a clue what your native language is, I can assure 
that I do not speak a word of it ;-)

< Well, Samba is an AD
> DC. So, the manpage said that I need to use the LDAP
> attribute scriptPath. But I don't know how?? I tried creating a new
user
> with the --script-path option, but it did not work. How can I set this ldap
> attribute??
By the method you seem to have tried, adding '--script-path=SCRIPT_PATH'
(where SCRIPT_PATH is the full path to the script) to the 'samba-tool 
user create' command should have added the attribute and value to the 
users AD object. Perhaps there was a problem with its formatting, can 
you please post the command you used.

Rowland