On Thursday 31 March 2005 04:40, Meli Marco wrote:> Hi,
> I running samba-3.0.13-1 on RH9
> (openldap-2.0.27-8,krb5-1.2.7-10,nss_ldap-202-5) and configured as show
> below, my intention is only to make IDMAP storage in LDAP using winbind.
> I've looked on SAMBA3 by example book and relatives official guide on
the
> site.
> First I have try to run samba and winbind retriving users and groups from
> ADS and storing them in winbindd_idmap.tdb and winbindd_cache.tdb files and
> it seems to work fine.
> After I have introduce the LDAP backend and relative configuration as shown
> below, but I have received the errors at the bottom of the message.
> Why it doesn't work? I found only example that show domains with only
one
> prefix could I wrong the ldap configuration?
> Thanks.
> Marco.
>
> /etc/samba/smb.conf
> netbios name = XXXX03
> os level = 16
> wins server = XXX.XXX.XXX.XXX
> socket options = IPTOS_LOWDELAY TCP_NODELAY SO_KEEPALIVE
> unix charset = LOCALE
> workgroup = WORKGROUP
> realm = PREFIX1.PREFIX2.COM
> security = ADS
> password server = kdc01.sinter.gkn.com
> encrypt passwords = yes
> winbind use default domain = Yes
> winbind separator = /
> winbind enum users = Yes
> winbind enum groups = Yes
> ldap ssl = No
> ldap admin dn = cn=Manager,dc=prefix1,dc=prefix2,dc=com
> ldap idmap suffix = ou=Idmap
> ldap suffix = dc=prefix1,dc=prefix2,dc=com
> idmap backend = ldap:ldap://localhost
> idmap uid = 10000-40000
> idmap gid = 10000-40000
> hide unreadable = Yes
> template homedir = /data/user/%U
> template shell = /bin/false
> use sendfile = Yes
>
> /etc/nsswitch.conf
> passwd: compat ldap
> shadow: compat ldap
> group: compat ldap
> hosts: files dns wins
>
> /etc/ldap.conf
> host 127.0.0.1
> base dc=prefix1,dc=prefix2,dc=com
> binddn cn=Manager,dc=prefix1,dc=prefix2,dc=com
> bindpw secret
> pam_password exop
> nss_base_passwd ou=People,dc=prefix1,dc=prefix2,dc=com?one
> nss_base_shadow ou=People,dc=prefix1,dc=prefix2,dc=com?one
> nss_base_group ou=Group,dc=prefix1,dc=prefix2,dc=com?one
> ssl no
>
> /etc/openldap/idmap.ldif
> dn: dc=prefix1,dc=prefix2,dc=com
> objectClass: dcObject
> objectClass: organization
> dc: prefix1.prefix2
> o: xxx
> description: xxx
>
> dn: cn=Manager,dc=prefix1,dc=prefix2,dc=com
> objectClass: organizationalRole
> cn: Manager
> description: Directory Manager
>
> dn: ou=Idmap,dc=prefix1,dc=prefix2,dc=com
> objectClass: organizationalUnit
> ou: idmap
>
> /etc/krb5.conf
> [logging]
> default = FILE:/var/log/krb5libs.log <FILE:/var/log/krb5libs.log>
> <FILE:/var/log/krb5libs.log <FILE:/var/log/krb5libs.log> >
> kdc = FILE:/var/log/krb5kdc.log <FILE:/var/log/krb5kdc.log>
> <FILE:/var/log/krb5kdc.log <FILE:/var/log/krb5kdc.log> >
> admin_server = FILE:/var/log/kadmind.log <FILE:/var/log/kadmind.log>
> <FILE:/var/log/kadmind.log <FILE:/var/log/kadmind.log> >
>
> [libdefaults]
> ticket_lifetime = 24000
> default_realm = PREFIX1.PREFIX2.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
>
> [realms]
> PREFIX1.PREFIX2.COM = {
> kdc = KDC01.PREFIX1.PREFIX2.COM
> }
>
> [domain_realm]
> .prefix1.prefix2.com = PREFIX1.PREFIX2.COM
> prefix1.prefix2.com = PREFIX1.PREFIX2.COM
>
> [kdc]
> profile = /var/kerberos/krb5kdc/kdc.conf
>
> [appdefaults]
> pam = {
> debug = false
> ticket_lifetime = 36000
> renew_lifetime = 36000
> forwardable = true
> krb4_convert = false
>
> /var/spool/samba/log.winbindd
> [2005/03/30 17:53:26, 0] sam/idmap.c:idmap_init(138)
> idmap_init: failed to initialize remote backend!
> [2005/03/30 17:53:26, 1] nsswitch/winbindd.c:main(897)
> Could not init idmap -- netlogon proxy only
> [2005/03/30 17:54:34, 1] nsswitch/winbindd_user.c:winbindd_fill_pwent(50)
> error getting user id for sid
> S-1-5-21-597916725-1483147915-620655208-19426
> [2005/03/30 17:54:34, 1] nsswitch/winbindd_user.c:winbindd_fill_pwent(50)
> error getting user id for sid
> S-1-5-21-597916725-1483147915-620655208-19426
Did you store the LDAP server access password 'secret' into the Samba
secrets.tdb file?
smbpasswd -w secret
- John T.
--
John H Terpstra
Samba-Team Member
Phone: +1 (650) 580-8668
Author:
The Official Samba-3 HOWTO & Reference Guide, ISBN: 0131453556
Samba-3 by Example, ISBN: 0131472216
Hardening Linux, ISBN: 0072254971
Other books in production.