I've been trying to do this for days, and I think I'm really close.
It's
become one of those so-close-yet-so-far sorts of things. I'm running
Gentoo -- all sync'ed up and current as of a week ago -- with the
following package versions:
openldap-2.1.30-r5
pam_ldap-178-r1
nss_ldap-239-r1
smbldap-tools-0.9.1-r1
phpldapadmin-0.9.5 (very cool, I must say!)
samba-3.0.14a-r2
I've been following the ideal.org howto as closely as I can, but from
what I've google'd since having my problem, I guess it's a little
out of
date. Apparently, you do NOT have to join machines to the domain using a
uid 0 account. However, I don't really care about that; I just want to
get it joined. Specifically, I'm trying to join a Win2K (fully patched)
client to the domain.]
The error I'm getting seems like it ought to be solvable, but I haven't
seen it anywhere on the net, though I've seen one pretty close (full log
below):
smbd[20039]: _samr_create_user: Running the command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
It's clear from "slapd[13182]: conn=999 op=2 RESULT tag=103 err=8
text=modifications requir
e authentication" that I'm not getting logged into the ldap server.
Unfortunately, I don't know how or what to get more logging on to be
able to get any more information. I can use phpldapadmin to triple check
that the password I'm using for root is what's in openldap (and is
different from the root account in /etc/passwd).
There's always another error message in my logs with each attempt, but I
have no idea where it's coming from, and I don't know if it has anything
to do with anything:
rc-scripts: /sbin/runscript.sh: must be root to run init scripts
If I create the machine account with `smbldap-useradd -w' (to try to
join the machine in two steps like can be done in a Windows-only
environment), I get errors in the log about not being able to access the
ldap directory unless root. The stupid part is that I *am* trying to
join the machine as root. (From what I've read, this is a bug. Since I
don't have to have this functionality, I'm not worrying about it.)
Thanks for whatever help anyone can give. It's not like I'm a noob here.
I've run a smbpasswd-backend'ed domain at another site for many years
now. It's just that I'm trying to get everything tied together on my
development machines now, and I'm having no luck. I've already put about
20 hours of research into this, and I just don't know what else to try
(except to wait for the next version of Samba to hit the portage tree).
Regards,
dk
Here's slapd.conf:
----------------
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
database bdb
checkpoint 32 30 # <kbyte> <min>
suffix "dc=starfleet,dc=mil"
rootdn "cn=Manager,dc=starfleet,dc=mil"
rootpw secret
directory /var/lib/openldap-data
index objectClass,uidNumber,gidNumber eq
index cn,sn,uid,displayName pres,sub,eq
index memberUid,mail,givenname eq,subinitial
index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
by self write
by anonymous auth
by * none
access to *
by * read
Here's (the main section of) smb.conf:
-----------------
[global]
workgroup = STARFLEET
server string = Excelsior
map to guest = Bad User
passdb backend = ldapsam:ldap://127.0.0.1/
log level = 9
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/sbin/smbldap -g "%g"
"%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
logon script = startup.bat
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = cn=Manager,dc=starfleet,dc=mil
ldap delete dn = Yes
ldap filter ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
ldap passwd sync = Yes
ldap suffix = dc=starfleet,dc=mil
ldap user suffix = ou=Users
ldap idmap suffix = ou=Users
#enable privileges = Yes
Full log:
------------------------
Aug 8 07:32:08 excelsior slapd[13181]: conn=998 fd=29 ACCEPT from
IP=127.0.0.1:53428 (IP=0.0.0.0:38
9)
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" metho
d=128
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" mechSIMPLE ssf=0
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 RESULT tag=97
err=0 textAug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
base=""
scope=0 filter="(objectClass=*)"
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
attr=supportedControl
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 RESULT tag=101
err=0 textAug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13186]: conn=998
op=3 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13182]: conn=582
op=1163 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 ACCEPT from
IP=127.0.0.1:53429 (IP=0.0.0.0:38
9)
Aug 8 07:32:10 excelsior rc-scripts: /sbin/runscript.sh: must be root
to run init scripts
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SEARCH RESULT
tag=101 err=0 nentries=0 textAug 8 07:32:10 excelsior slapd[13186]: conn=999
op=1 SRCH
base="sambaDomainName=STARFLEET,dc=starfl
eet,dc=mil" scope=0 filter="(objectClass=sambaUnixIdPool)"
Aug 8 07:32:10 excelsior slapd[13186]: conn=999 op=1 SEARCH RESULT
tag=101 err=0 nentries=1 textAug 8 07:32:10 excelsior slapd[13182]: conn=999
op=2 MOD
dn="sambaDomainName=STARFLEET,dc=starfleet
,dc=mil"
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 MOD attr=uidNumber
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 RESULT tag=103
err=8 text=modifications requir
e authentication
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 closed
Aug 8 07:32:10 excelsior smbd[20039]: [2005/08/08 07:32:10, 0]
rpc_server/srv_samr_nt.c:_samr_creat
e_user(2324)
Aug 8 07:32:10 excelsior smbd[20039]: _samr_create_user: Running the
command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
Aug 8 07:32:10 excelsior slapd[13181]: conn=998 fd=29 closed
Hi David
Did you configure smbldap.conf and smbldap_bind.conf for smbldap-tools, did
you run smbldap-populate ?
If the above is fine, then add the following line to your global section of
smb.conf and use administrator to log the machine into the domain.
Thank you,
Mark Adrian Coetser
mark@bwbtrading.co.za, mark@thummb.com
http://www.bwbtrading.co.za http://www.thummb.com
cel: +27 83 296 1199
tel: +27 11 334 7779
-----Original Message-----
From: samba-bounces+mark=thummb.com@lists.samba.org
[mailto:samba-bounces+mark=thummb.com@lists.samba.org] On Behalf Of David
Krider
Sent: 08 August 2005 03:01 PM
To: samba@lists.samba.org
Subject: [Samba] Can't join machines to a Samba PDC using LDAP
I've been trying to do this for days, and I think I'm really close.
It's
become one of those so-close-yet-so-far sorts of things. I'm running
Gentoo -- all sync'ed up and current as of a week ago -- with the
following package versions:
openldap-2.1.30-r5
pam_ldap-178-r1
nss_ldap-239-r1
smbldap-tools-0.9.1-r1
phpldapadmin-0.9.5 (very cool, I must say!)
samba-3.0.14a-r2
I've been following the ideal.org howto as closely as I can, but from
what I've google'd since having my problem, I guess it's a little
out of
date. Apparently, you do NOT have to join machines to the domain using a
uid 0 account. However, I don't really care about that; I just want to
get it joined. Specifically, I'm trying to join a Win2K (fully patched)
client to the domain.]
The error I'm getting seems like it ought to be solvable, but I haven't
seen it anywhere on the net, though I've seen one pretty close (full log
below):
smbd[20039]: _samr_create_user: Running the command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
It's clear from "slapd[13182]: conn=999 op=2 RESULT tag=103 err=8
text=modifications requir
e authentication" that I'm not getting logged into the ldap server.
Unfortunately, I don't know how or what to get more logging on to be
able to get any more information. I can use phpldapadmin to triple check
that the password I'm using for root is what's in openldap (and is
different from the root account in /etc/passwd).
There's always another error message in my logs with each attempt, but I
have no idea where it's coming from, and I don't know if it has anything
to do with anything:
rc-scripts: /sbin/runscript.sh: must be root to run init scripts
If I create the machine account with `smbldap-useradd -w' (to try to
join the machine in two steps like can be done in a Windows-only
environment), I get errors in the log about not being able to access the
ldap directory unless root. The stupid part is that I *am* trying to
join the machine as root. (From what I've read, this is a bug. Since I
don't have to have this functionality, I'm not worrying about it.)
Thanks for whatever help anyone can give. It's not like I'm a noob here.
I've run a smbpasswd-backend'ed domain at another site for many years
now. It's just that I'm trying to get everything tied together on my
development machines now, and I'm having no luck. I've already put about
20 hours of research into this, and I just don't know what else to try
(except to wait for the next version of Samba to hit the portage tree).
Regards,
dk
Here's slapd.conf:
----------------
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
database bdb
checkpoint 32 30 # <kbyte> <min>
suffix "dc=starfleet,dc=mil"
rootdn "cn=Manager,dc=starfleet,dc=mil"
rootpw secret
directory /var/lib/openldap-data
index objectClass,uidNumber,gidNumber eq
index cn,sn,uid,displayName pres,sub,eq
index memberUid,mail,givenname eq,subinitial
index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
by self write
by anonymous auth
by * none
access to *
by * read
Here's (the main section of) smb.conf:
-----------------
[global]
workgroup = STARFLEET
server string = Excelsior
map to guest = Bad User
passdb backend = ldapsam:ldap://127.0.0.1/
log level = 9
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/sbin/smbldap -g "%g"
"%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
logon script = startup.bat
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = cn=Manager,dc=starfleet,dc=mil
ldap delete dn = Yes
ldap filter ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
ldap passwd sync = Yes
ldap suffix = dc=starfleet,dc=mil
ldap user suffix = ou=Users
ldap idmap suffix = ou=Users
#enable privileges = Yes
Full log:
------------------------
Aug 8 07:32:08 excelsior slapd[13181]: conn=998 fd=29 ACCEPT from
IP=127.0.0.1:53428 (IP=0.0.0.0:38
9)
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" metho
d=128
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" mechSIMPLE ssf=0
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 RESULT tag=97
err=0 textAug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
base=""
scope=0 filter="(objectClass=*)"
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
attr=supportedControl
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 RESULT tag=101
err=0 textAug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13186]: conn=998
op=3 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13182]: conn=582
op=1163 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 ACCEPT from
IP=127.0.0.1:53429 (IP=0.0.0.0:38
9)
Aug 8 07:32:10 excelsior rc-scripts: /sbin/runscript.sh: must be root
to run init scripts
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SEARCH RESULT
tag=101 err=0 nentries=0 textAug 8 07:32:10 excelsior slapd[13186]: conn=999
op=1 SRCH
base="sambaDomainName=STARFLEET,dc=starfl
eet,dc=mil" scope=0 filter="(objectClass=sambaUnixIdPool)"
Aug 8 07:32:10 excelsior slapd[13186]: conn=999 op=1 SEARCH RESULT
tag=101 err=0 nentries=1 textAug 8 07:32:10 excelsior slapd[13182]: conn=999
op=2 MOD
dn="sambaDomainName=STARFLEET,dc=starfleet
,dc=mil"
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 MOD attr=uidNumber
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 RESULT tag=103
err=8 text=modifications requir
e authentication
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 closed
Aug 8 07:32:10 excelsior smbd[20039]: [2005/08/08 07:32:10, 0]
rpc_server/srv_samr_nt.c:_samr_creat
e_user(2324)
Aug 8 07:32:10 excelsior smbd[20039]: _samr_create_user: Running the
command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
Aug 8 07:32:10 excelsior slapd[13181]: conn=998 fd=29 closed
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
Whoops forgot the line from smb.conf
###global section
admin users = administrator
Thank you,
Mark Adrian Coetser
mark@bwbtrading.co.za, mark@thummb.com
http://www.bwbtrading.co.za http://www.thummb.com
cel: +27 83 296 1199
tel: +27 11 334 7779
-----Original Message-----
From: samba-bounces+mark=thummb.com@lists.samba.org
[mailto:samba-bounces+mark=thummb.com@lists.samba.org] On Behalf Of David
Krider
Sent: 08 August 2005 03:01 PM
To: samba@lists.samba.org
Subject: [Samba] Can't join machines to a Samba PDC using LDAP
I've been trying to do this for days, and I think I'm really close.
It's
become one of those so-close-yet-so-far sorts of things. I'm running
Gentoo -- all sync'ed up and current as of a week ago -- with the
following package versions:
openldap-2.1.30-r5
pam_ldap-178-r1
nss_ldap-239-r1
smbldap-tools-0.9.1-r1
phpldapadmin-0.9.5 (very cool, I must say!)
samba-3.0.14a-r2
I've been following the ideal.org howto as closely as I can, but from
what I've google'd since having my problem, I guess it's a little
out of
date. Apparently, you do NOT have to join machines to the domain using a
uid 0 account. However, I don't really care about that; I just want to
get it joined. Specifically, I'm trying to join a Win2K (fully patched)
client to the domain.]
The error I'm getting seems like it ought to be solvable, but I haven't
seen it anywhere on the net, though I've seen one pretty close (full log
below):
smbd[20039]: _samr_create_user: Running the command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
It's clear from "slapd[13182]: conn=999 op=2 RESULT tag=103 err=8
text=modifications requir
e authentication" that I'm not getting logged into the ldap server.
Unfortunately, I don't know how or what to get more logging on to be
able to get any more information. I can use phpldapadmin to triple check
that the password I'm using for root is what's in openldap (and is
different from the root account in /etc/passwd).
There's always another error message in my logs with each attempt, but I
have no idea where it's coming from, and I don't know if it has anything
to do with anything:
rc-scripts: /sbin/runscript.sh: must be root to run init scripts
If I create the machine account with `smbldap-useradd -w' (to try to
join the machine in two steps like can be done in a Windows-only
environment), I get errors in the log about not being able to access the
ldap directory unless root. The stupid part is that I *am* trying to
join the machine as root. (From what I've read, this is a bug. Since I
don't have to have this functionality, I'm not worrying about it.)
Thanks for whatever help anyone can give. It's not like I'm a noob here.
I've run a smbpasswd-backend'ed domain at another site for many years
now. It's just that I'm trying to get everything tied together on my
development machines now, and I'm having no luck. I've already put about
20 hours of research into this, and I just don't know what else to try
(except to wait for the next version of Samba to hit the portage tree).
Regards,
dk
Here's slapd.conf:
----------------
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
database bdb
checkpoint 32 30 # <kbyte> <min>
suffix "dc=starfleet,dc=mil"
rootdn "cn=Manager,dc=starfleet,dc=mil"
rootpw secret
directory /var/lib/openldap-data
index objectClass,uidNumber,gidNumber eq
index cn,sn,uid,displayName pres,sub,eq
index memberUid,mail,givenname eq,subinitial
index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
by self write
by anonymous auth
by * none
access to *
by * read
Here's (the main section of) smb.conf:
-----------------
[global]
workgroup = STARFLEET
server string = Excelsior
map to guest = Bad User
passdb backend = ldapsam:ldap://127.0.0.1/
log level = 9
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/sbin/smbldap -g "%g"
"%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
logon script = startup.bat
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = cn=Manager,dc=starfleet,dc=mil
ldap delete dn = Yes
ldap filter ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
ldap passwd sync = Yes
ldap suffix = dc=starfleet,dc=mil
ldap user suffix = ou=Users
ldap idmap suffix = ou=Users
#enable privileges = Yes
Full log:
------------------------
Aug 8 07:32:08 excelsior slapd[13181]: conn=998 fd=29 ACCEPT from
IP=127.0.0.1:53428 (IP=0.0.0.0:38
9)
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" metho
d=128
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 BIND
dn="cn=Manager,dc=starfleet,dc=mil" mechSIMPLE ssf=0
Aug 8 07:32:08 excelsior slapd[13186]: conn=998 op=0 RESULT tag=97
err=0 textAug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
base=""
scope=0 filter="(objectClass=*)"
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 SRCH
attr=supportedControl
Aug 8 07:32:08 excelsior slapd[13182]: conn=998 op=1 RESULT tag=101
err=0 textAug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:08 excelsior slapd[13185]: conn=998 op=2 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13186]: conn=998
op=3 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=sambaSamAccount))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SRCH attr=uid
uidNumber gidNumber homeDirector
y sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime
sambaLogoffTime sambaKickoffTi
me cn displayName sambaHomeDrive sambaHomePath sambaLogonScript
sambaProfilePath description sambaUs
erWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword
sambaNTPassword sambaDomainName objectC
lass sambaAcctFlags sambaMungedDial sambaBadPasswordCount
sambaBadPasswordTime sambaPasswordHistory
modifyTimestamp sambaLogonHours modifyTimestamp
Aug 8 07:32:09 excelsior slapd[13186]: conn=998 op=3 SEARCH RESULT
tag=101 err=0 nentries=2 textAug 8 07:32:09 excelsior slapd[13182]: conn=582
op=1163 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1163 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13185]: conn=582 op=1164 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH
base="ou=Users,dc=starfleet,dc=mil" sc
ope=1 filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13186]: conn=582 op=1165 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH
base="ou=Computers,dc=starfleet,dc=mil
" scope=1
filter="(&(objectClass=posixAccount)(uid=DEFIANT$))"
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SRCH attr=uid
userPassword uidNumber gidNum
ber cn homeDirectory loginShell gecos description objectClass
Aug 8 07:32:09 excelsior slapd[13182]: conn=582 op=1166 SEARCH RESULT
tag=101 err=0 nentries=0 text
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 ACCEPT from
IP=127.0.0.1:53429 (IP=0.0.0.0:38
9)
Aug 8 07:32:10 excelsior rc-scripts: /sbin/runscript.sh: must be root
to run init scripts
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SRCH
base="dc=starfleet,dc=mil" scope=2 filter
="(&(objectClass=posixAccount)(uid=defiant$))"
Aug 8 07:32:10 excelsior slapd[13185]: conn=999 op=0 SEARCH RESULT
tag=101 err=0 nentries=0 textAug 8 07:32:10 excelsior slapd[13186]: conn=999
op=1 SRCH
base="sambaDomainName=STARFLEET,dc=starfl
eet,dc=mil" scope=0 filter="(objectClass=sambaUnixIdPool)"
Aug 8 07:32:10 excelsior slapd[13186]: conn=999 op=1 SEARCH RESULT
tag=101 err=0 nentries=1 textAug 8 07:32:10 excelsior slapd[13182]: conn=999
op=2 MOD
dn="sambaDomainName=STARFLEET,dc=starfleet
,dc=mil"
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 MOD attr=uidNumber
Aug 8 07:32:10 excelsior slapd[13182]: conn=999 op=2 RESULT tag=103
err=8 text=modifications requir
e authentication
Aug 8 07:32:10 excelsior slapd[13181]: conn=999 fd=30 closed
Aug 8 07:32:10 excelsior smbd[20039]: [2005/08/08 07:32:10, 0]
rpc_server/srv_samr_nt.c:_samr_creat
e_user(2324)
Aug 8 07:32:10 excelsior smbd[20039]: _samr_create_user: Running the
command `/usr/sbin/smbldap-u
seradd -w "defiant$"' gave 1
Aug 8 07:32:10 excelsior slapd[13181]: conn=998 fd=29 closed
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba