thr3ads.net - samba - [Samba] Samba PDC + OpenLDAP (Debian Lenny) [Aug 2009]

If this information is useful, please help other people find it:
Share via:

Henrik Dige Semark

2009-Aug-16 10:59 UTC

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

Hey.
I'm trying to move my existing MS-AD over to SAMBA, the place I'm 
working for is changing all servers from MS to Debian, but all the 
clients is still a mixed environment for now.
We have MAC, *NIX, and Windows clients, so its imported that everything 
keeps running in the same or almost the same way as before the change but.

When I try to join a Windows Vista Ultimate ore Windows XP Pro to the 
domain it takes 30 sec and then it says "The machine account dos not 
exist" but as I understand that is what
"add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i
"%u"" has to
do right ?

I have pasted my config + log from OpenLDAP and SAMBA, can anybody see 
what I have don wrung

# cat /etc/samba/smb.conf
-------------------------
# Defining domain name, hostname
####################################################
[global]
       workgroup = MY-DOMAIN
       netbios name = HDS-Linux - PDC
       server string = Debian Samba-PDC %v
       name resolve order = host bcast
       hosts allow = 192.168.1. 192.168.2. 127.
       wins support = yes

       # Network settings #
       #interfaces = 192.168.5.11
       #username map = /etc/samba/smbusers

       # Security #
       security = ads
       realm = MY-DOMAIN
       nt acl support = Yes
       enable privileges = yes
       encrypt passwords = Yes
       obey pam restrictions = Yes
       password server = my-server.my-domain
       #min passwd length = 5
       #pam password change = no

       # method 1:
       #unix password sync = no
       #ldap passwd sync = yes

       # method 2:
       unix password sync = No
       ldap passwd sync = Yes
       passwd program = /usr/sbin/smbldap-passwd -u "%u"
       passwd chat = "Skift kode: *\n Ny kode*" %n\n "*Gentag ny
kode*"
%n\n"

       # Log #
       log level = 1
       syslog = 1
       log file = /var/log/samba/samba_my-domain.log
       max log size = 100000
       socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
       mangling method = hash2
       Dos charset = 850
       Unix charset = ISO8859-1

       # Logon scripts #
       logon script = scripts/logon.bat
       logon path = \\%L\profile\%U
       logon drive = H:
       logon home = \\%L\%u

       # Server settings #
       time server = Yes
       domain logons = Yes
       domain master = Yes
       os level = 65
       preferred master = Yes

       # Winbind settings #
       winbind use default domain = yes
       winbind separator = %
       winbind uid = 10000-21000
       winbind gid = 10000-21000
       winbind enum users = yes
       winbind enum groups = yes
       template homedir = /home/%U

       # LDAP settings #
       # passdb backend = ldapsam:"ldap://ldap1.company.com 
ldap://ldap2.company.com"
       passdb backend = ldapsam:ldap://127.0.0.1/
       ldap admin dn = cn=admin,dc=domain,dc=dk
       ldap suffix = dc=domain,dc=dk
       ldap group suffix = ou=groups
       ldap user suffix = ou=people
       ldap machine suffix = ou=Computers
       ldap idmap suffix = ou=Idmap

       idmap uid = 10000-21000
       idmap gid = 10000-21000

       ldap ssl = No

       ldap delete dn = Yes
       add user script = /usr/sbin/smbldap-useradd -a -m "%u"
       add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u"
       add group script = /usr/sbin/smbldap-groupadd -p "%g"
       add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
       delete user script = /usr/sbin/smbldap-userdel "%u"
       delete group script = /usr/sbin/smbldap-groupdel "%g"
       delete user from group script = /usr/sbin/smbldap-groupmod -x 
"%u" "%g"
       set primary group script = /usr/sbin/smbldap-usermod -g "%u"
"%g"

       # printers configuration #
       printer admin = @"Print Operators"
       load printers = Yes
       create mask = 0640
       directory mask = 0750
       #force create mode = 0640
       #force directory mode = 0750
       printing = cups
       printcap name = cups
       deadtime = 10
       guest account = nobody
       map to guest = Bad User
       dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
       show add printer wizard = yes
       ; to maintain capital letters in shortcuts in any of the profile 
folders:
       preserve case = yes
       short preserve case = yes
       case sensitive = no

[netlogon]
       path = /home/netlogon/
       browseable = No
       read only = yes

[profiles]
       comment = Roaming Profiles
       #path = /var/lib/samba/profiles
       path = /home/profiles
       read only = no
       writeable = yes
       create mask = 0600
       directory mask = 0700
       browseable = No
       guest ok = Yes
       profile acls = yes
       csc policy = disable
       # next line is a great way to secure the profiles
       force user = %U
       # next line allows administrator to access all profiles
       valid users = %U "Domain Admins"

[printers]
       comment = Network Printers
       printer admin = @"Print Operators"
       guest ok = yes
       printable = yes
       path = /home/spool/
       browseable = No
       read only  = Yes
       printable = Yes
       print command = /usr/bin/lpr -P%p -r %s
       lpq command = /usr/bin/lpq -P%p
       lprm command = /usr/bin/lprm -P%p %j
       # print command = /usr/bin/lpr -U%U@%M -P%p -r %s
       # lpq command = /usr/bin/lpq -U%U@%M -P%p
       # lprm command = /usr/bin/lprm -U%U@%M -P%p %j
       # lppause command = /usr/sbin/lpc -U%U@%M hold %p %j
       # lpresume command = /usr/sbin/lpc -U%U@%M release %p %j
       # queuepause command = /usr/sbin/lpc -U%U@%M stop %p
       # queueresume command = /usr/sbin/lpc -U%U@%M start %p

[print$]
       path = /home/printers
       guest ok = No
       browseable = Yes
       read only = Yes
       valid users = @"Print Operators"
       write list = @"Print Operators"
       create mask = 0664
       directory mask = 0775

[public]
       path = /tmp
       guest ok = yes
       browseable = Yes
       writable = yes

[homes]
       path = /home/%u
       comment = Home Directories
       valid users = %u
       read only = No
       browseable = Yes
       create mode = 0750


# tail -200f /var/log/samba/samba_domain.log
--------------------------
[2009/08/14 18:22:24,  1] param/loadparm.c:lp_do_parameter(7202)
 WARNING: The "printer admin" option is deprecated
[2009/08/14 18:22:24,  1] param/loadparm.c:lp_do_parameter(7202)
 WARNING: The "printer admin" option is deprecated
[2009/08/14 18:22:24,  0] passdb/pdb_get_set.c:pdb_get_group_sid(210)
 pdb_get_group_sid: Failed to find Unix account for DomAdmin
[2009/08/14 18:22:24,  1] auth/auth_util.c:make_server_info_sam(562)
 User DomAdmin in passdb, but getpwnam() fails!
[2009/08/14 18:22:24,  0] auth/auth_sam.c:check_sam_security(355)
 check_sam_security: make_server_info_sam() failed with 
'NT_STATUS_NO_SUCH_USER'
[2009/08/14 18:22:47,  0] passdb/pdb_get_set.c:pdb_get_group_sid(210)
 pdb_get_group_sid: Failed to find Unix account for DomAdmin
[2009/08/14 18:22:47,  1] auth/auth_util.c:make_server_info_sam(562)
 User DomAdmin in passdb, but getpwnam() fails!
[2009/08/14 18:22:47,  0] auth/auth_sam.c:check_sam_security(355)
 check_sam_security: make_server_info_sam() failed with 
'NT_STATUS_NO_SUCH_USER'
Error: modifications require authentication at 
/usr/share/perl5/smbldap_tools.pm line 1083.
[2009/08/14 18:22:48,  0] 
passdb/pdb_interface.c:pdb_default_create_user(336)
 _samr_create_user: Running the command `/usr/sbin/smbldap-useradd -t 0 
-w -i "hds$"' gave 127

[2009/08/14 18:23:49,  1] param/loadparm.c:lp_do_parameter(7202)
 WARNING: The "printer admin" option is deprecated
[2009/08/14 18:23:49,  1] param/loadparm.c:lp_do_parameter(7202)
 WARNING: The "printer admin" option is deprecated
[2009/08/14 18:23:49,  1] libads/cldap.c:recv_cldap_netlogon(156)
 no reply received to cldap netlogon
[2009/08/14 18:23:49,  0] printing/nt_printing.c:nt_printing_init(664)
 nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2009/08/14 18:23:49,  0] groupdb/mapping.c:pdb_create_builtin_alias(802)
 pdb_create_builtin_alias: Could not add group mapping entry for alias 
545 (NT_STATUS_GROUP_EXISTS)

tail -200f /var/log/syslog | grep slapd
--------------------------
Aug 14 18:32:33 hds-linux slapd[4180]: connection_get(20)
Aug 14 18:32:33 hds-linux slapd[4180]: SRCH 
"sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0
Aug 14 18:32:33 hds-linux slapd[4180]:     0 15 0
Aug 14 18:32:33 hds-linux slapd[4180]:     filter: 
(?objectClass=sambaTrustedDomainPassword)
Aug 14 18:32:33 hds-linux slapd[4180]:     attrs:
Aug 14 18:32:33 hds-linux slapd[4180]:  sambaDomainName
Aug 14 18:32:33 hds-linux slapd[4180]:  sambaSID
Aug 14 18:32:33 hds-linux slapd[4180]:
Aug 14 18:32:33 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940]
Aug 14 18:32:33 hds-linux slapd[4180]: send_ldap_result: err=0 
matched="" text="value does not conform to assertion syntax"
Aug 14 18:32:46 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: ==> hdb_bind: dn: 
cn=admin,dc=domain,dc=dk
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 
matched="" text=""
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "" 0 0
Aug 14 18:33:01 hds-linux slapd[4180]:     0 0 0
Aug 14 18:33:01 hds-linux slapd[4180]:     filter: (objectClass=*)
Aug 14 18:33:01 hds-linux slapd[4180]:     attrs:
Aug 14 18:33:01 hds-linux slapd[4180]:  supportedControl
Aug 14 18:33:01 hds-linux slapd[4180]:
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 
matched="" text=""
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH 
"sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk"
2 0
Aug 14 18:33:01 hds-linux slapd[4180]:     0 15 0
Aug 14 18:33:01 hds-linux slapd[4180]:     filter: 
(&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN))
Aug 14 18:33:01 hds-linux slapd[4180]:     attrs:
Aug 14 18:33:01 hds-linux slapd[4180]:
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=10 
matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value
does not
conform to assertion syntax"
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0
Aug 14 18:33:01 hds-linux slapd[4180]:     0 15 0
Aug 14 18:33:01 hds-linux slapd[4180]:     filter: 
(&(uid=domadmin)(objectClass=sambaSamAccount))
Aug 14 18:33:01 hds-linux slapd[4180]:     attrs:
Aug 14 18:33:01 hds-linux slapd[4180]:  uid
Aug 14 18:33:01 hds-linux slapd[4180]:  uidNumber
Aug 14 18:33:01 hds-linux slapd[4180]:  gidNumber
[ ... ]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841]
Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 
matched="" text=""
Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 
matched="" text=""
Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14)
[ ... ]
Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 modifications:
Aug 14 18:33:25 hds-linux slapd[4180]: ^Ireplace: uidNumber
Aug 14 18:33:25 hds-linux slapd[4180]: ^I^Ione value, length 5
Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=8 
matched="" text="modifications require authentication"
Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29)
Aug 14 18:33:35 hds-linux slapd[4180]: connection_get(14)

# net groupmap list
--------------------------
Domain Admins (S-1-5-21-3045805106-2558287267-4023452987-512) -> 512
Domain Users (S-1-5-21-3045805106-2558287267-4023452987-513) -> 513
Domain Guests (S-1-5-21-3045805106-2558287267-4023452987-514) -> 514
Domain Computers (S-1-5-21-3045805106-2558287267-4023452987-515) -> 515
Administrators (S-1-5-32-544) -> 544
Account Operators (S-1-5-32-548) -> 548
Print Operators (S-1-5-32-550) -> 550
Backup Operators (S-1-5-32-551) -> 551
Replicators (S-1-5-32-552) -> 552
Users (S-1-5-32-545) -> 10000

System info:
--------------------------
Debian Lenny 5.0.2
Kernel - 2.6.26-2-xen-686

Samba Version 3.2.5
Winbind Version 3.2.5
OpenLDAP Version 2.4.11

if there is more info you need plz just ask :)

-- 
Med Venlig Hilsen / Best regards
Henrik Dige Semark

Mike Eggleston

2009-Aug-16 11:33 UTC

head link

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

On Sun, 16 Aug 2009, Henrik Dige Semark might have said:
> Hey.
> I'm trying to move my existing MS-AD over to SAMBA, the place I'm 
> working for is changing all servers from MS to Debian, but all the 
> clients is still a mixed environment for now.
> We have MAC, *NIX, and Windows clients, so its imported that everything 
> keeps running in the same or almost the same way as before the change but.
> 
> When I try to join a Windows Vista Ultimate ore Windows XP Pro to the 
> domain it takes 30 sec and then it says "The machine account dos not 
> exist" but as I understand that is what
> "add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i
"%u"" has to
> do right ?
> 
> I have pasted my config + log from OpenLDAP and SAMBA, can anybody see 
> what I have don wrung
I'm not at work and am unable to compare your configuration with
my production configuration. I have a similar environment, though,
and found for windows boxes I needed to create the account in LDAP
first (I use smbldap-adduser ...), then I must also add my samba
server as a WINS server to the windows box, then I can join the
windows box to my samba pdc domain.

Mike

Adam Tauno WIlliams

2009-Aug-16 14:59 UTC

head link

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

> I'm trying to move my existing MS-AD over to SAMBA, the place I'm 
So you have an AD domain?  Samba 3.x does not provide an AD domain, it
provides an NT domains, so your requirement of "everything keeps running
in the same or almost the same way" cannot be met.  Unless you want to
try Samba 4.
> When I try to join a Windows Vista Ultimate ore Windows XP Pro to the 
> domain it takes 30 sec and then it says "The machine account dos not 
> exist" but as I understand that is what
> "add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i
"%u"" has to
> do right ?
It is supposed to, yes.
>        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
Get rid of all the "socket options" stuff.  Are you using an old HOWTO
or some crap Wiki entry from somewhere?  Setting this directive is an
OLD habit and very obsolete.  Use only the Samba HOWTO and By-Example as
provided on Samba docs.  Assume everything else on the Internet is
obsolete and out-of-date, because it most likely is.
> [2009/08/14 18:22:24,  0] passdb/pdb_get_set.c:pdb_get_group_sid(210)
>  pdb_get_group_sid: Failed to find Unix account for DomAdmin
> [2009/08/14 18:22:24,  1] auth/auth_util.c:make_server_info_sam(562)
>  User DomAdmin in passdb, but getpwnam() fails!
I don't know why it is looking for a "DomAdmin" account. Perhaps
your
directory is not fully initialized?  Loaded with the required users,
etc...
> Error: modifications require authentication at 
> /usr/share/perl5/smbldap_tools.pm line 1083.
> [2009/08/14 18:22:48,  0] 
> passdb/pdb_interface.c:pdb_default_create_user(336)
>  _samr_create_user: Running the command `/usr/sbin/smbldap-useradd -t 0 
> -w -i "hds$"' gave 127
I don't use smblap-tools but this looks like they don't have sufficient
config to authenticate to the DSA.

Seemingly Similar Threads

Search for more maybe matching threads

samba - Aug 2009 - Samba PDC + OpenLDAP (Debian Lenny)

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

[Samba] Samba PDC + OpenLDAP (Debian Lenny)

Seemingly Similar Threads