Rowland Penny
2015-Jan-09 09:31 UTC
[Samba] Use Samba with ACL for read Active Directory and set Permissions via it.
On 09/01/15 08:40, Jason Long wrote:> Thanks. > I'm confused. Can I paste "set" command on windows for you? > "jason" account is administrator and can join and dis-join any computer. > > Cheers. > > > > On Wednesday, January 7, 2015 2:59 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: > On 07/01/15 10:51, Jason Long wrote: >> Thank you. >> I changed my "krb5.conf" as below : >> >> >> [logging] >> default = FILE:/var/log/krb5libs.log >> kdc = FILE:/var/log/krb5kdc.log >> admin_server = FILE:/var/log/kadmind.log >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> renew_lifetime = 7d >> forwardable = yes >> default_keytab_name = /etc/krb5.keytab >> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> pkinit_kdc_hostname = <DNS> >> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >> pkinit_eku_checking = kpServerAuth >> pkinit_win2k_require_binding = false >> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >> > My krb5.conf is: > > [libdefaults] > default_realm = EXAMPLE.LAN > dns_lookup_realm = false > dns_lookup_kdc = true > ticket_lifetime = 24h > forwardable = yes > >> and removed "krb5.keytab" too. You told me that my domain name is "jasondomaini" but it is wrong, My domain name is "jasondomain.jj" and backend is "jasondomaini", For example, when I want to login into Windows use "jasondomaini\jason". >> >> After enter the command "net ads join -U jason at jasondomain.jj", My computer joined but when use "net rpc testjoin" , I got same error as below : >> >> Unable to find a suitable server for domain JASONDOMAINI >> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >> >> I don't know why it see domain name as "JASONDOMAINI". How can I edit it? > You shouldn't because 'JASONDOMAINI' *IS* your domain name *NOT* the > backend!!! > > The join command should be 'net ads join -U jason at JASONDOMAIN.JJ' , but > does 'jason' have the required rights to join the domain ?? Try again > but this time use: > > net ads join -U Administrator at JASONDOMAIN.JJ > > and enter the 'Administrator' password when prompted. > > Rowland >> >> Thanks. >> >> >> >> >> On Tuesday, January 6, 2015 12:57 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >> On 06/01/15 06:17, Jason Long wrote: >>> Thanks. >>> My domain name is "jasondomain.jj" and backend is "jasondomaini". >> No, your realm name is "jasondomain.jj" and it would seem that your >> domain name is "jasondomaini", the domain name can also be known as the >> 'workgroup' name. >> >> Set smb.conf to match this: >> >> [global] >> workgroup = JASONDOMAINI >> security = ADS >> realm = JASONDOMAIN.JJ >> dedicated keytab file = /etc/krb5.keytab >> kerberos method = secrets and keytab >> server string = Samba 4 Client %h >> winbind enum users = yes >> winbind enum groups = yes >> winbind use default domain = yes >> winbind expand groups = 4 >> winbind nss info = rfc2307 >> winbind refresh tickets = Yes >> winbind offline logon = yes >> winbind normalize names = Yes >> idmap config * : backend = tdb >> idmap config * : range = 2000-9999 >> idmap config JASONDOMAINI : backend = ad >> idmap config JASONDOMAINI : range = 10000-999999 >> idmap config JASONDOMAINI : schema_mode = rfc2307 >> printcap name = cups >> cups options = raw >> usershare allow guests = yes >> domain master = no >> local master = no >> preferred master = no >> os level = 20 >> map to guest = bad user >> >> set /etc/krb5.conf to this: >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> forwardable = yes >> >> set /etc/resolv.conf >> >> nameserver <ip of your windows server> >> search jasondomain.jj >> >> If /etc/krb5.keytab exists, delete it. >> >> make sure the time on the client matches the server. >> >> then try to join the domain: >> >> net ads join -U Administrator at JASONDOMAIN.JJ >> >> >> Rowland >>> >>> On Monday, January 5, 2015 3:48 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>> On 05/01/15 11:09, Jason Long wrote: >>>> Thank you. >>>> >>>> My Windows is Windows server 2008 R2. >>>> About realm name, My domain name is "JASONDOMAIN.JJ". >>>> My Windows not have any Workgroup Name. It is Domain. >>>> >>>> >>>> Thanks >>>> >>>> >>>> >>>> >>>> On Monday, January 5, 2015 1:05 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>> On 05/01/15 07:02, Jason Long wrote: >>>>> Thanks a lot. >>>>> I changed the below lines to correct domain name : >>>>> >>>>> idmap config JASONDOMAIN : range = 10000-999999 >>>>> idmap config JASONDOMAIN : schema_mode = rfc2307 >>>>> >>>>> and after join, the command "net rpc testjoin" show same error : >>>>> >>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>> >>>>> I have an idea and I guess that "/etc/krb5.conf" has some incorrect options. The file is " >>>>> >>>>> [logging] >>>>> default = FILE:/var/log/krb5libs.log >>>>> kdc = FILE:/var/log/krb5kdc.log >>>>> admin_server = FILE:/var/log/kadmind.log >>>>> >>>>> [libdefaults] >>>>> default_realm = JASONDOMAIN.JJ >>>>> dns_lookup_realm = false >>>>> dns_lookup_kdc = true >>>>> ticket_lifetime = 24h >>>>> renew_lifetime = 7d >>>>> forwardable = yes >>>>> default_keytab_name = /etc/krb5.keytab >>>>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> pkinit_kdc_hostname = <DNS> >>>>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>>>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>>>> pkinit_eku_checking = kpServerAuth >>>>> pkinit_win2k_require_binding = false >>>>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>>>> >>>>> [realms] >>>>> EXAMPLE.COM = { >>>>> kdc = kerberos.example.com >>>>> admin_server = kerberos.example.com >>>>> } >>>>> JASONDOMAIN.JJ = { >>>>> auth_to_local = RULE:[1:$0\$1](^JASONDOMAIN\.JJ\\.*)s/^JASONDOMAIN\.JJ/JASONDOMAINI/ >>>>> auth_to_local = RULE:[1:$0\$1](^ADVER\.JASONDOMAIN\.JJ\\.*)s/^ADVER\.JASONDOMAIN\.JJ/ADVER/ >>>>> auth_to_local = DEFAULT >>>>> } >>>>> >>>>> [domain_realm] >>>>> .example.com = EXAMPLE.COM >>>>> example.com = EXAMPLE.COM >>>>> .JASONDOMAIN.JJ = JASONDOMAIN.JJ >>>>> .adver.JASONDOMAIN.JJ = ADVER.JASONDOMAIN.JJ >>>>> [capaths] >>>>> [appdefaults] >>>>> pam = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> forwardable = true >>>>> validate = true >>>>> } >>>>> httpd = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> reverse_mappings = (.*)@JASONDOMAIN\.JJ JASONDOMAINI\$1 >>>>> } >>>>> >>>>> >>>>> >>>>> What is your idea? I must tell you that after removed LikeWise and configure manually, I can't login to Linux via Windows AD accounts. >>>>> >>>>> >>>>> Thanks. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Sunday, January 4, 2015 5:11 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>> On 04/01/15 13:00, Rowland Penny wrote: >>>>>> On 04/01/15 10:17, Jason Long wrote: >>>>>>> Thanks a lot. >>>>>>> I enter the command and result is : >>>>>>> >>>>>>> Using short domain name -- JASONDOMAINI >>>>>>> Joined 'PRINTMAH' to dns domain 'JASONDOMAIN.JJ' >>>>>>> but after run "net rpc testjoin" : >>>>>>> >>>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>>> >>>>>>> I guess I understand what is my problem. I'm really sorry :(. >>>>>>> >>>>>>> On Windows OS i used "set" command and it show me : >>>>>>> >>>>>>> USERDNSDOMAIN= JASONDOMAIN.JJ >>>>>>> USERDOMAIN= JASONDOMAINI >>>>>>> >>>>>>> I guess that I must change "JASONDOMAINI" in below texts to >>>>>>> "JASONDOMAIN" : >>>>>>> >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> >>>>>>> Am I right? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Saturday, January 3, 2015 7:44 AM, Rowland Penny >>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>> On 03/01/15 15:08, Jason Long wrote: >>>>>>>> Thank you. >>>>>>>> I used below videos for join my Linux Box to Windows domain : >>>>>>>> >>>>>>>> http://www.youtube.com/watch?v=Y3TFPDT9uic >>>>>>>> >>>>>>>> Please look at this video and I used instructions in it and >>>>>>>> LikeWiseOpen tool. >>>>>>>> >>>>>>>> >>>>>>>> Cheers. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Saturday, January 3, 2015 5:45 AM, Rowland Penny >>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>> On 03/01/15 12:38, Jason Long wrote: >>>>>>>>> Thanks. >>>>>>>>> >>>>>>>>> I enter "net ads testjoin" and it show me : >>>>>>>>> >>>>>>>>> ads_connect: No logon servers >>>>>>>>> Join to domain is not valid: No logon servers >>>>>>>> You are *not* joined to the domain, I suppose this should have been >>>>>>>> asked earlier, but how did you do the domain join ? >>>>>>>> >>>>>>>> Rowland >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> If it is incorrect, Why I can Login to Linux via Windows account? >>>>>>>>> As you see, I followed the steps on Video. >>>>>>>>> >>>>>>>>> :(. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Saturday, January 3, 2015 1:13 AM, Rowland Penny >>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>> On 03/01/15 05:41, Jason Long wrote: >>>>>>>>>> Thank you. >>>>>>>>>> Command show below error : >>>>>>>>>> >>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>> >>>>>>>>>> :( >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Wednesday, December 31, 2014 2:05 AM, Rowland Penny >>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>> On 31/12/14 09:55, Jason Long wrote: >>>>>>>>>>> Thanks. >>>>>>>>>>> I changed the command as below : >>>>>>>>>>> >>>>>>>>>>> #net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>> SeDiskOperatorPrivilege -U jasondomain\\administrator -I 192.168.1.1 >>>>>>>>>>> >>>>>>>>>>> But Got below error : >>>>>>>>>>> >>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>> >>>>>>>>>>> Cheers. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Wednesday, December 31, 2014 1:35 AM, Rowland Penny >>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>> On 31/12/14 09:17, Jason Long wrote: >>>>>>>>>>>> Thank you so much but I run below commands on linux : >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>> # net rpc rights list accounts -Uadministrator >>>>>>>>>>>> >>>>>>>>>>>> it ask me a password for "administrator: >>>>>>>>>>>> >>>>>>>>>>>> Enter administrator's password: >>>>>>>>>>>> Could not connect to server 127.0.0.1 >>>>>>>>>>>> Connection failed: NT_STATUS_NO_LOGON_SERVERS >>>>>>>>>>>> >>>>>>>>>>>> Must I enter windows administrator password? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Thanks. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Monday, December 29, 2014 5:10 AM, Rowland Penny >>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>> On 29/12/14 12:52, Jason Long wrote: >>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>> >>>>>>>>>>>>> I did some changes like below : >>>>>>>>>>>>> >>>>>>>>>>>>> /dev/mapper/vg_print-lv_root / ext4 >>>>>>>>>>>>> user_xattr,acl,defaults 1 1 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Then "lsof | grep /dev/mapper/vg_print-lv_root" not have any >>>>>>>>>>>>> output. >>>>>>>>>>>>> I added below lines to [global] section too : >>>>>>>>>>>>> >>>>>>>>>>>>> vfs objects = acl_xattr >>>>>>>>>>>>> map acl inherit = Yes >>>>>>>>>>>>> store dos attributes = Yes >>>>>>>>>>>>> >>>>>>>>>>>>> But about below commands can you tell me more? >>>>>>>>>>>>> >>>>>>>>>>>>> net rpc rights grant 'SAMDOM\Domain Admins' >>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>> net rpc rights list accounts -Uadministrator >>>>>>>>>>>>> >>>>>>>>>>>>> I hope they are not Dangerous!!!! >>>>>>>>>>>> No :-) >>>>>>>>>>>> >>>>>>>>>>>> The first one gives members of Domain Admins the right to change >>>>>>>>>>>> windows >>>>>>>>>>>> ACL's on a share >>>>>>>>>>>> The second list accounts and what rights they have. >>>>>>>>>>>> >>>>>>>>>>>>> In the >>>>>>>>>>>>> "https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs" >>>>>>>>>>>>> , the other steps are in Windows!!! Can I doing via Linux too? >>>>>>>>>>>> Yes, but it is just easier via windows >>>>>>>>>>>> >>>>>>>>>>>> Rowland >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> Thanks. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday, December 29, 2014 1:59 AM, Rowland Penny >>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>> On 29/12/14 06:38, Jason Long wrote: >>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>> You right, My realm is "jasondomaini.jasondomain.jj" and I >>>>>>>>>>>>>> change configure as below : >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = JASONDOMAINI >>>>>>>>>>>>>> server string = Samba Server Version %v >>>>>>>>>>>>>> # logs split per machine >>>>>>>>>>>>>> log file = /var/log/samba/log.%m >>>>>>>>>>>>>> # max 50KB per log file, then rotate >>>>>>>>>>>>>> max log size = 50 >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>>>>>>>> passdb backend = tdbsam >>>>>>>>>>>>>> load printers = yes >>>>>>>>>>>>>> cups options = raw >>>>>>>>>>>>>> idmap config *:backend = tdb >>>>>>>>>>>>>> idmap config *:range = 70001-80000 >>>>>>>>>>>>>> #idmap config SAMDOM:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:schema_mode = rfc2307 >>>>>>>>>>>>>> idmap config JASONDOMAINI:range = 500-40000 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> When I use "SSH" on my CentOS and enter "jasondomain\jason", >>>>>>>>>>>>>> It show me the root partition and I can open "Test" directory >>>>>>>>>>>>>> But it has two problems : >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1- Why it show root partition? >>>>>>>>>>>>>> 2- I can't browse it via Windows explorer!!! >>>>>>>>>>>>>> >>>>>>>>>>>>>> I want to know use AD users in Linux is Hard? >>>>>>>>>>>>>> >>>>>>>>>>>>>> In your opinion I used a correct command to set ACL? >>>>>>>>>>>>>> >>>>>>>>>>>>>> #getfacl test/ >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # file: test/ >>>>>>>>>>>>>> # owner: JASONDOMAINI\134JASON >>>>>>>>>>>>>> # group: JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> user::rwx >>>>>>>>>>>>>> group::r-x >>>>>>>>>>>>>> group:JASONDOMAINI\134grp-JASON-rw:rwx >>>>>>>>>>>>>> mask::rwx >>>>>>>>>>>>>> other::r-x >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> and in "getent group" it show me below group : >>>>>>>>>>>>>> >>>>>>>>>>>>>> JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> in your idea, Am I use correct command to set permission? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Sunday, December 28, 2014 9:37 AM, Rowland Penny >>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>> On 28/12/14 15:48, Jason Long wrote: >>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>> Thus I must change "idmap config JASONDOMAIN.JJ:backend = ad >>>>>>>>>>>>>>> " to "idmap config JASONDOMAIN:backend = ad". >>>>>>>>>>>>>>> How about Workgroup? is must change "JASONDOMAIN" too? >>>>>>>>>>>>>>> About your question I must say that I Test this share via >>>>>>>>>>>>>>> Linux too and Windows and Linux has same problem. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> About "What I would do is, install the OpenSSH server on the >>>>>>>>>>>>>>> linux machine, install 'PUTTY' on a windows machine and try >>>>>>>>>>>>>>> to login via 'PUTTY' and use the SSH protocol." , You mean is >>>>>>>>>>>>>>> that Windows clients use SSH to work with this directory? I >>>>>>>>>>>>>>> want to made this Linux Box as a File server and Windows >>>>>>>>>>>>>>> Clients need graphical browser to copy and paste file into >>>>>>>>>>>>>>> this directory!!!!!!! >>>>>>>>>>>>>>> What is your idea? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> I am loosing track here a bit, but if your dns domain is >>>>>>>>>>>>>> example.com, >>>>>>>>>>>>>> then your windows AD realm should be something like >>>>>>>>>>>>>> internal.example.com >>>>>>>>>>>>>> and your workgroup/domain name should be INTERNAL, that is, >>>>>>>>>>>>>> they all >>>>>>>>>>>>>> rely on each other. >>>>>>>>>>>>>> >>>>>>>>>>>>>> So anywhere that you come across these, you should use the >>>>>>>>>>>>>> relevant one, >>>>>>>>>>>>>> this is the relevant parts from a Unix client on my domain: >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = INTERNAL >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = INTERNAL.EXAMPLE.COM >>>>>>>>>>>>>> .......... >>>>>>>>>>>>>> idmap config * : backend = tdb >>>>>>>>>>>>>> idmap config * : range = 2000-9999 >>>>>>>>>>>>>> idmap config INTERNAL : backend = ad >>>>>>>>>>>>>> idmap config INTERNAL : range = 10000-999999 >>>>>>>>>>>>>> idmap config INTERNAL : schema_mode = rfc2307 >>>>>>>>>>>>>> >>>>>>>>>>>>>> As for using 'PUTTY', this was just a way of testing whether >>>>>>>>>>>>>> you can >>>>>>>>>>>>>> connect to the Unix machine. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Rowland >>>>>>>>>>>>> OK, we are getting closer >>>>>>>>>>>>> >>>>>>>>>>>>> right, answers to your questions >>>>>>>>>>>>> 1) I think that you may find that this is also printed 'Could >>>>>>>>>>>>> not chdir >>>>>>>>>>>>> to home directory', in which case you will end up in the root >>>>>>>>>>>>> of computer. >>>>>>>>>>>>> >>>>>>>>>>>>> 2) Are you running the 'nmbd' daemon ? Even if this is not >>>>>>>>>>>>> running you >>>>>>>>>>>>> should be able to navigate to the share by entering the path. >>>>>>>>>>>>> Have a >>>>>>>>>>>>> look here: >>>>>>>>>>>>> >>>>>>>>>>>>> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Rowland >>>>>>>>>>>>> >>>>>>>>>>> You are trying to run the command on a client, try adding either: >>>>>>>>>>> >>>>>>>>>>> -S server name >>>>>>>>>>> >>>>>>>>>>> OR >>>>>>>>>>> >>>>>>>>>>> -I address of target server >>>>>>>>>>> >>>>>>>>>>> where 'server' is the AD DC. >>>>>>>>>>> >>>>>>>>>>> Yes, you need to supply the password of the Domain Administrator. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Rowland >>>>>>>>>>> >>>>>>>>>> OK, try it like this: >>>>>>>>>> >>>>>>>>>> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege >>>>>>>>>> -UAdministrator -I 192.168.1.1 >>>>>>>>>> >>>>>>>>>> This works for me on a client joined to the domain. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Rowland >>>>>>>>>> >>>>>>>>> Sounds like something is wrong with the join, what does 'net ads >>>>>>>>> testjoin' return ? You may have to run this command with sudo. >>>>>>>>> >>>>>>>>> >>>>>>>>> Rowland >>>>>>>>> >>>>>>> Sometimes I wonder why all the time is spent on keeping the samba wiki >>>>>>> updated. Likewiseopen was replaced sometime ago by PowerBroker Open, I >>>>>>> cannot recommend using either of these, because quite simply, they are >>>>>>> not needed. >>>>>>> >>>>>>> Check the following files: >>>>>>> >>>>>>> /etc/samba/smb.conf >>>>>>> >>>>>>> [global] >>>>>>> workgroup = JASONDOMAINI >>>>>>> security = ADS >>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dedicated keytab file = /etc/krb5.keytab >>>>>>> kerberos method = secrets and keytab >>>>>>> server string = Samba 4 Client %h >>>>>>> winbind enum users = yes >>>>>>> winbind enum groups = yes >>>>>>> winbind use default domain = yes >>>>>>> winbind expand groups = 4 >>>>>>> winbind nss info = rfc2307 >>>>>>> winbind refresh tickets = Yes >>>>>>> winbind normalize names = Yes >>>>>>> idmap config * : backend = tdb >>>>>>> idmap config * : range = 2000-9999 >>>>>>> idmap config JASONDOMAINI : backend = ad >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> printcap name = cups >>>>>>> cups options = raw >>>>>>> usershare allow guests = yes >>>>>>> domain master = no >>>>>>> local master = no >>>>>>> preferred master = no >>>>>>> os level = 20 >>>>>>> map to guest = bad user >>>>>>> vfs objects = acl_xattr >>>>>>> map acl inherit = Yes >>>>>>> store dos attributes = Yes >>>>>>> log level = 6 >>>>>>> >>>>>>> /etc/krb5.conf >>>>>>> >>>>>>> [libdefaults] >>>>>>> default_realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dns_lookup_realm = false >>>>>>> dns_lookup_kdc = true >>>>>>> ticket_lifetime = 24h >>>>>>> forwardable = yes >>>>>>> >>>>>>> /etc/resolv.conf >>>>>>> >>>>>>> nameserver <your AD DC's ipaddress> >>>>>>> search jasondomaini.jasondomain.jj >>>>>>> >>>>>>> If required, alter them to match the above, check that 'hostname' >>>>>>> returns only the hostname of the client, check that 'hostname -f' >>>>>>> returns the FQDN. If either are not correct, fix them. >>>>>>> >>>>>>> Remove likewiseopen >>>>>>> >>>>>>> Once everything is correct, run the following command: >>>>>>> >>>>>>> net ads join -U Administrator at JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> >>>>>>> You should be asked for the domain Administrators password, enter this >>>>>>> and you should join the domain >>>>>>> >>>>>>> Rowland >>>>>>> >>>>>> What Windows DC are you using ? >>>>>> What is the realm name * workgroup name on the Windows DC ? >>>>>> >>>>>> Rowland >>>>> oops, that should have been: >>>>> >>>>> >>>>> What is the realm name & workgroup name on the Windows DC ? >>>>> >>>>> Rowland >>>>> >>>> Hi, will you answer these questions: >>>> >>>> What Windows DC are you using ? >>>> What is the realm name on the Windows DC ? >>>> What is the workgroup name on the Windows DC ? >>>> >>>> You do not need all of what you have in /etc/krb5.conf, but please >>>> answer the questions above first. >>>> >>>> Rowland >>>> >>> OK, so what is your 'domain' name (and No, it is not 'JASONDOMAIN.JJ') >>> >>> Rowland >>>Your confused !!! looking back over what you posted I found this: Thanks a lot. I changed the below lines to correct domain name : idmap config JASONDOMAIN : range = 10000-999999 idmap config JASONDOMAIN : schema_mode = rfc2307 and after join, the command "net rpc testjoin" show same error : Unable to find a suitable server for domain JASONDOMAINI Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL this was 05/01/15 07:02 Totally missed it then, but now it sticks out like a sore thumb, is your workgroup/NETBiosdomain 'JASONDOMAIN' *OR* 'JASONDOMAINI' ????? Rowland
Jason Long
2015-Jan-10 07:14 UTC
[Samba] Use Samba with ACL for read Active Directory and set Permissions via it.
Thank you. I'm really sorry Bro. You right, When I get properties from AD, "Domain name(Pre-Windows 2000)" is "JASONDOMAINI". I'm sorry :( but when I want to join a Windows client to my domain I use "JASONDOMAIN.JJ" !!!! I guess that we must change SAMBA configuration. Cheers. On Friday, January 9, 2015 1:55 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: On 09/01/15 08:40, Jason Long wrote:> Thanks. > I'm confused. Can I paste "set" command on windows for you? > "jason" account is administrator and can join and dis-join any computer. > > Cheers. > > > > On Wednesday, January 7, 2015 2:59 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: > On 07/01/15 10:51, Jason Long wrote: >> Thank you. >> I changed my "krb5.conf" as below : >> >> >> [logging] >> default = FILE:/var/log/krb5libs.log >> kdc = FILE:/var/log/krb5kdc.log >> admin_server = FILE:/var/log/kadmind.log >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> renew_lifetime = 7d >> forwardable = yes >> default_keytab_name = /etc/krb5.keytab >> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> pkinit_kdc_hostname = <DNS> >> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >> pkinit_eku_checking = kpServerAuth >> pkinit_win2k_require_binding = false >> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >> > My krb5.conf is: > > [libdefaults] > default_realm = EXAMPLE.LAN > dns_lookup_realm = false > dns_lookup_kdc = true > ticket_lifetime = 24h > forwardable = yes > >> and removed "krb5.keytab" too. You told me that my domain name is "jasondomaini" but it is wrong, My domain name is "jasondomain.jj" and backend is "jasondomaini", For example, when I want to login into Windows use "jasondomaini\jason". >> >> After enter the command "net ads join -U jason at jasondomain.jj", My computer joined but when use "net rpc testjoin" , I got same error as below : >> >> Unable to find a suitable server for domain JASONDOMAINI >> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >> >> I don't know why it see domain name as "JASONDOMAINI". How can I edit it? > You shouldn't because 'JASONDOMAINI' *IS* your domain name *NOT* the > backend!!! > > The join command should be 'net ads join -U jason at JASONDOMAIN.JJ' , but > does 'jason' have the required rights to join the domain ?? Try again > but this time use: > > net ads join -U Administrator at JASONDOMAIN.JJ > > and enter the 'Administrator' password when prompted. > > Rowland >> >> Thanks. >> >> >> >> >> On Tuesday, January 6, 2015 12:57 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >> On 06/01/15 06:17, Jason Long wrote: >>> Thanks. >>> My domain name is "jasondomain.jj" and backend is "jasondomaini". >> No, your realm name is "jasondomain.jj" and it would seem that your >> domain name is "jasondomaini", the domain name can also be known as the >> 'workgroup' name. >> >> Set smb.conf to match this: >> >> [global] >> workgroup = JASONDOMAINI >> security = ADS >> realm = JASONDOMAIN.JJ >> dedicated keytab file = /etc/krb5.keytab >> kerberos method = secrets and keytab >> server string = Samba 4 Client %h >> winbind enum users = yes >> winbind enum groups = yes >> winbind use default domain = yes >> winbind expand groups = 4 >> winbind nss info = rfc2307 >> winbind refresh tickets = Yes >> winbind offline logon = yes >> winbind normalize names = Yes >> idmap config * : backend = tdb >> idmap config * : range = 2000-9999 >> idmap config JASONDOMAINI : backend = ad >> idmap config JASONDOMAINI : range = 10000-999999 >> idmap config JASONDOMAINI : schema_mode = rfc2307 >> printcap name = cups >> cups options = raw >> usershare allow guests = yes >> domain master = no >> local master = no >> preferred master = no >> os level = 20 >> map to guest = bad user >> >> set /etc/krb5.conf to this: >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> forwardable = yes >> >> set /etc/resolv.conf >> >> nameserver <ip of your windows server> >> search jasondomain.jj >> >> If /etc/krb5.keytab exists, delete it. >> >> make sure the time on the client matches the server. >> >> then try to join the domain: >> >> net ads join -U Administrator at JASONDOMAIN.JJ >> >> >> Rowland >>> >>> On Monday, January 5, 2015 3:48 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>> On 05/01/15 11:09, Jason Long wrote: >>>> Thank you. >>>> >>>> My Windows is Windows server 2008 R2. >>>> About realm name, My domain name is "JASONDOMAIN.JJ". >>>> My Windows not have any Workgroup Name. It is Domain. >>>> >>>> >>>> Thanks >>>> >>>> >>>> >>>> >>>> On Monday, January 5, 2015 1:05 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>> On 05/01/15 07:02, Jason Long wrote: >>>>> Thanks a lot. >>>>> I changed the below lines to correct domain name : >>>>> >>>>> idmap config JASONDOMAIN : range = 10000-999999 >>>>> idmap config JASONDOMAIN : schema_mode = rfc2307 >>>>> >>>>> and after join, the command "net rpc testjoin" show same error : >>>>> >>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>> >>>>> I have an idea and I guess that "/etc/krb5.conf" has some incorrect options. The file is " >>>>> >>>>> [logging] >>>>> default = FILE:/var/log/krb5libs.log >>>>> kdc = FILE:/var/log/krb5kdc.log >>>>> admin_server = FILE:/var/log/kadmind.log >>>>> >>>>> [libdefaults] >>>>> default_realm = JASONDOMAIN.JJ >>>>> dns_lookup_realm = false >>>>> dns_lookup_kdc = true >>>>> ticket_lifetime = 24h >>>>> renew_lifetime = 7d >>>>> forwardable = yes >>>>> default_keytab_name = /etc/krb5.keytab >>>>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> pkinit_kdc_hostname = <DNS> >>>>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>>>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>>>> pkinit_eku_checking = kpServerAuth >>>>> pkinit_win2k_require_binding = false >>>>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>>>> >>>>> [realms] >>>>> EXAMPLE.COM = { >>>>> kdc = kerberos.example.com >>>>> admin_server = kerberos.example.com >>>>> } >>>>> JASONDOMAIN.JJ = { >>>>> auth_to_local = RULE:[1:$0\$1](^JASONDOMAIN\.JJ\\.*)s/^JASONDOMAIN\.JJ/JASONDOMAINI/ >>>>> auth_to_local = RULE:[1:$0\$1](^ADVER\.JASONDOMAIN\.JJ\\.*)s/^ADVER\.JASONDOMAIN\.JJ/ADVER/ >>>>> auth_to_local = DEFAULT >>>>> } >>>>> >>>>> [domain_realm] >>>>> .example.com = EXAMPLE.COM >>>>> example.com = EXAMPLE.COM >>>>> .JASONDOMAIN.JJ = JASONDOMAIN.JJ >>>>> .adver.JASONDOMAIN.JJ = ADVER.JASONDOMAIN.JJ >>>>> [capaths] >>>>> [appdefaults] >>>>> pam = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> forwardable = true >>>>> validate = true >>>>> } >>>>> httpd = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> reverse_mappings = (.*)@JASONDOMAIN\.JJ JASONDOMAINI\$1 >>>>> } >>>>> >>>>> >>>>> >>>>> What is your idea? I must tell you that after removed LikeWise and configure manually, I can't login to Linux via Windows AD accounts. >>>>> >>>>> >>>>> Thanks. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Sunday, January 4, 2015 5:11 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>> On 04/01/15 13:00, Rowland Penny wrote: >>>>>> On 04/01/15 10:17, Jason Long wrote: >>>>>>> Thanks a lot. >>>>>>> I enter the command and result is : >>>>>>> >>>>>>> Using short domain name -- JASONDOMAINI >>>>>>> Joined 'PRINTMAH' to dns domain 'JASONDOMAIN.JJ' >>>>>>> but after run "net rpc testjoin" : >>>>>>> >>>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>>> >>>>>>> I guess I understand what is my problem. I'm really sorry :(. >>>>>>> >>>>>>> On Windows OS i used "set" command and it show me : >>>>>>> >>>>>>> USERDNSDOMAIN= JASONDOMAIN.JJ >>>>>>> USERDOMAIN= JASONDOMAINI >>>>>>> >>>>>>> I guess that I must change "JASONDOMAINI" in below texts to >>>>>>> "JASONDOMAIN" : >>>>>>> >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> >>>>>>> Am I right? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Saturday, January 3, 2015 7:44 AM, Rowland Penny >>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>> On 03/01/15 15:08, Jason Long wrote: >>>>>>>> Thank you. >>>>>>>> I used below videos for join my Linux Box to Windows domain : >>>>>>>> >>>>>>>> http://www.youtube.com/watch?v=Y3TFPDT9uic >>>>>>>> >>>>>>>> Please look at this video and I used instructions in it and >>>>>>>> LikeWiseOpen tool. >>>>>>>> >>>>>>>> >>>>>>>> Cheers. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Saturday, January 3, 2015 5:45 AM, Rowland Penny >>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>> On 03/01/15 12:38, Jason Long wrote: >>>>>>>>> Thanks. >>>>>>>>> >>>>>>>>> I enter "net ads testjoin" and it show me : >>>>>>>>> >>>>>>>>> ads_connect: No logon servers >>>>>>>>> Join to domain is not valid: No logon servers >>>>>>>> You are *not* joined to the domain, I suppose this should have been >>>>>>>> asked earlier, but how did you do the domain join ? >>>>>>>> >>>>>>>> Rowland >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> If it is incorrect, Why I can Login to Linux via Windows account? >>>>>>>>> As you see, I followed the steps on Video. >>>>>>>>> >>>>>>>>> :(. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Saturday, January 3, 2015 1:13 AM, Rowland Penny >>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>> On 03/01/15 05:41, Jason Long wrote: >>>>>>>>>> Thank you. >>>>>>>>>> Command show below error : >>>>>>>>>> >>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>> >>>>>>>>>> :( >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Wednesday, December 31, 2014 2:05 AM, Rowland Penny >>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>> On 31/12/14 09:55, Jason Long wrote: >>>>>>>>>>> Thanks. >>>>>>>>>>> I changed the command as below : >>>>>>>>>>> >>>>>>>>>>> #net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>> SeDiskOperatorPrivilege -U jasondomain\\administrator -I 192.168.1.1 >>>>>>>>>>> >>>>>>>>>>> But Got below error : >>>>>>>>>>> >>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>> >>>>>>>>>>> Cheers. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Wednesday, December 31, 2014 1:35 AM, Rowland Penny >>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>> On 31/12/14 09:17, Jason Long wrote: >>>>>>>>>>>> Thank you so much but I run below commands on linux : >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>> # net rpc rights list accounts -Uadministrator >>>>>>>>>>>> >>>>>>>>>>>> it ask me a password for "administrator: >>>>>>>>>>>> >>>>>>>>>>>> Enter administrator's password: >>>>>>>>>>>> Could not connect to server 127.0.0.1 >>>>>>>>>>>> Connection failed: NT_STATUS_NO_LOGON_SERVERS >>>>>>>>>>>> >>>>>>>>>>>> Must I enter windows administrator password? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Thanks. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Monday, December 29, 2014 5:10 AM, Rowland Penny >>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>> On 29/12/14 12:52, Jason Long wrote: >>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>> >>>>>>>>>>>>> I did some changes like below : >>>>>>>>>>>>> >>>>>>>>>>>>> /dev/mapper/vg_print-lv_root / ext4 >>>>>>>>>>>>> user_xattr,acl,defaults 1 1 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Then "lsof | grep /dev/mapper/vg_print-lv_root" not have any >>>>>>>>>>>>> output. >>>>>>>>>>>>> I added below lines to [global] section too : >>>>>>>>>>>>> >>>>>>>>>>>>> vfs objects = acl_xattr >>>>>>>>>>>>> map acl inherit = Yes >>>>>>>>>>>>> store dos attributes = Yes >>>>>>>>>>>>> >>>>>>>>>>>>> But about below commands can you tell me more? >>>>>>>>>>>>> >>>>>>>>>>>>> net rpc rights grant 'SAMDOM\Domain Admins' >>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>> net rpc rights list accounts -Uadministrator >>>>>>>>>>>>> >>>>>>>>>>>>> I hope they are not Dangerous!!!! >>>>>>>>>>>> No :-) >>>>>>>>>>>> >>>>>>>>>>>> The first one gives members of Domain Admins the right to change >>>>>>>>>>>> windows >>>>>>>>>>>> ACL's on a share >>>>>>>>>>>> The second list accounts and what rights they have. >>>>>>>>>>>> >>>>>>>>>>>>> In the >>>>>>>>>>>>> "https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs" >>>>>>>>>>>>> , the other steps are in Windows!!! Can I doing via Linux too? >>>>>>>>>>>> Yes, but it is just easier via windows >>>>>>>>>>>> >>>>>>>>>>>> Rowland >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> Thanks. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday, December 29, 2014 1:59 AM, Rowland Penny >>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>> On 29/12/14 06:38, Jason Long wrote: >>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>> You right, My realm is "jasondomaini.jasondomain.jj" and I >>>>>>>>>>>>>> change configure as below : >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = JASONDOMAINI >>>>>>>>>>>>>> server string = Samba Server Version %v >>>>>>>>>>>>>> # logs split per machine >>>>>>>>>>>>>> log file = /var/log/samba/log.%m >>>>>>>>>>>>>> # max 50KB per log file, then rotate >>>>>>>>>>>>>> max log size = 50 >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>>>>>>>> passdb backend = tdbsam >>>>>>>>>>>>>> load printers = yes >>>>>>>>>>>>>> cups options = raw >>>>>>>>>>>>>> idmap config *:backend = tdb >>>>>>>>>>>>>> idmap config *:range = 70001-80000 >>>>>>>>>>>>>> #idmap config SAMDOM:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:schema_mode = rfc2307 >>>>>>>>>>>>>> idmap config JASONDOMAINI:range = 500-40000 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> When I use "SSH" on my CentOS and enter "jasondomain\jason", >>>>>>>>>>>>>> It show me the root partition and I can open "Test" directory >>>>>>>>>>>>>> But it has two problems : >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1- Why it show root partition? >>>>>>>>>>>>>> 2- I can't browse it via Windows explorer!!! >>>>>>>>>>>>>> >>>>>>>>>>>>>> I want to know use AD users in Linux is Hard? >>>>>>>>>>>>>> >>>>>>>>>>>>>> In your opinion I used a correct command to set ACL? >>>>>>>>>>>>>> >>>>>>>>>>>>>> #getfacl test/ >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # file: test/ >>>>>>>>>>>>>> # owner: JASONDOMAINI\134JASON >>>>>>>>>>>>>> # group: JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> user::rwx >>>>>>>>>>>>>> group::r-x >>>>>>>>>>>>>> group:JASONDOMAINI\134grp-JASON-rw:rwx >>>>>>>>>>>>>> mask::rwx >>>>>>>>>>>>>> other::r-x >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> and in "getent group" it show me below group : >>>>>>>>>>>>>> >>>>>>>>>>>>>> JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> in your idea, Am I use correct command to set permission? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Sunday, December 28, 2014 9:37 AM, Rowland Penny >>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>> On 28/12/14 15:48, Jason Long wrote: >>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>> Thus I must change "idmap config JASONDOMAIN.JJ:backend = ad >>>>>>>>>>>>>>> " to "idmap config JASONDOMAIN:backend = ad". >>>>>>>>>>>>>>> How about Workgroup? is must change "JASONDOMAIN" too? >>>>>>>>>>>>>>> About your question I must say that I Test this share via >>>>>>>>>>>>>>> Linux too and Windows and Linux has same problem. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> About "What I would do is, install the OpenSSH server on the >>>>>>>>>>>>>>> linux machine, install 'PUTTY' on a windows machine and try >>>>>>>>>>>>>>> to login via 'PUTTY' and use the SSH protocol." , You mean is >>>>>>>>>>>>>>> that Windows clients use SSH to work with this directory? I >>>>>>>>>>>>>>> want to made this Linux Box as a File server and Windows >>>>>>>>>>>>>>> Clients need graphical browser to copy and paste file into >>>>>>>>>>>>>>> this directory!!!!!!! >>>>>>>>>>>>>>> What is your idea? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> I am loosing track here a bit, but if your dns domain is >>>>>>>>>>>>>> example.com, >>>>>>>>>>>>>> then your windows AD realm should be something like >>>>>>>>>>>>>> internal.example.com >>>>>>>>>>>>>> and your workgroup/domain name should be INTERNAL, that is, >>>>>>>>>>>>>> they all >>>>>>>>>>>>>> rely on each other. >>>>>>>>>>>>>> >>>>>>>>>>>>>> So anywhere that you come across these, you should use the >>>>>>>>>>>>>> relevant one, >>>>>>>>>>>>>> this is the relevant parts from a Unix client on my domain: >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = INTERNAL >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = INTERNAL.EXAMPLE.COM >>>>>>>>>>>>>> .......... >>>>>>>>>>>>>> idmap config * : backend = tdb >>>>>>>>>>>>>> idmap config * : range = 2000-9999 >>>>>>>>>>>>>> idmap config INTERNAL : backend = ad >>>>>>>>>>>>>> idmap config INTERNAL : range = 10000-999999 >>>>>>>>>>>>>> idmap config INTERNAL : schema_mode = rfc2307 >>>>>>>>>>>>>> >>>>>>>>>>>>>> As for using 'PUTTY', this was just a way of testing whether >>>>>>>>>>>>>> you can >>>>>>>>>>>>>> connect to the Unix machine. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Rowland >>>>>>>>>>>>> OK, we are getting closer >>>>>>>>>>>>> >>>>>>>>>>>>> right, answers to your questions >>>>>>>>>>>>> 1) I think that you may find that this is also printed 'Could >>>>>>>>>>>>> not chdir >>>>>>>>>>>>> to home directory', in which case you will end up in the root >>>>>>>>>>>>> of computer. >>>>>>>>>>>>> >>>>>>>>>>>>> 2) Are you running the 'nmbd' daemon ? Even if this is not >>>>>>>>>>>>> running you >>>>>>>>>>>>> should be able to navigate to the share by entering the path. >>>>>>>>>>>>> Have a >>>>>>>>>>>>> look here: >>>>>>>>>>>>> >>>>>>>>>>>>> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Rowland >>>>>>>>>>>>> >>>>>>>>>>> You are trying to run the command on a client, try adding either: >>>>>>>>>>> >>>>>>>>>>> -S server name >>>>>>>>>>> >>>>>>>>>>> OR >>>>>>>>>>> >>>>>>>>>>> -I address of target server >>>>>>>>>>> >>>>>>>>>>> where 'server' is the AD DC. >>>>>>>>>>> >>>>>>>>>>> Yes, you need to supply the password of the Domain Administrator. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Rowland >>>>>>>>>>> >>>>>>>>>> OK, try it like this: >>>>>>>>>> >>>>>>>>>> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege >>>>>>>>>> -UAdministrator -I 192.168.1.1 >>>>>>>>>> >>>>>>>>>> This works for me on a client joined to the domain. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Rowland >>>>>>>>>> >>>>>>>>> Sounds like something is wrong with the join, what does 'net ads >>>>>>>>> testjoin' return ? You may have to run this command with sudo. >>>>>>>>> >>>>>>>>> >>>>>>>>> Rowland >>>>>>>>> >>>>>>> Sometimes I wonder why all the time is spent on keeping the samba wiki >>>>>>> updated. Likewiseopen was replaced sometime ago by PowerBroker Open, I >>>>>>> cannot recommend using either of these, because quite simply, they are >>>>>>> not needed. >>>>>>> >>>>>>> Check the following files: >>>>>>> >>>>>>> /etc/samba/smb.conf >>>>>>> >>>>>>> [global] >>>>>>> workgroup = JASONDOMAINI >>>>>>> security = ADS >>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dedicated keytab file = /etc/krb5.keytab >>>>>>> kerberos method = secrets and keytab >>>>>>> server string = Samba 4 Client %h >>>>>>> winbind enum users = yes >>>>>>> winbind enum groups = yes >>>>>>> winbind use default domain = yes >>>>>>> winbind expand groups = 4 >>>>>>> winbind nss info = rfc2307 >>>>>>> winbind refresh tickets = Yes >>>>>>> winbind normalize names = Yes >>>>>>> idmap config * : backend = tdb >>>>>>> idmap config * : range = 2000-9999 >>>>>>> idmap config JASONDOMAINI : backend = ad >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> printcap name = cups >>>>>>> cups options = raw >>>>>>> usershare allow guests = yes >>>>>>> domain master = no >>>>>>> local master = no >>>>>>> preferred master = no >>>>>>> os level = 20 >>>>>>> map to guest = bad user >>>>>>> vfs objects = acl_xattr >>>>>>> map acl inherit = Yes >>>>>>> store dos attributes = Yes >>>>>>> log level = 6 >>>>>>> >>>>>>> /etc/krb5.conf >>>>>>> >>>>>>> [libdefaults] >>>>>>> default_realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dns_lookup_realm = false >>>>>>> dns_lookup_kdc = true >>>>>>> ticket_lifetime = 24h >>>>>>> forwardable = yes >>>>>>> >>>>>>> /etc/resolv.conf >>>>>>> >>>>>>> nameserver <your AD DC's ipaddress> >>>>>>> search jasondomaini.jasondomain.jj >>>>>>> >>>>>>> If required, alter them to match the above, check that 'hostname' >>>>>>> returns only the hostname of the client, check that 'hostname -f' >>>>>>> returns the FQDN. If either are not correct, fix them. >>>>>>> >>>>>>> Remove likewiseopen >>>>>>> >>>>>>> Once everything is correct, run the following command: >>>>>>> >>>>>>> net ads join -U Administrator at JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> >>>>>>> You should be asked for the domain Administrators password, enter this >>>>>>> and you should join the domain >>>>>>> >>>>>>> Rowland >>>>>>> >>>>>> What Windows DC are you using ? >>>>>> What is the realm name * workgroup name on the Windows DC ? >>>>>> >>>>>> Rowland >>>>> oops, that should have been: >>>>> >>>>> >>>>> What is the realm name & workgroup name on the Windows DC ? >>>>> >>>>> Rowland >>>>> >>>> Hi, will you answer these questions: >>>> >>>> What Windows DC are you using ? >>>> What is the realm name on the Windows DC ? >>>> What is the workgroup name on the Windows DC ? >>>> >>>> You do not need all of what you have in /etc/krb5.conf, but please >>>> answer the questions above first. >>>> >>>> Rowland >>>> >>> OK, so what is your 'domain' name (and No, it is not 'JASONDOMAIN.JJ') >>> >>> Rowland >>>Your confused !!! looking back over what you posted I found this: Thanks a lot. I changed the below lines to correct domain name : idmap config JASONDOMAIN : range = 10000-999999 idmap config JASONDOMAIN : schema_mode = rfc2307 and after join, the command "net rpc testjoin" show same error : Unable to find a suitable server for domain JASONDOMAINI Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL this was 05/01/15 07:02 Totally missed it then, but now it sticks out like a sore thumb, is your workgroup/NETBiosdomain 'JASONDOMAIN' *OR* 'JASONDOMAINI' ????? Rowland -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Jason Long
2015-Jan-11 06:26 UTC
[Samba] Use Samba with ACL for read Active Directory and set Permissions via it.
Any Idea? On Friday, January 9, 2015 11:14 PM, Jason Long <hack3rcon at yahoo.com> wrote: Thank you. I'm really sorry Bro. You right, When I get properties from AD, "Domain name(Pre-Windows 2000)" is "JASONDOMAINI". I'm sorry :( but when I want to join a Windows client to my domain I use "JASONDOMAIN.JJ" !!!! I guess that we must change SAMBA configuration. Cheers. On Friday, January 9, 2015 1:55 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: On 09/01/15 08:40, Jason Long wrote:> Thanks. > I'm confused. Can I paste "set" command on windows for you? > "jason" account is administrator and can join and dis-join any computer. > > Cheers. > > > > On Wednesday, January 7, 2015 2:59 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: > On 07/01/15 10:51, Jason Long wrote: >> Thank you. >> I changed my "krb5.conf" as below : >> >> >> [logging] >> default = FILE:/var/log/krb5libs.log >> kdc = FILE:/var/log/krb5kdc.log >> admin_server = FILE:/var/log/kadmind.log >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> renew_lifetime = 7d >> forwardable = yes >> default_keytab_name = /etc/krb5.keytab >> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> pkinit_kdc_hostname = <DNS> >> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >> pkinit_eku_checking = kpServerAuth >> pkinit_win2k_require_binding = false >> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >> > My krb5.conf is: > > [libdefaults] > default_realm = EXAMPLE.LAN > dns_lookup_realm = false > dns_lookup_kdc = true > ticket_lifetime = 24h > forwardable = yes > >> and removed "krb5.keytab" too. You told me that my domain name is "jasondomaini" but it is wrong, My domain name is "jasondomain.jj" and backend is "jasondomaini", For example, when I want to login into Windows use "jasondomaini\jason". >> >> After enter the command "net ads join -U jason at jasondomain.jj", My computer joined but when use "net rpc testjoin" , I got same error as below : >> >> Unable to find a suitable server for domain JASONDOMAINI >> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >> >> I don't know why it see domain name as "JASONDOMAINI". How can I edit it? > You shouldn't because 'JASONDOMAINI' *IS* your domain name *NOT* the > backend!!! > > The join command should be 'net ads join -U jason at JASONDOMAIN.JJ' , but > does 'jason' have the required rights to join the domain ?? Try again > but this time use: > > net ads join -U Administrator at JASONDOMAIN.JJ > > and enter the 'Administrator' password when prompted. > > Rowland >> >> Thanks. >> >> >> >> >> On Tuesday, January 6, 2015 12:57 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >> On 06/01/15 06:17, Jason Long wrote: >>> Thanks. >>> My domain name is "jasondomain.jj" and backend is "jasondomaini". >> No, your realm name is "jasondomain.jj" and it would seem that your >> domain name is "jasondomaini", the domain name can also be known as the >> 'workgroup' name. >> >> Set smb.conf to match this: >> >> [global] >> workgroup = JASONDOMAINI >> security = ADS >> realm = JASONDOMAIN.JJ >> dedicated keytab file = /etc/krb5.keytab >> kerberos method = secrets and keytab >> server string = Samba 4 Client %h >> winbind enum users = yes >> winbind enum groups = yes >> winbind use default domain = yes >> winbind expand groups = 4 >> winbind nss info = rfc2307 >> winbind refresh tickets = Yes >> winbind offline logon = yes >> winbind normalize names = Yes >> idmap config * : backend = tdb >> idmap config * : range = 2000-9999 >> idmap config JASONDOMAINI : backend = ad >> idmap config JASONDOMAINI : range = 10000-999999 >> idmap config JASONDOMAINI : schema_mode = rfc2307 >> printcap name = cups >> cups options = raw >> usershare allow guests = yes >> domain master = no >> local master = no >> preferred master = no >> os level = 20 >> map to guest = bad user >> >> set /etc/krb5.conf to this: >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> forwardable = yes >> >> set /etc/resolv.conf >> >> nameserver <ip of your windows server> >> search jasondomain.jj >> >> If /etc/krb5.keytab exists, delete it. >> >> make sure the time on the client matches the server. >> >> then try to join the domain: >> >> net ads join -U Administrator at JASONDOMAIN.JJ >> >> >> Rowland >>> >>> On Monday, January 5, 2015 3:48 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>> On 05/01/15 11:09, Jason Long wrote: >>>> Thank you. >>>> >>>> My Windows is Windows server 2008 R2. >>>> About realm name, My domain name is "JASONDOMAIN.JJ". >>>> My Windows not have any Workgroup Name. It is Domain. >>>> >>>> >>>> Thanks >>>> >>>> >>>> >>>> >>>> On Monday, January 5, 2015 1:05 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>> On 05/01/15 07:02, Jason Long wrote: >>>>> Thanks a lot. >>>>> I changed the below lines to correct domain name : >>>>> >>>>> idmap config JASONDOMAIN : range = 10000-999999 >>>>> idmap config JASONDOMAIN : schema_mode = rfc2307 >>>>> >>>>> and after join, the command "net rpc testjoin" show same error : >>>>> >>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>> >>>>> I have an idea and I guess that "/etc/krb5.conf" has some incorrect options. The file is " >>>>> >>>>> [logging] >>>>> default = FILE:/var/log/krb5libs.log >>>>> kdc = FILE:/var/log/krb5kdc.log >>>>> admin_server = FILE:/var/log/kadmind.log >>>>> >>>>> [libdefaults] >>>>> default_realm = JASONDOMAIN.JJ >>>>> dns_lookup_realm = false >>>>> dns_lookup_kdc = true >>>>> ticket_lifetime = 24h >>>>> renew_lifetime = 7d >>>>> forwardable = yes >>>>> default_keytab_name = /etc/krb5.keytab >>>>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> pkinit_kdc_hostname = <DNS> >>>>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>>>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>>>> pkinit_eku_checking = kpServerAuth >>>>> pkinit_win2k_require_binding = false >>>>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>>>> >>>>> [realms] >>>>> EXAMPLE.COM = { >>>>> kdc = kerberos.example.com >>>>> admin_server = kerberos.example.com >>>>> } >>>>> JASONDOMAIN.JJ = { >>>>> auth_to_local = RULE:[1:$0\$1](^JASONDOMAIN\.JJ\\.*)s/^JASONDOMAIN\.JJ/JASONDOMAINI/ >>>>> auth_to_local = RULE:[1:$0\$1](^ADVER\.JASONDOMAIN\.JJ\\.*)s/^ADVER\.JASONDOMAIN\.JJ/ADVER/ >>>>> auth_to_local = DEFAULT >>>>> } >>>>> >>>>> [domain_realm] >>>>> .example.com = EXAMPLE.COM >>>>> example.com = EXAMPLE.COM >>>>> .JASONDOMAIN.JJ = JASONDOMAIN.JJ >>>>> .adver.JASONDOMAIN.JJ = ADVER.JASONDOMAIN.JJ >>>>> [capaths] >>>>> [appdefaults] >>>>> pam = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> forwardable = true >>>>> validate = true >>>>> } >>>>> httpd = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> reverse_mappings = (.*)@JASONDOMAIN\.JJ JASONDOMAINI\$1 >>>>> } >>>>> >>>>> >>>>> >>>>> What is your idea? I must tell you that after removed LikeWise and configure manually, I can't login to Linux via Windows AD accounts. >>>>> >>>>> >>>>> Thanks. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Sunday, January 4, 2015 5:11 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>> On 04/01/15 13:00, Rowland Penny wrote: >>>>>> On 04/01/15 10:17, Jason Long wrote: >>>>>>> Thanks a lot. >>>>>>> I enter the command and result is : >>>>>>> >>>>>>> Using short domain name -- JASONDOMAINI >>>>>>> Joined 'PRINTMAH' to dns domain 'JASONDOMAIN.JJ' >>>>>>> but after run "net rpc testjoin" : >>>>>>> >>>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>>> >>>>>>> I guess I understand what is my problem. I'm really sorry :(. >>>>>>> >>>>>>> On Windows OS i used "set" command and it show me : >>>>>>> >>>>>>> USERDNSDOMAIN= JASONDOMAIN.JJ >>>>>>> USERDOMAIN= JASONDOMAINI >>>>>>> >>>>>>> I guess that I must change "JASONDOMAINI" in below texts to >>>>>>> "JASONDOMAIN" : >>>>>>> >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> >>>>>>> Am I right? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Saturday, January 3, 2015 7:44 AM, Rowland Penny >>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>> On 03/01/15 15:08, Jason Long wrote: >>>>>>>> Thank you. >>>>>>>> I used below videos for join my Linux Box to Windows domain : >>>>>>>> >>>>>>>> http://www.youtube.com/watch?v=Y3TFPDT9uic >>>>>>>> >>>>>>>> Please look at this video and I used instructions in it and >>>>>>>> LikeWiseOpen tool. >>>>>>>> >>>>>>>> >>>>>>>> Cheers. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Saturday, January 3, 2015 5:45 AM, Rowland Penny >>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>> On 03/01/15 12:38, Jason Long wrote: >>>>>>>>> Thanks. >>>>>>>>> >>>>>>>>> I enter "net ads testjoin" and it show me : >>>>>>>>> >>>>>>>>> ads_connect: No logon servers >>>>>>>>> Join to domain is not valid: No logon servers >>>>>>>> You are *not* joined to the domain, I suppose this should have been >>>>>>>> asked earlier, but how did you do the domain join ? >>>>>>>> >>>>>>>> Rowland >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> If it is incorrect, Why I can Login to Linux via Windows account? >>>>>>>>> As you see, I followed the steps on Video. >>>>>>>>> >>>>>>>>> :(. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Saturday, January 3, 2015 1:13 AM, Rowland Penny >>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>> On 03/01/15 05:41, Jason Long wrote: >>>>>>>>>> Thank you. >>>>>>>>>> Command show below error : >>>>>>>>>> >>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>> >>>>>>>>>> :( >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Wednesday, December 31, 2014 2:05 AM, Rowland Penny >>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>> On 31/12/14 09:55, Jason Long wrote: >>>>>>>>>>> Thanks. >>>>>>>>>>> I changed the command as below : >>>>>>>>>>> >>>>>>>>>>> #net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>> SeDiskOperatorPrivilege -U jasondomain\\administrator -I 192.168.1.1 >>>>>>>>>>> >>>>>>>>>>> But Got below error : >>>>>>>>>>> >>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>> >>>>>>>>>>> Cheers. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Wednesday, December 31, 2014 1:35 AM, Rowland Penny >>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>> On 31/12/14 09:17, Jason Long wrote: >>>>>>>>>>>> Thank you so much but I run below commands on linux : >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>> # net rpc rights list accounts -Uadministrator >>>>>>>>>>>> >>>>>>>>>>>> it ask me a password for "administrator: >>>>>>>>>>>> >>>>>>>>>>>> Enter administrator's password: >>>>>>>>>>>> Could not connect to server 127.0.0.1 >>>>>>>>>>>> Connection failed: NT_STATUS_NO_LOGON_SERVERS >>>>>>>>>>>> >>>>>>>>>>>> Must I enter windows administrator password? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Thanks. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Monday, December 29, 2014 5:10 AM, Rowland Penny >>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>> On 29/12/14 12:52, Jason Long wrote: >>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>> >>>>>>>>>>>>> I did some changes like below : >>>>>>>>>>>>> >>>>>>>>>>>>> /dev/mapper/vg_print-lv_root / ext4 >>>>>>>>>>>>> user_xattr,acl,defaults 1 1 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Then "lsof | grep /dev/mapper/vg_print-lv_root" not have any >>>>>>>>>>>>> output. >>>>>>>>>>>>> I added below lines to [global] section too : >>>>>>>>>>>>> >>>>>>>>>>>>> vfs objects = acl_xattr >>>>>>>>>>>>> map acl inherit = Yes >>>>>>>>>>>>> store dos attributes = Yes >>>>>>>>>>>>> >>>>>>>>>>>>> But about below commands can you tell me more? >>>>>>>>>>>>> >>>>>>>>>>>>> net rpc rights grant 'SAMDOM\Domain Admins' >>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>> net rpc rights list accounts -Uadministrator >>>>>>>>>>>>> >>>>>>>>>>>>> I hope they are not Dangerous!!!! >>>>>>>>>>>> No :-) >>>>>>>>>>>> >>>>>>>>>>>> The first one gives members of Domain Admins the right to change >>>>>>>>>>>> windows >>>>>>>>>>>> ACL's on a share >>>>>>>>>>>> The second list accounts and what rights they have. >>>>>>>>>>>> >>>>>>>>>>>>> In the >>>>>>>>>>>>> "https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs" >>>>>>>>>>>>> , the other steps are in Windows!!! Can I doing via Linux too? >>>>>>>>>>>> Yes, but it is just easier via windows >>>>>>>>>>>> >>>>>>>>>>>> Rowland >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> Thanks. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday, December 29, 2014 1:59 AM, Rowland Penny >>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>> On 29/12/14 06:38, Jason Long wrote: >>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>> You right, My realm is "jasondomaini.jasondomain.jj" and I >>>>>>>>>>>>>> change configure as below : >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = JASONDOMAINI >>>>>>>>>>>>>> server string = Samba Server Version %v >>>>>>>>>>>>>> # logs split per machine >>>>>>>>>>>>>> log file = /var/log/samba/log.%m >>>>>>>>>>>>>> # max 50KB per log file, then rotate >>>>>>>>>>>>>> max log size = 50 >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>>>>>>>> passdb backend = tdbsam >>>>>>>>>>>>>> load printers = yes >>>>>>>>>>>>>> cups options = raw >>>>>>>>>>>>>> idmap config *:backend = tdb >>>>>>>>>>>>>> idmap config *:range = 70001-80000 >>>>>>>>>>>>>> #idmap config SAMDOM:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:schema_mode = rfc2307 >>>>>>>>>>>>>> idmap config JASONDOMAINI:range = 500-40000 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> When I use "SSH" on my CentOS and enter "jasondomain\jason", >>>>>>>>>>>>>> It show me the root partition and I can open "Test" directory >>>>>>>>>>>>>> But it has two problems : >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1- Why it show root partition? >>>>>>>>>>>>>> 2- I can't browse it via Windows explorer!!! >>>>>>>>>>>>>> >>>>>>>>>>>>>> I want to know use AD users in Linux is Hard? >>>>>>>>>>>>>> >>>>>>>>>>>>>> In your opinion I used a correct command to set ACL? >>>>>>>>>>>>>> >>>>>>>>>>>>>> #getfacl test/ >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # file: test/ >>>>>>>>>>>>>> # owner: JASONDOMAINI\134JASON >>>>>>>>>>>>>> # group: JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> user::rwx >>>>>>>>>>>>>> group::r-x >>>>>>>>>>>>>> group:JASONDOMAINI\134grp-JASON-rw:rwx >>>>>>>>>>>>>> mask::rwx >>>>>>>>>>>>>> other::r-x >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> and in "getent group" it show me below group : >>>>>>>>>>>>>> >>>>>>>>>>>>>> JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> in your idea, Am I use correct command to set permission? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Sunday, December 28, 2014 9:37 AM, Rowland Penny >>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>> On 28/12/14 15:48, Jason Long wrote: >>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>> Thus I must change "idmap config JASONDOMAIN.JJ:backend = ad >>>>>>>>>>>>>>> " to "idmap config JASONDOMAIN:backend = ad". >>>>>>>>>>>>>>> How about Workgroup? is must change "JASONDOMAIN" too? >>>>>>>>>>>>>>> About your question I must say that I Test this share via >>>>>>>>>>>>>>> Linux too and Windows and Linux has same problem. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> About "What I would do is, install the OpenSSH server on the >>>>>>>>>>>>>>> linux machine, install 'PUTTY' on a windows machine and try >>>>>>>>>>>>>>> to login via 'PUTTY' and use the SSH protocol." , You mean is >>>>>>>>>>>>>>> that Windows clients use SSH to work with this directory? I >>>>>>>>>>>>>>> want to made this Linux Box as a File server and Windows >>>>>>>>>>>>>>> Clients need graphical browser to copy and paste file into >>>>>>>>>>>>>>> this directory!!!!!!! >>>>>>>>>>>>>>> What is your idea? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> I am loosing track here a bit, but if your dns domain is >>>>>>>>>>>>>> example.com, >>>>>>>>>>>>>> then your windows AD realm should be something like >>>>>>>>>>>>>> internal.example.com >>>>>>>>>>>>>> and your workgroup/domain name should be INTERNAL, that is, >>>>>>>>>>>>>> they all >>>>>>>>>>>>>> rely on each other. >>>>>>>>>>>>>> >>>>>>>>>>>>>> So anywhere that you come across these, you should use the >>>>>>>>>>>>>> relevant one, >>>>>>>>>>>>>> this is the relevant parts from a Unix client on my domain: >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = INTERNAL >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = INTERNAL.EXAMPLE.COM >>>>>>>>>>>>>> .......... >>>>>>>>>>>>>> idmap config * : backend = tdb >>>>>>>>>>>>>> idmap config * : range = 2000-9999 >>>>>>>>>>>>>> idmap config INTERNAL : backend = ad >>>>>>>>>>>>>> idmap config INTERNAL : range = 10000-999999 >>>>>>>>>>>>>> idmap config INTERNAL : schema_mode = rfc2307 >>>>>>>>>>>>>> >>>>>>>>>>>>>> As for using 'PUTTY', this was just a way of testing whether >>>>>>>>>>>>>> you can >>>>>>>>>>>>>> connect to the Unix machine. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Rowland >>>>>>>>>>>>> OK, we are getting closer >>>>>>>>>>>>> >>>>>>>>>>>>> right, answers to your questions >>>>>>>>>>>>> 1) I think that you may find that this is also printed 'Could >>>>>>>>>>>>> not chdir >>>>>>>>>>>>> to home directory', in which case you will end up in the root >>>>>>>>>>>>> of computer. >>>>>>>>>>>>> >>>>>>>>>>>>> 2) Are you running the 'nmbd' daemon ? Even if this is not >>>>>>>>>>>>> running you >>>>>>>>>>>>> should be able to navigate to the share by entering the path. >>>>>>>>>>>>> Have a >>>>>>>>>>>>> look here: >>>>>>>>>>>>> >>>>>>>>>>>>> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Rowland >>>>>>>>>>>>> >>>>>>>>>>> You are trying to run the command on a client, try adding either: >>>>>>>>>>> >>>>>>>>>>> -S server name >>>>>>>>>>> >>>>>>>>>>> OR >>>>>>>>>>> >>>>>>>>>>> -I address of target server >>>>>>>>>>> >>>>>>>>>>> where 'server' is the AD DC. >>>>>>>>>>> >>>>>>>>>>> Yes, you need to supply the password of the Domain Administrator. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Rowland >>>>>>>>>>> >>>>>>>>>> OK, try it like this: >>>>>>>>>> >>>>>>>>>> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege >>>>>>>>>> -UAdministrator -I 192.168.1.1 >>>>>>>>>> >>>>>>>>>> This works for me on a client joined to the domain. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Rowland >>>>>>>>>> >>>>>>>>> Sounds like something is wrong with the join, what does 'net ads >>>>>>>>> testjoin' return ? You may have to run this command with sudo. >>>>>>>>> >>>>>>>>> >>>>>>>>> Rowland >>>>>>>>> >>>>>>> Sometimes I wonder why all the time is spent on keeping the samba wiki >>>>>>> updated. Likewiseopen was replaced sometime ago by PowerBroker Open, I >>>>>>> cannot recommend using either of these, because quite simply, they are >>>>>>> not needed. >>>>>>> >>>>>>> Check the following files: >>>>>>> >>>>>>> /etc/samba/smb.conf >>>>>>> >>>>>>> [global] >>>>>>> workgroup = JASONDOMAINI >>>>>>> security = ADS >>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dedicated keytab file = /etc/krb5.keytab >>>>>>> kerberos method = secrets and keytab >>>>>>> server string = Samba 4 Client %h >>>>>>> winbind enum users = yes >>>>>>> winbind enum groups = yes >>>>>>> winbind use default domain = yes >>>>>>> winbind expand groups = 4 >>>>>>> winbind nss info = rfc2307 >>>>>>> winbind refresh tickets = Yes >>>>>>> winbind normalize names = Yes >>>>>>> idmap config * : backend = tdb >>>>>>> idmap config * : range = 2000-9999 >>>>>>> idmap config JASONDOMAINI : backend = ad >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> printcap name = cups >>>>>>> cups options = raw >>>>>>> usershare allow guests = yes >>>>>>> domain master = no >>>>>>> local master = no >>>>>>> preferred master = no >>>>>>> os level = 20 >>>>>>> map to guest = bad user >>>>>>> vfs objects = acl_xattr >>>>>>> map acl inherit = Yes >>>>>>> store dos attributes = Yes >>>>>>> log level = 6 >>>>>>> >>>>>>> /etc/krb5.conf >>>>>>> >>>>>>> [libdefaults] >>>>>>> default_realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dns_lookup_realm = false >>>>>>> dns_lookup_kdc = true >>>>>>> ticket_lifetime = 24h >>>>>>> forwardable = yes >>>>>>> >>>>>>> /etc/resolv.conf >>>>>>> >>>>>>> nameserver <your AD DC's ipaddress> >>>>>>> search jasondomaini.jasondomain.jj >>>>>>> >>>>>>> If required, alter them to match the above, check that 'hostname' >>>>>>> returns only the hostname of the client, check that 'hostname -f' >>>>>>> returns the FQDN. If either are not correct, fix them. >>>>>>> >>>>>>> Remove likewiseopen >>>>>>> >>>>>>> Once everything is correct, run the following command: >>>>>>> >>>>>>> net ads join -U Administrator at JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> >>>>>>> You should be asked for the domain Administrators password, enter this >>>>>>> and you should join the domain >>>>>>> >>>>>>> Rowland >>>>>>> >>>>>> What Windows DC are you using ? >>>>>> What is the realm name * workgroup name on the Windows DC ? >>>>>> >>>>>> Rowland >>>>> oops, that should have been: >>>>> >>>>> >>>>> What is the realm name & workgroup name on the Windows DC ? >>>>> >>>>> Rowland >>>>> >>>> Hi, will you answer these questions: >>>> >>>> What Windows DC are you using ? >>>> What is the realm name on the Windows DC ? >>>> What is the workgroup name on the Windows DC ? >>>> >>>> You do not need all of what you have in /etc/krb5.conf, but please >>>> answer the questions above first. >>>> >>>> Rowland >>>> >>> OK, so what is your 'domain' name (and No, it is not 'JASONDOMAIN.JJ') >>> >>> Rowland >>>Your confused !!! looking back over what you posted I found this: Thanks a lot. I changed the below lines to correct domain name : idmap config JASONDOMAIN : range = 10000-999999 idmap config JASONDOMAIN : schema_mode = rfc2307 and after join, the command "net rpc testjoin" show same error : Unable to find a suitable server for domain JASONDOMAINI Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL this was 05/01/15 07:02 Totally missed it then, but now it sticks out like a sore thumb, is your workgroup/NETBiosdomain 'JASONDOMAIN' *OR* 'JASONDOMAINI' ????? Rowland -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Jason Long
2015-Jan-12 14:53 UTC
[Samba] Use Samba with ACL for read Active Directory and set Permissions via it.
Thank you. I'm really sorry Bro. You right, When I get properties from AD, "Domain name(Pre-Windows 2000)" is "JASONDOMAINI". I'm sorry :( but when I want to join a Windows client to my domain I use "JASONDOMAIN.JJ" !!!! I guess that we must change SAMBA configuration. Cheers. On Friday, January 9, 2015 1:55 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: On 09/01/15 08:40, Jason Long wrote:> Thanks. > I'm confused. Can I paste "set" command on windows for you? > "jason" account is administrator and can join and dis-join any computer. > > Cheers. > > > > On Wednesday, January 7, 2015 2:59 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: > On 07/01/15 10:51, Jason Long wrote: >> Thank you. >> I changed my "krb5.conf" as below : >> >> >> [logging] >> default = FILE:/var/log/krb5libs.log >> kdc = FILE:/var/log/krb5kdc.log >> admin_server = FILE:/var/log/kadmind.log >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> renew_lifetime = 7d >> forwardable = yes >> default_keytab_name = /etc/krb5.keytab >> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >> pkinit_kdc_hostname = <DNS> >> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >> pkinit_eku_checking = kpServerAuth >> pkinit_win2k_require_binding = false >> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >> > My krb5.conf is: > > [libdefaults] > default_realm = EXAMPLE.LAN > dns_lookup_realm = false > dns_lookup_kdc = true > ticket_lifetime = 24h > forwardable = yes > >> and removed "krb5.keytab" too. You told me that my domain name is "jasondomaini" but it is wrong, My domain name is "jasondomain.jj" and backend is "jasondomaini", For example, when I want to login into Windows use "jasondomaini\jason". >> >> After enter the command "net ads join -U jason at jasondomain.jj", My computer joined but when use "net rpc testjoin" , I got same error as below : >> >> Unable to find a suitable server for domain JASONDOMAINI >> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >> >> I don't know why it see domain name as "JASONDOMAINI". How can I edit it? > You shouldn't because 'JASONDOMAINI' *IS* your domain name *NOT* the > backend!!! > > The join command should be 'net ads join -U jason at JASONDOMAIN.JJ' , but > does 'jason' have the required rights to join the domain ?? Try again > but this time use: > > net ads join -U Administrator at JASONDOMAIN.JJ > > and enter the 'Administrator' password when prompted. > > Rowland >> >> Thanks. >> >> >> >> >> On Tuesday, January 6, 2015 12:57 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >> On 06/01/15 06:17, Jason Long wrote: >>> Thanks. >>> My domain name is "jasondomain.jj" and backend is "jasondomaini". >> No, your realm name is "jasondomain.jj" and it would seem that your >> domain name is "jasondomaini", the domain name can also be known as the >> 'workgroup' name. >> >> Set smb.conf to match this: >> >> [global] >> workgroup = JASONDOMAINI >> security = ADS >> realm = JASONDOMAIN.JJ >> dedicated keytab file = /etc/krb5.keytab >> kerberos method = secrets and keytab >> server string = Samba 4 Client %h >> winbind enum users = yes >> winbind enum groups = yes >> winbind use default domain = yes >> winbind expand groups = 4 >> winbind nss info = rfc2307 >> winbind refresh tickets = Yes >> winbind offline logon = yes >> winbind normalize names = Yes >> idmap config * : backend = tdb >> idmap config * : range = 2000-9999 >> idmap config JASONDOMAINI : backend = ad >> idmap config JASONDOMAINI : range = 10000-999999 >> idmap config JASONDOMAINI : schema_mode = rfc2307 >> printcap name = cups >> cups options = raw >> usershare allow guests = yes >> domain master = no >> local master = no >> preferred master = no >> os level = 20 >> map to guest = bad user >> >> set /etc/krb5.conf to this: >> >> [libdefaults] >> default_realm = JASONDOMAIN.JJ >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> forwardable = yes >> >> set /etc/resolv.conf >> >> nameserver <ip of your windows server> >> search jasondomain.jj >> >> If /etc/krb5.keytab exists, delete it. >> >> make sure the time on the client matches the server. >> >> then try to join the domain: >> >> net ads join -U Administrator at JASONDOMAIN.JJ >> >> >> Rowland >>> >>> On Monday, January 5, 2015 3:48 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>> On 05/01/15 11:09, Jason Long wrote: >>>> Thank you. >>>> >>>> My Windows is Windows server 2008 R2. >>>> About realm name, My domain name is "JASONDOMAIN.JJ". >>>> My Windows not have any Workgroup Name. It is Domain. >>>> >>>> >>>> Thanks >>>> >>>> >>>> >>>> >>>> On Monday, January 5, 2015 1:05 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>> On 05/01/15 07:02, Jason Long wrote: >>>>> Thanks a lot. >>>>> I changed the below lines to correct domain name : >>>>> >>>>> idmap config JASONDOMAIN : range = 10000-999999 >>>>> idmap config JASONDOMAIN : schema_mode = rfc2307 >>>>> >>>>> and after join, the command "net rpc testjoin" show same error : >>>>> >>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>> >>>>> I have an idea and I guess that "/etc/krb5.conf" has some incorrect options. The file is " >>>>> >>>>> [logging] >>>>> default = FILE:/var/log/krb5libs.log >>>>> kdc = FILE:/var/log/krb5kdc.log >>>>> admin_server = FILE:/var/log/kadmind.log >>>>> >>>>> [libdefaults] >>>>> default_realm = JASONDOMAIN.JJ >>>>> dns_lookup_realm = false >>>>> dns_lookup_kdc = true >>>>> ticket_lifetime = 24h >>>>> renew_lifetime = 7d >>>>> forwardable = yes >>>>> default_keytab_name = /etc/krb5.keytab >>>>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>> pkinit_kdc_hostname = <DNS> >>>>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>>>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>>>> pkinit_eku_checking = kpServerAuth >>>>> pkinit_win2k_require_binding = false >>>>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>>>> >>>>> [realms] >>>>> EXAMPLE.COM = { >>>>> kdc = kerberos.example.com >>>>> admin_server = kerberos.example.com >>>>> } >>>>> JASONDOMAIN.JJ = { >>>>> auth_to_local = RULE:[1:$0\$1](^JASONDOMAIN\.JJ\\.*)s/^JASONDOMAIN\.JJ/JASONDOMAINI/ >>>>> auth_to_local = RULE:[1:$0\$1](^ADVER\.JASONDOMAIN\.JJ\\.*)s/^ADVER\.JASONDOMAIN\.JJ/ADVER/ >>>>> auth_to_local = DEFAULT >>>>> } >>>>> >>>>> [domain_realm] >>>>> .example.com = EXAMPLE.COM >>>>> example.com = EXAMPLE.COM >>>>> .JASONDOMAIN.JJ = JASONDOMAIN.JJ >>>>> .adver.JASONDOMAIN.JJ = ADVER.JASONDOMAIN.JJ >>>>> [capaths] >>>>> [appdefaults] >>>>> pam = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> forwardable = true >>>>> validate = true >>>>> } >>>>> httpd = { >>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>> reverse_mappings = (.*)@JASONDOMAIN\.JJ JASONDOMAINI\$1 >>>>> } >>>>> >>>>> >>>>> >>>>> What is your idea? I must tell you that after removed LikeWise and configure manually, I can't login to Linux via Windows AD accounts. >>>>> >>>>> >>>>> Thanks. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Sunday, January 4, 2015 5:11 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>> On 04/01/15 13:00, Rowland Penny wrote: >>>>>> On 04/01/15 10:17, Jason Long wrote: >>>>>>> Thanks a lot. >>>>>>> I enter the command and result is : >>>>>>> >>>>>>> Using short domain name -- JASONDOMAINI >>>>>>> Joined 'PRINTMAH' to dns domain 'JASONDOMAIN.JJ' >>>>>>> but after run "net rpc testjoin" : >>>>>>> >>>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>>> >>>>>>> I guess I understand what is my problem. I'm really sorry :(. >>>>>>> >>>>>>> On Windows OS i used "set" command and it show me : >>>>>>> >>>>>>> USERDNSDOMAIN= JASONDOMAIN.JJ >>>>>>> USERDOMAIN= JASONDOMAINI >>>>>>> >>>>>>> I guess that I must change "JASONDOMAINI" in below texts to >>>>>>> "JASONDOMAIN" : >>>>>>> >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> >>>>>>> Am I right? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Saturday, January 3, 2015 7:44 AM, Rowland Penny >>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>> On 03/01/15 15:08, Jason Long wrote: >>>>>>>> Thank you. >>>>>>>> I used below videos for join my Linux Box to Windows domain : >>>>>>>> >>>>>>>> http://www.youtube.com/watch?v=Y3TFPDT9uic >>>>>>>> >>>>>>>> Please look at this video and I used instructions in it and >>>>>>>> LikeWiseOpen tool. >>>>>>>> >>>>>>>> >>>>>>>> Cheers. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Saturday, January 3, 2015 5:45 AM, Rowland Penny >>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>> On 03/01/15 12:38, Jason Long wrote: >>>>>>>>> Thanks. >>>>>>>>> >>>>>>>>> I enter "net ads testjoin" and it show me : >>>>>>>>> >>>>>>>>> ads_connect: No logon servers >>>>>>>>> Join to domain is not valid: No logon servers >>>>>>>> You are *not* joined to the domain, I suppose this should have been >>>>>>>> asked earlier, but how did you do the domain join ? >>>>>>>> >>>>>>>> Rowland >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> If it is incorrect, Why I can Login to Linux via Windows account? >>>>>>>>> As you see, I followed the steps on Video. >>>>>>>>> >>>>>>>>> :(. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Saturday, January 3, 2015 1:13 AM, Rowland Penny >>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>> On 03/01/15 05:41, Jason Long wrote: >>>>>>>>>> Thank you. >>>>>>>>>> Command show below error : >>>>>>>>>> >>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>> >>>>>>>>>> :( >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Wednesday, December 31, 2014 2:05 AM, Rowland Penny >>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>> On 31/12/14 09:55, Jason Long wrote: >>>>>>>>>>> Thanks. >>>>>>>>>>> I changed the command as below : >>>>>>>>>>> >>>>>>>>>>> #net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>> SeDiskOperatorPrivilege -U jasondomain\\administrator -I 192.168.1.1 >>>>>>>>>>> >>>>>>>>>>> But Got below error : >>>>>>>>>>> >>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>> >>>>>>>>>>> Cheers. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Wednesday, December 31, 2014 1:35 AM, Rowland Penny >>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>> On 31/12/14 09:17, Jason Long wrote: >>>>>>>>>>>> Thank you so much but I run below commands on linux : >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>> # net rpc rights list accounts -Uadministrator >>>>>>>>>>>> >>>>>>>>>>>> it ask me a password for "administrator: >>>>>>>>>>>> >>>>>>>>>>>> Enter administrator's password: >>>>>>>>>>>> Could not connect to server 127.0.0.1 >>>>>>>>>>>> Connection failed: NT_STATUS_NO_LOGON_SERVERS >>>>>>>>>>>> >>>>>>>>>>>> Must I enter windows administrator password? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Thanks. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Monday, December 29, 2014 5:10 AM, Rowland Penny >>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>> On 29/12/14 12:52, Jason Long wrote: >>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>> >>>>>>>>>>>>> I did some changes like below : >>>>>>>>>>>>> >>>>>>>>>>>>> /dev/mapper/vg_print-lv_root / ext4 >>>>>>>>>>>>> user_xattr,acl,defaults 1 1 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Then "lsof | grep /dev/mapper/vg_print-lv_root" not have any >>>>>>>>>>>>> output. >>>>>>>>>>>>> I added below lines to [global] section too : >>>>>>>>>>>>> >>>>>>>>>>>>> vfs objects = acl_xattr >>>>>>>>>>>>> map acl inherit = Yes >>>>>>>>>>>>> store dos attributes = Yes >>>>>>>>>>>>> >>>>>>>>>>>>> But about below commands can you tell me more? >>>>>>>>>>>>> >>>>>>>>>>>>> net rpc rights grant 'SAMDOM\Domain Admins' >>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>> net rpc rights list accounts -Uadministrator >>>>>>>>>>>>> >>>>>>>>>>>>> I hope they are not Dangerous!!!! >>>>>>>>>>>> No :-) >>>>>>>>>>>> >>>>>>>>>>>> The first one gives members of Domain Admins the right to change >>>>>>>>>>>> windows >>>>>>>>>>>> ACL's on a share >>>>>>>>>>>> The second list accounts and what rights they have. >>>>>>>>>>>> >>>>>>>>>>>>> In the >>>>>>>>>>>>> "https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs" >>>>>>>>>>>>> , the other steps are in Windows!!! Can I doing via Linux too? >>>>>>>>>>>> Yes, but it is just easier via windows >>>>>>>>>>>> >>>>>>>>>>>> Rowland >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> Thanks. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday, December 29, 2014 1:59 AM, Rowland Penny >>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>> On 29/12/14 06:38, Jason Long wrote: >>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>> You right, My realm is "jasondomaini.jasondomain.jj" and I >>>>>>>>>>>>>> change configure as below : >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = JASONDOMAINI >>>>>>>>>>>>>> server string = Samba Server Version %v >>>>>>>>>>>>>> # logs split per machine >>>>>>>>>>>>>> log file = /var/log/samba/log.%m >>>>>>>>>>>>>> # max 50KB per log file, then rotate >>>>>>>>>>>>>> max log size = 50 >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>>>>>>>> passdb backend = tdbsam >>>>>>>>>>>>>> load printers = yes >>>>>>>>>>>>>> cups options = raw >>>>>>>>>>>>>> idmap config *:backend = tdb >>>>>>>>>>>>>> idmap config *:range = 70001-80000 >>>>>>>>>>>>>> #idmap config SAMDOM:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:backend = ad >>>>>>>>>>>>>> idmap config JASONDOMAINI:schema_mode = rfc2307 >>>>>>>>>>>>>> idmap config JASONDOMAINI:range = 500-40000 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> When I use "SSH" on my CentOS and enter "jasondomain\jason", >>>>>>>>>>>>>> It show me the root partition and I can open "Test" directory >>>>>>>>>>>>>> But it has two problems : >>>>>>>>>>>>>> >>>>>>>>>>>>>> 1- Why it show root partition? >>>>>>>>>>>>>> 2- I can't browse it via Windows explorer!!! >>>>>>>>>>>>>> >>>>>>>>>>>>>> I want to know use AD users in Linux is Hard? >>>>>>>>>>>>>> >>>>>>>>>>>>>> In your opinion I used a correct command to set ACL? >>>>>>>>>>>>>> >>>>>>>>>>>>>> #getfacl test/ >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # file: test/ >>>>>>>>>>>>>> # owner: JASONDOMAINI\134JASON >>>>>>>>>>>>>> # group: JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> user::rwx >>>>>>>>>>>>>> group::r-x >>>>>>>>>>>>>> group:JASONDOMAINI\134grp-JASON-rw:rwx >>>>>>>>>>>>>> mask::rwx >>>>>>>>>>>>>> other::r-x >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> and in "getent group" it show me below group : >>>>>>>>>>>>>> >>>>>>>>>>>>>> JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> in your idea, Am I use correct command to set permission? >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Sunday, December 28, 2014 9:37 AM, Rowland Penny >>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>> On 28/12/14 15:48, Jason Long wrote: >>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>> Thus I must change "idmap config JASONDOMAIN.JJ:backend = ad >>>>>>>>>>>>>>> " to "idmap config JASONDOMAIN:backend = ad". >>>>>>>>>>>>>>> How about Workgroup? is must change "JASONDOMAIN" too? >>>>>>>>>>>>>>> About your question I must say that I Test this share via >>>>>>>>>>>>>>> Linux too and Windows and Linux has same problem. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> About "What I would do is, install the OpenSSH server on the >>>>>>>>>>>>>>> linux machine, install 'PUTTY' on a windows machine and try >>>>>>>>>>>>>>> to login via 'PUTTY' and use the SSH protocol." , You mean is >>>>>>>>>>>>>>> that Windows clients use SSH to work with this directory? I >>>>>>>>>>>>>>> want to made this Linux Box as a File server and Windows >>>>>>>>>>>>>>> Clients need graphical browser to copy and paste file into >>>>>>>>>>>>>>> this directory!!!!!!! >>>>>>>>>>>>>>> What is your idea? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> I am loosing track here a bit, but if your dns domain is >>>>>>>>>>>>>> example.com, >>>>>>>>>>>>>> then your windows AD realm should be something like >>>>>>>>>>>>>> internal.example.com >>>>>>>>>>>>>> and your workgroup/domain name should be INTERNAL, that is, >>>>>>>>>>>>>> they all >>>>>>>>>>>>>> rely on each other. >>>>>>>>>>>>>> >>>>>>>>>>>>>> So anywhere that you come across these, you should use the >>>>>>>>>>>>>> relevant one, >>>>>>>>>>>>>> this is the relevant parts from a Unix client on my domain: >>>>>>>>>>>>>> >>>>>>>>>>>>>> [global] >>>>>>>>>>>>>> workgroup = INTERNAL >>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>> realm = INTERNAL.EXAMPLE.COM >>>>>>>>>>>>>> .......... >>>>>>>>>>>>>> idmap config * : backend = tdb >>>>>>>>>>>>>> idmap config * : range = 2000-9999 >>>>>>>>>>>>>> idmap config INTERNAL : backend = ad >>>>>>>>>>>>>> idmap config INTERNAL : range = 10000-999999 >>>>>>>>>>>>>> idmap config INTERNAL : schema_mode = rfc2307 >>>>>>>>>>>>>> >>>>>>>>>>>>>> As for using 'PUTTY', this was just a way of testing whether >>>>>>>>>>>>>> you can >>>>>>>>>>>>>> connect to the Unix machine. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Rowland >>>>>>>>>>>>> OK, we are getting closer >>>>>>>>>>>>> >>>>>>>>>>>>> right, answers to your questions >>>>>>>>>>>>> 1) I think that you may find that this is also printed 'Could >>>>>>>>>>>>> not chdir >>>>>>>>>>>>> to home directory', in which case you will end up in the root >>>>>>>>>>>>> of computer. >>>>>>>>>>>>> >>>>>>>>>>>>> 2) Are you running the 'nmbd' daemon ? Even if this is not >>>>>>>>>>>>> running you >>>>>>>>>>>>> should be able to navigate to the share by entering the path. >>>>>>>>>>>>> Have a >>>>>>>>>>>>> look here: >>>>>>>>>>>>> >>>>>>>>>>>>> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Rowland >>>>>>>>>>>>> >>>>>>>>>>> You are trying to run the command on a client, try adding either: >>>>>>>>>>> >>>>>>>>>>> -S server name >>>>>>>>>>> >>>>>>>>>>> OR >>>>>>>>>>> >>>>>>>>>>> -I address of target server >>>>>>>>>>> >>>>>>>>>>> where 'server' is the AD DC. >>>>>>>>>>> >>>>>>>>>>> Yes, you need to supply the password of the Domain Administrator. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Rowland >>>>>>>>>>> >>>>>>>>>> OK, try it like this: >>>>>>>>>> >>>>>>>>>> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege >>>>>>>>>> -UAdministrator -I 192.168.1.1 >>>>>>>>>> >>>>>>>>>> This works for me on a client joined to the domain. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Rowland >>>>>>>>>> >>>>>>>>> Sounds like something is wrong with the join, what does 'net ads >>>>>>>>> testjoin' return ? You may have to run this command with sudo. >>>>>>>>> >>>>>>>>> >>>>>>>>> Rowland >>>>>>>>> >>>>>>> Sometimes I wonder why all the time is spent on keeping the samba wiki >>>>>>> updated. Likewiseopen was replaced sometime ago by PowerBroker Open, I >>>>>>> cannot recommend using either of these, because quite simply, they are >>>>>>> not needed. >>>>>>> >>>>>>> Check the following files: >>>>>>> >>>>>>> /etc/samba/smb.conf >>>>>>> >>>>>>> [global] >>>>>>> workgroup = JASONDOMAINI >>>>>>> security = ADS >>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dedicated keytab file = /etc/krb5.keytab >>>>>>> kerberos method = secrets and keytab >>>>>>> server string = Samba 4 Client %h >>>>>>> winbind enum users = yes >>>>>>> winbind enum groups = yes >>>>>>> winbind use default domain = yes >>>>>>> winbind expand groups = 4 >>>>>>> winbind nss info = rfc2307 >>>>>>> winbind refresh tickets = Yes >>>>>>> winbind normalize names = Yes >>>>>>> idmap config * : backend = tdb >>>>>>> idmap config * : range = 2000-9999 >>>>>>> idmap config JASONDOMAINI : backend = ad >>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>> printcap name = cups >>>>>>> cups options = raw >>>>>>> usershare allow guests = yes >>>>>>> domain master = no >>>>>>> local master = no >>>>>>> preferred master = no >>>>>>> os level = 20 >>>>>>> map to guest = bad user >>>>>>> vfs objects = acl_xattr >>>>>>> map acl inherit = Yes >>>>>>> store dos attributes = Yes >>>>>>> log level = 6 >>>>>>> >>>>>>> /etc/krb5.conf >>>>>>> >>>>>>> [libdefaults] >>>>>>> default_realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> dns_lookup_realm = false >>>>>>> dns_lookup_kdc = true >>>>>>> ticket_lifetime = 24h >>>>>>> forwardable = yes >>>>>>> >>>>>>> /etc/resolv.conf >>>>>>> >>>>>>> nameserver <your AD DC's ipaddress> >>>>>>> search jasondomaini.jasondomain.jj >>>>>>> >>>>>>> If required, alter them to match the above, check that 'hostname' >>>>>>> returns only the hostname of the client, check that 'hostname -f' >>>>>>> returns the FQDN. If either are not correct, fix them. >>>>>>> >>>>>>> Remove likewiseopen >>>>>>> >>>>>>> Once everything is correct, run the following command: >>>>>>> >>>>>>> net ads join -U Administrator at JASONDOMAINI.JASONDOMAIN.JJ >>>>>>> >>>>>>> You should be asked for the domain Administrators password, enter this >>>>>>> and you should join the domain >>>>>>> >>>>>>> Rowland >>>>>>> >>>>>> What Windows DC are you using ? >>>>>> What is the realm name * workgroup name on the Windows DC ? >>>>>> >>>>>> Rowland >>>>> oops, that should have been: >>>>> >>>>> >>>>> What is the realm name & workgroup name on the Windows DC ? >>>>> >>>>> Rowland >>>>> >>>> Hi, will you answer these questions: >>>> >>>> What Windows DC are you using ? >>>> What is the realm name on the Windows DC ? >>>> What is the workgroup name on the Windows DC ? >>>> >>>> You do not need all of what you have in /etc/krb5.conf, but please >>>> answer the questions above first. >>>> >>>> Rowland >>>> >>> OK, so what is your 'domain' name (and No, it is not 'JASONDOMAIN.JJ') >>> >>> Rowland >>>Your confused !!! looking back over what you posted I found this: Thanks a lot. I changed the below lines to correct domain name : idmap config JASONDOMAIN : range = 10000-999999 idmap config JASONDOMAIN : schema_mode = rfc2307 and after join, the command "net rpc testjoin" show same error : Unable to find a suitable server for domain JASONDOMAINI Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL this was 05/01/15 07:02 Totally missed it then, but now it sticks out like a sore thumb, is your workgroup/NETBiosdomain 'JASONDOMAIN' *OR* 'JASONDOMAINI' ????? Rowland
Rowland Penny
2015-Jan-12 15:34 UTC
[Samba] Use Samba with ACL for read Active Directory and set Permissions via it.
On 12/01/15 14:53, Jason Long wrote:> Thank you. > I'm really sorry Bro. > You right, When I get properties from AD, "Domain name(Pre-Windows 2000)" is "JASONDOMAINI". I'm sorry :( but when I want to join a Windows client to my domain I use "JASONDOMAIN.JJ" !!!! > I guess that we must change SAMBA configuration. > > Cheers. > > > > > On Friday, January 9, 2015 1:55 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: > On 09/01/15 08:40, Jason Long wrote: >> Thanks. >> I'm confused. Can I paste "set" command on windows for you? >> "jason" account is administrator and can join and dis-join any computer. >> >> Cheers. >> >> >> >> On Wednesday, January 7, 2015 2:59 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >> On 07/01/15 10:51, Jason Long wrote: >>> Thank you. >>> I changed my "krb5.conf" as below : >>> >>> >>> [logging] >>> default = FILE:/var/log/krb5libs.log >>> kdc = FILE:/var/log/krb5kdc.log >>> admin_server = FILE:/var/log/kadmind.log >>> >>> [libdefaults] >>> default_realm = JASONDOMAIN.JJ >>> dns_lookup_realm = false >>> dns_lookup_kdc = true >>> ticket_lifetime = 24h >>> renew_lifetime = 7d >>> forwardable = yes >>> default_keytab_name = /etc/krb5.keytab >>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>> pkinit_kdc_hostname = <DNS> >>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>> pkinit_eku_checking = kpServerAuth >>> pkinit_win2k_require_binding = false >>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>> >> My krb5.conf is: >> >> [libdefaults] >> default_realm = EXAMPLE.LAN >> dns_lookup_realm = false >> dns_lookup_kdc = true >> ticket_lifetime = 24h >> forwardable = yes >> >>> and removed "krb5.keytab" too. You told me that my domain name is "jasondomaini" but it is wrong, My domain name is "jasondomain.jj" and backend is "jasondomaini", For example, when I want to login into Windows use "jasondomaini\jason". >>> >>> After enter the command "net ads join -U jason at jasondomain.jj", My computer joined but when use "net rpc testjoin" , I got same error as below : >>> >>> Unable to find a suitable server for domain JASONDOMAINI >>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>> >>> I don't know why it see domain name as "JASONDOMAINI". How can I edit it? >> You shouldn't because 'JASONDOMAINI' *IS* your domain name *NOT* the >> backend!!! >> >> The join command should be 'net ads join -U jason at JASONDOMAIN.JJ' , but >> does 'jason' have the required rights to join the domain ?? Try again >> but this time use: >> >> net ads join -U Administrator at JASONDOMAIN.JJ >> >> and enter the 'Administrator' password when prompted. >> >> Rowland >>> Thanks. >>> >>> >>> >>> >>> On Tuesday, January 6, 2015 12:57 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>> On 06/01/15 06:17, Jason Long wrote: >>>> Thanks. >>>> My domain name is "jasondomain.jj" and backend is "jasondomaini". >>> No, your realm name is "jasondomain.jj" and it would seem that your >>> domain name is "jasondomaini", the domain name can also be known as the >>> 'workgroup' name. >>> >>> Set smb.conf to match this: >>> >>> [global] >>> workgroup = JASONDOMAINI >>> security = ADS >>> realm = JASONDOMAIN.JJ >>> dedicated keytab file = /etc/krb5.keytab >>> kerberos method = secrets and keytab >>> server string = Samba 4 Client %h >>> winbind enum users = yes >>> winbind enum groups = yes >>> winbind use default domain = yes >>> winbind expand groups = 4 >>> winbind nss info = rfc2307 >>> winbind refresh tickets = Yes >>> winbind offline logon = yes >>> winbind normalize names = Yes >>> idmap config * : backend = tdb >>> idmap config * : range = 2000-9999 >>> idmap config JASONDOMAINI : backend = ad >>> idmap config JASONDOMAINI : range = 10000-999999 >>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>> printcap name = cups >>> cups options = raw >>> usershare allow guests = yes >>> domain master = no >>> local master = no >>> preferred master = no >>> os level = 20 >>> map to guest = bad user >>> >>> set /etc/krb5.conf to this: >>> >>> [libdefaults] >>> default_realm = JASONDOMAIN.JJ >>> dns_lookup_realm = false >>> dns_lookup_kdc = true >>> ticket_lifetime = 24h >>> forwardable = yes >>> >>> set /etc/resolv.conf >>> >>> nameserver <ip of your windows server> >>> search jasondomain.jj >>> >>> If /etc/krb5.keytab exists, delete it. >>> >>> make sure the time on the client matches the server. >>> >>> then try to join the domain: >>> >>> net ads join -U Administrator at JASONDOMAIN.JJ >>> >>> >>> Rowland >>>> On Monday, January 5, 2015 3:48 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>> On 05/01/15 11:09, Jason Long wrote: >>>>> Thank you. >>>>> >>>>> My Windows is Windows server 2008 R2. >>>>> About realm name, My domain name is "JASONDOMAIN.JJ". >>>>> My Windows not have any Workgroup Name. It is Domain. >>>>> >>>>> >>>>> Thanks >>>>> >>>>> >>>>> >>>>> >>>>> On Monday, January 5, 2015 1:05 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>> On 05/01/15 07:02, Jason Long wrote: >>>>>> Thanks a lot. >>>>>> I changed the below lines to correct domain name : >>>>>> >>>>>> idmap config JASONDOMAIN : range = 10000-999999 >>>>>> idmap config JASONDOMAIN : schema_mode = rfc2307 >>>>>> >>>>>> and after join, the command "net rpc testjoin" show same error : >>>>>> >>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>> >>>>>> I have an idea and I guess that "/etc/krb5.conf" has some incorrect options. The file is " >>>>>> >>>>>> [logging] >>>>>> default = FILE:/var/log/krb5libs.log >>>>>> kdc = FILE:/var/log/krb5kdc.log >>>>>> admin_server = FILE:/var/log/kadmind.log >>>>>> >>>>>> [libdefaults] >>>>>> default_realm = JASONDOMAIN.JJ >>>>>> dns_lookup_realm = false >>>>>> dns_lookup_kdc = true >>>>>> ticket_lifetime = 24h >>>>>> renew_lifetime = 7d >>>>>> forwardable = yes >>>>>> default_keytab_name = /etc/krb5.keytab >>>>>> default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>>> default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>>> preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC >>>>>> pkinit_kdc_hostname = <DNS> >>>>>> pkinit_anchors = DIR:/var/lib/pbis/trusted_certs >>>>>> pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL> >>>>>> pkinit_eku_checking = kpServerAuth >>>>>> pkinit_win2k_require_binding = false >>>>>> pkinit_identities = PKCS11:/opt/pbis/lib64/libpkcs11.so >>>>>> >>>>>> [realms] >>>>>> EXAMPLE.COM = { >>>>>> kdc = kerberos.example.com >>>>>> admin_server = kerberos.example.com >>>>>> } >>>>>> JASONDOMAIN.JJ = { >>>>>> auth_to_local = RULE:[1:$0\$1](^JASONDOMAIN\.JJ\\.*)s/^JASONDOMAIN\.JJ/JASONDOMAINI/ >>>>>> auth_to_local = RULE:[1:$0\$1](^ADVER\.JASONDOMAIN\.JJ\\.*)s/^ADVER\.JASONDOMAIN\.JJ/ADVER/ >>>>>> auth_to_local = DEFAULT >>>>>> } >>>>>> >>>>>> [domain_realm] >>>>>> .example.com = EXAMPLE.COM >>>>>> example.com = EXAMPLE.COM >>>>>> .JASONDOMAIN.JJ = JASONDOMAIN.JJ >>>>>> .adver.JASONDOMAIN.JJ = ADVER.JASONDOMAIN.JJ >>>>>> [capaths] >>>>>> [appdefaults] >>>>>> pam = { >>>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>>> forwardable = true >>>>>> validate = true >>>>>> } >>>>>> httpd = { >>>>>> mappings = JASONDOMAINI\\(.*) $1 at JASONDOMAIN.JJ >>>>>> reverse_mappings = (.*)@JASONDOMAIN\.JJ JASONDOMAINI\$1 >>>>>> } >>>>>> >>>>>> >>>>>> >>>>>> What is your idea? I must tell you that after removed LikeWise and configure manually, I can't login to Linux via Windows AD accounts. >>>>>> >>>>>> >>>>>> Thanks. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On Sunday, January 4, 2015 5:11 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: >>>>>> On 04/01/15 13:00, Rowland Penny wrote: >>>>>>> On 04/01/15 10:17, Jason Long wrote: >>>>>>>> Thanks a lot. >>>>>>>> I enter the command and result is : >>>>>>>> >>>>>>>> Using short domain name -- JASONDOMAINI >>>>>>>> Joined 'PRINTMAH' to dns domain 'JASONDOMAIN.JJ' >>>>>>>> but after run "net rpc testjoin" : >>>>>>>> >>>>>>>> Unable to find a suitable server for domain JASONDOMAINI >>>>>>>> Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL >>>>>>>> >>>>>>>> I guess I understand what is my problem. I'm really sorry :(. >>>>>>>> >>>>>>>> On Windows OS i used "set" command and it show me : >>>>>>>> >>>>>>>> USERDNSDOMAIN= JASONDOMAIN.JJ >>>>>>>> USERDOMAIN= JASONDOMAINI >>>>>>>> >>>>>>>> I guess that I must change "JASONDOMAINI" in below texts to >>>>>>>> "JASONDOMAIN" : >>>>>>>> >>>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>>> >>>>>>>> Am I right? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Saturday, January 3, 2015 7:44 AM, Rowland Penny >>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>> On 03/01/15 15:08, Jason Long wrote: >>>>>>>>> Thank you. >>>>>>>>> I used below videos for join my Linux Box to Windows domain : >>>>>>>>> >>>>>>>>> http://www.youtube.com/watch?v=Y3TFPDT9uic >>>>>>>>> >>>>>>>>> Please look at this video and I used instructions in it and >>>>>>>>> LikeWiseOpen tool. >>>>>>>>> >>>>>>>>> >>>>>>>>> Cheers. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Saturday, January 3, 2015 5:45 AM, Rowland Penny >>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>> On 03/01/15 12:38, Jason Long wrote: >>>>>>>>>> Thanks. >>>>>>>>>> >>>>>>>>>> I enter "net ads testjoin" and it show me : >>>>>>>>>> >>>>>>>>>> ads_connect: No logon servers >>>>>>>>>> Join to domain is not valid: No logon servers >>>>>>>>> You are *not* joined to the domain, I suppose this should have been >>>>>>>>> asked earlier, but how did you do the domain join ? >>>>>>>>> >>>>>>>>> Rowland >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> If it is incorrect, Why I can Login to Linux via Windows account? >>>>>>>>>> As you see, I followed the steps on Video. >>>>>>>>>> >>>>>>>>>> :(. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Saturday, January 3, 2015 1:13 AM, Rowland Penny >>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>> On 03/01/15 05:41, Jason Long wrote: >>>>>>>>>>> Thank you. >>>>>>>>>>> Command show below error : >>>>>>>>>>> >>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>> >>>>>>>>>>> :( >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Wednesday, December 31, 2014 2:05 AM, Rowland Penny >>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>> On 31/12/14 09:55, Jason Long wrote: >>>>>>>>>>>> Thanks. >>>>>>>>>>>> I changed the command as below : >>>>>>>>>>>> >>>>>>>>>>>> #net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>> SeDiskOperatorPrivilege -U jasondomain\\administrator -I 192.168.1.1 >>>>>>>>>>>> >>>>>>>>>>>> But Got below error : >>>>>>>>>>>> >>>>>>>>>>>> Could not connect to server 192.168.1.1 >>>>>>>>>>>> Connection failed: NT_STATUS_INVALID_WORKSTATION >>>>>>>>>>>> >>>>>>>>>>>> Cheers. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On Wednesday, December 31, 2014 1:35 AM, Rowland Penny >>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>> On 31/12/14 09:17, Jason Long wrote: >>>>>>>>>>>>> Thank you so much but I run below commands on linux : >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> # net rpc rights grant 'jasondomain\Domain Admins' >>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>> # net rpc rights list accounts -Uadministrator >>>>>>>>>>>>> >>>>>>>>>>>>> it ask me a password for "administrator: >>>>>>>>>>>>> >>>>>>>>>>>>> Enter administrator's password: >>>>>>>>>>>>> Could not connect to server 127.0.0.1 >>>>>>>>>>>>> Connection failed: NT_STATUS_NO_LOGON_SERVERS >>>>>>>>>>>>> >>>>>>>>>>>>> Must I enter windows administrator password? >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Thanks. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday, December 29, 2014 5:10 AM, Rowland Penny >>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>> On 29/12/14 12:52, Jason Long wrote: >>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I did some changes like below : >>>>>>>>>>>>>> >>>>>>>>>>>>>> /dev/mapper/vg_print-lv_root / ext4 >>>>>>>>>>>>>> user_xattr,acl,defaults 1 1 >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Then "lsof | grep /dev/mapper/vg_print-lv_root" not have any >>>>>>>>>>>>>> output. >>>>>>>>>>>>>> I added below lines to [global] section too : >>>>>>>>>>>>>> >>>>>>>>>>>>>> vfs objects = acl_xattr >>>>>>>>>>>>>> map acl inherit = Yes >>>>>>>>>>>>>> store dos attributes = Yes >>>>>>>>>>>>>> >>>>>>>>>>>>>> But about below commands can you tell me more? >>>>>>>>>>>>>> >>>>>>>>>>>>>> net rpc rights grant 'SAMDOM\Domain Admins' >>>>>>>>>>>>>> SeDiskOperatorPrivilege -Uadministrator >>>>>>>>>>>>>> net rpc rights list accounts -Uadministrator >>>>>>>>>>>>>> >>>>>>>>>>>>>> I hope they are not Dangerous!!!! >>>>>>>>>>>>> No :-) >>>>>>>>>>>>> >>>>>>>>>>>>> The first one gives members of Domain Admins the right to change >>>>>>>>>>>>> windows >>>>>>>>>>>>> ACL's on a share >>>>>>>>>>>>> The second list accounts and what rights they have. >>>>>>>>>>>>> >>>>>>>>>>>>>> In the >>>>>>>>>>>>>> "https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs" >>>>>>>>>>>>>> , the other steps are in Windows!!! Can I doing via Linux too? >>>>>>>>>>>>> Yes, but it is just easier via windows >>>>>>>>>>>>> >>>>>>>>>>>>> Rowland >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Monday, December 29, 2014 1:59 AM, Rowland Penny >>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>> On 29/12/14 06:38, Jason Long wrote: >>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>> You right, My realm is "jasondomaini.jasondomain.jj" and I >>>>>>>>>>>>>>> change configure as below : >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> [global] >>>>>>>>>>>>>>> workgroup = JASONDOMAINI >>>>>>>>>>>>>>> server string = Samba Server Version %v >>>>>>>>>>>>>>> # logs split per machine >>>>>>>>>>>>>>> log file = /var/log/samba/log.%m >>>>>>>>>>>>>>> # max 50KB per log file, then rotate >>>>>>>>>>>>>>> max log size = 50 >>>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>>>>>>>>> passdb backend = tdbsam >>>>>>>>>>>>>>> load printers = yes >>>>>>>>>>>>>>> cups options = raw >>>>>>>>>>>>>>> idmap config *:backend = tdb >>>>>>>>>>>>>>> idmap config *:range = 70001-80000 >>>>>>>>>>>>>>> #idmap config SAMDOM:backend = ad >>>>>>>>>>>>>>> idmap config JASONDOMAINI:backend = ad >>>>>>>>>>>>>>> idmap config JASONDOMAINI:schema_mode = rfc2307 >>>>>>>>>>>>>>> idmap config JASONDOMAINI:range = 500-40000 >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> When I use "SSH" on my CentOS and enter "jasondomain\jason", >>>>>>>>>>>>>>> It show me the root partition and I can open "Test" directory >>>>>>>>>>>>>>> But it has two problems : >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> 1- Why it show root partition? >>>>>>>>>>>>>>> 2- I can't browse it via Windows explorer!!! >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> I want to know use AD users in Linux is Hard? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> In your opinion I used a correct command to set ACL? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> #getfacl test/ >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # file: test/ >>>>>>>>>>>>>>> # owner: JASONDOMAINI\134JASON >>>>>>>>>>>>>>> # group: JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>>> user::rwx >>>>>>>>>>>>>>> group::r-x >>>>>>>>>>>>>>> group:JASONDOMAINI\134grp-JASON-rw:rwx >>>>>>>>>>>>>>> mask::rwx >>>>>>>>>>>>>>> other::r-x >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> and in "getent group" it show me below group : >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> JASONDOMAINI\134grp-JASON-rw >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> in your idea, Am I use correct command to set permission? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> On Sunday, December 28, 2014 9:37 AM, Rowland Penny >>>>>>>>>>>>>>> <rowlandpenny at googlemail.com> wrote: >>>>>>>>>>>>>>> On 28/12/14 15:48, Jason Long wrote: >>>>>>>>>>>>>>>> Thank you so much. >>>>>>>>>>>>>>>> Thus I must change "idmap config JASONDOMAIN.JJ:backend = ad >>>>>>>>>>>>>>>> " to "idmap config JASONDOMAIN:backend = ad". >>>>>>>>>>>>>>>> How about Workgroup? is must change "JASONDOMAIN" too? >>>>>>>>>>>>>>>> About your question I must say that I Test this share via >>>>>>>>>>>>>>>> Linux too and Windows and Linux has same problem. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> About "What I would do is, install the OpenSSH server on the >>>>>>>>>>>>>>>> linux machine, install 'PUTTY' on a windows machine and try >>>>>>>>>>>>>>>> to login via 'PUTTY' and use the SSH protocol." , You mean is >>>>>>>>>>>>>>>> that Windows clients use SSH to work with this directory? I >>>>>>>>>>>>>>>> want to made this Linux Box as a File server and Windows >>>>>>>>>>>>>>>> Clients need graphical browser to copy and paste file into >>>>>>>>>>>>>>>> this directory!!!!!!! >>>>>>>>>>>>>>>> What is your idea? >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Thanks. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> I am loosing track here a bit, but if your dns domain is >>>>>>>>>>>>>>> example.com, >>>>>>>>>>>>>>> then your windows AD realm should be something like >>>>>>>>>>>>>>> internal.example.com >>>>>>>>>>>>>>> and your workgroup/domain name should be INTERNAL, that is, >>>>>>>>>>>>>>> they all >>>>>>>>>>>>>>> rely on each other. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> So anywhere that you come across these, you should use the >>>>>>>>>>>>>>> relevant one, >>>>>>>>>>>>>>> this is the relevant parts from a Unix client on my domain: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> [global] >>>>>>>>>>>>>>> workgroup = INTERNAL >>>>>>>>>>>>>>> security = ADS >>>>>>>>>>>>>>> realm = INTERNAL.EXAMPLE.COM >>>>>>>>>>>>>>> .......... >>>>>>>>>>>>>>> idmap config * : backend = tdb >>>>>>>>>>>>>>> idmap config * : range = 2000-9999 >>>>>>>>>>>>>>> idmap config INTERNAL : backend = ad >>>>>>>>>>>>>>> idmap config INTERNAL : range = 10000-999999 >>>>>>>>>>>>>>> idmap config INTERNAL : schema_mode = rfc2307 >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> As for using 'PUTTY', this was just a way of testing whether >>>>>>>>>>>>>>> you can >>>>>>>>>>>>>>> connect to the Unix machine. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Rowland >>>>>>>>>>>>>> OK, we are getting closer >>>>>>>>>>>>>> >>>>>>>>>>>>>> right, answers to your questions >>>>>>>>>>>>>> 1) I think that you may find that this is also printed 'Could >>>>>>>>>>>>>> not chdir >>>>>>>>>>>>>> to home directory', in which case you will end up in the root >>>>>>>>>>>>>> of computer. >>>>>>>>>>>>>> >>>>>>>>>>>>>> 2) Are you running the 'nmbd' daemon ? Even if this is not >>>>>>>>>>>>>> running you >>>>>>>>>>>>>> should be able to navigate to the share by entering the path. >>>>>>>>>>>>>> Have a >>>>>>>>>>>>>> look here: >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Rowland >>>>>>>>>>>>>> >>>>>>>>>>>> You are trying to run the command on a client, try adding either: >>>>>>>>>>>> >>>>>>>>>>>> -S server name >>>>>>>>>>>> >>>>>>>>>>>> OR >>>>>>>>>>>> >>>>>>>>>>>> -I address of target server >>>>>>>>>>>> >>>>>>>>>>>> where 'server' is the AD DC. >>>>>>>>>>>> >>>>>>>>>>>> Yes, you need to supply the password of the Domain Administrator. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Rowland >>>>>>>>>>>> >>>>>>>>>>> OK, try it like this: >>>>>>>>>>> >>>>>>>>>>> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege >>>>>>>>>>> -UAdministrator -I 192.168.1.1 >>>>>>>>>>> >>>>>>>>>>> This works for me on a client joined to the domain. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Rowland >>>>>>>>>>> >>>>>>>>>> Sounds like something is wrong with the join, what does 'net ads >>>>>>>>>> testjoin' return ? You may have to run this command with sudo. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Rowland >>>>>>>>>> >>>>>>>> Sometimes I wonder why all the time is spent on keeping the samba wiki >>>>>>>> updated. Likewiseopen was replaced sometime ago by PowerBroker Open, I >>>>>>>> cannot recommend using either of these, because quite simply, they are >>>>>>>> not needed. >>>>>>>> >>>>>>>> Check the following files: >>>>>>>> >>>>>>>> /etc/samba/smb.conf >>>>>>>> >>>>>>>> [global] >>>>>>>> workgroup = JASONDOMAINI >>>>>>>> security = ADS >>>>>>>> realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>> dedicated keytab file = /etc/krb5.keytab >>>>>>>> kerberos method = secrets and keytab >>>>>>>> server string = Samba 4 Client %h >>>>>>>> winbind enum users = yes >>>>>>>> winbind enum groups = yes >>>>>>>> winbind use default domain = yes >>>>>>>> winbind expand groups = 4 >>>>>>>> winbind nss info = rfc2307 >>>>>>>> winbind refresh tickets = Yes >>>>>>>> winbind normalize names = Yes >>>>>>>> idmap config * : backend = tdb >>>>>>>> idmap config * : range = 2000-9999 >>>>>>>> idmap config JASONDOMAINI : backend = ad >>>>>>>> idmap config JASONDOMAINI : range = 10000-999999 >>>>>>>> idmap config JASONDOMAINI : schema_mode = rfc2307 >>>>>>>> printcap name = cups >>>>>>>> cups options = raw >>>>>>>> usershare allow guests = yes >>>>>>>> domain master = no >>>>>>>> local master = no >>>>>>>> preferred master = no >>>>>>>> os level = 20 >>>>>>>> map to guest = bad user >>>>>>>> vfs objects = acl_xattr >>>>>>>> map acl inherit = Yes >>>>>>>> store dos attributes = Yes >>>>>>>> log level = 6 >>>>>>>> >>>>>>>> /etc/krb5.conf >>>>>>>> >>>>>>>> [libdefaults] >>>>>>>> default_realm = JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>> dns_lookup_realm = false >>>>>>>> dns_lookup_kdc = true >>>>>>>> ticket_lifetime = 24h >>>>>>>> forwardable = yes >>>>>>>> >>>>>>>> /etc/resolv.conf >>>>>>>> >>>>>>>> nameserver <your AD DC's ipaddress> >>>>>>>> search jasondomaini.jasondomain.jj >>>>>>>> >>>>>>>> If required, alter them to match the above, check that 'hostname' >>>>>>>> returns only the hostname of the client, check that 'hostname -f' >>>>>>>> returns the FQDN. If either are not correct, fix them. >>>>>>>> >>>>>>>> Remove likewiseopen >>>>>>>> >>>>>>>> Once everything is correct, run the following command: >>>>>>>> >>>>>>>> net ads join -U Administrator at JASONDOMAINI.JASONDOMAIN.JJ >>>>>>>> >>>>>>>> You should be asked for the domain Administrators password, enter this >>>>>>>> and you should join the domain >>>>>>>> >>>>>>>> Rowland >>>>>>>> >>>>>>> What Windows DC are you using ? >>>>>>> What is the realm name * workgroup name on the Windows DC ? >>>>>>> >>>>>>> Rowland >>>>>> oops, that should have been: >>>>>> >>>>>> >>>>>> What is the realm name & workgroup name on the Windows DC ? >>>>>> >>>>>> Rowland >>>>>> >>>>> Hi, will you answer these questions: >>>>> >>>>> What Windows DC are you using ? >>>>> What is the realm name on the Windows DC ? >>>>> What is the workgroup name on the Windows DC ? >>>>> >>>>> You do not need all of what you have in /etc/krb5.conf, but please >>>>> answer the questions above first. >>>>> >>>>> Rowland >>>>> >>>> OK, so what is your 'domain' name (and No, it is not 'JASONDOMAIN.JJ') >>>> >>>> Rowland >>>> > Your confused !!! > > looking back over what you posted I found this: > > Thanks a lot. > I changed the below lines to correct domain name : > > idmap config JASONDOMAIN : range = 10000-999999 > idmap config JASONDOMAIN : schema_mode = rfc2307 > > and after join, the command "net rpc testjoin" show same error : > > Unable to find a suitable server for domain JASONDOMAINI > Join to domain 'JASONDOMAINI' is not valid: NT_STATUS_UNSUCCESSFUL > > this was 05/01/15 07:02 > > Totally missed it then, but now it sticks out like a sore thumb, is your > workgroup/NETBiosdomain 'JASONDOMAIN' *OR* 'JASONDOMAINI' ????? > > RowlandWhen you join a Unix client to an AD domain, you use 'net ads join -U Administrator' (or another user that has the right to join machines to the domain) You need to have lines in smb.conf similar to these: workgroup = DOMAIN realm = DOMAIN.TLD idmap config DOMAIN : backend = ad idmap config DOMAIN : schema_mode = rfc2307 idmap config DOMAIN : range = RANGE Which in your case would be: workgroup = JASONDOMAINI realm = JASONDOMAIN.JJ idmap config JASONDOMAINI : backend = ad idmap config JASONDOMAINI : schema_mode = rfc2307 idmap config JASONDOMAINI : range = RANGE You would also have to have your realm in /etc/krb5.conf [libdefaults] default_realm = JASONDOMAIN.JJ dns_lookup_realm = false dns_lookup_kdc = true The /etc/resolv.conf should look something like this: search jasondomain.jj nameserver <ipaddress of your AD DC> With these all set correctly, the join should work. Rowland
Apparently Analagous Threads
- Use Samba with ACL for read Active Directory and set Permissions via it.
- Use Samba with ACL for read Active Directory and set Permissions via it.
- Use Samba with ACL for read Active Directory and set Permissions via it.
- Use Samba with ACL for read Active Directory and set Permissions via it.
- Use Samba with ACL for read Active Directory and set Permissions via it.