[Samba] L2tp and winbind - server role active directory domain controller

L.P.H. van Belle
2016-08-30T14:27:51Z

Uhm upgrade.. to zentyal 4.2..

Setup a member server, now enable l2tp with winbindd
That should work fine.

Winbindd can not run on the AD DC, but it does on a member server.

Greetz,

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Gilberto Nunes
> via samba
> Verzonden: dinsdag 30 augustus 2016 16:07
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] L2tp and winbind - server role active directory
> domain controller
>
> Hi
>
> Thanks for your answer...
>
> Unfortunatelly, I can't upgrade because it's a appliance - Zentyal
Server
> 4.0.
> I will try another thing.
>
> Thank you any way...
>
> 2016-08-30 10:47 GMT-03:00 Rowland Penny via samba
> <samba at lists.samba.org>:
>
> > On Tue, 30 Aug 2016 10:05:28 -0300
> > Gilberto Nunes via samba <samba at lists.samba.org> wrote:
> >
> > > Hello list...
> > >
> > > I have samba 4.1.17 installed and in the same server, I have
l2tp.
> > > Samba it configurated as active directory domain controller.
> > >
> > > I am trying authetication against samba with winbind.
> > > I want to know how to restrict authentication for certain group.
> > > I put this line in the end of l2tp conf file:
> > >
> > > ntlm_auth-helper '/usr/bin/ntlm_auth
--helper-protocol=ntlm-server-1
> > > --require-membership-of="domain\\VPN"'
> > >
> > > But I get this in the log.windbindd:
> > >
> > >  server role = 'active directory domain controller' not
compatible
> > > with running the winbindd binary.
> > >   You should start 'samba' instead, and it will control
starting the
> > > internal AD DC winbindd implementation, which is not the same as
this
> > > one
> > >
> > > And seem to me group restriction do not work!
> > > Instead, any usser can connect via l2tp vpn.
> > >
> > > Somebody can help??
> > >
> > > Thanks a lot
> > >
> > > Gilberto Ferreira
> >
> > You really need to upgrade samba, 4.1.x is EOL, 4.5.0 will be released
> > shortly and then 4.2.x will go EOL.
> > Before 4.2.0, winbindd wasn't used, the 'winbind' part of
the 'samba'
> > binary was used. When 4.2.0 was released the code was changed to use
> > the separate 'winbindd' binary instead and the 'samba'
binary will
> > start it for you, just like it starts 'smbd'.
> >
> > As you have found out, you cannot start the separate
'winbindd' binary
> > yourself.
> >
> > Rowland
> >
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
>
>
>
> --
>
> Gilberto Ferreira
> +55 (47) 9676-7530
> Skype: gilberto.nunes36