samba - Feb 2018 - Changing expired Samba AD password during Windows login

On another clean install (with all updates) of Ubuntu Server 16.04.3, 
trying your line of dependencies fails:

Package libgpgme-dev is not available, but is referred to by another 
package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'libgpgme-dev' has no installation candidate
E: Unable to locate package perl-modules-5.26
E: Couldn't find any package by glob 'perl-modules-5.26'
E: Couldn't find any package by regex 'perl-modules-5.26'
E: Unable to locate package python-gpg
E: Unable to locate package python3-gpg

Regardless, using plain apt-get on that version of Ubuntu results in

krb5-kdc (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])

libkrb5-dev (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])

When the Samba install/build docs state that version "MIT Kerberos 
1.15.1 or later" is required. I couldn't figure out how to install that
version on Ubuntu 16.04.3 without just downloading the krb5 sources and 
compiling myself. Doing that required a lot of other tweaking to get all 
the krb5 dependencies and install directories "correct" to complete
the
build and have a subsequent Samba 4.7.4 build actually find a 
functioning krb5


On 01/31/2018 02:24 PM, Micha Ballmann wrote:
> apt-get install acl attr autoconf bind9utils bison build-essential 
> debhelper dnsutils docbook-xml docbook-xsl flex gdb libjansson-dev 
> krb5-user libacl1-dev libaio-dev libarchive-dev libattr1-dev 
> libblkid-dev libbsd-dev libcap-dev libcups2-dev libgnutls28-dev 
> libgpgme-dev libjson-perl libldap2-dev libncurses5-dev libpam0g-dev 
> libparse-yapp-perl libpopt-dev libreadline-dev nettle-dev perl 
> perl-modules-5.26 pkg-config python-all-dev python-crypto python-dbg 
> python-dev python-dnspython python3-dnspython python-gpg python3-gpg 
> python-markdown python3-markdown python3-dev xsltproc zlib1g-dev 
> libkrb5-dev krb5-kdc

On Wed, 31 Jan 2018 19:01:42 -0500
Ken McDonald via samba <samba at lists.samba.org> wrote:
> On another clean install (with all updates) of Ubuntu Server 16.04.3, 
> trying your line of dependencies fails:
> 
> Package libgpgme-dev is not available, but is referred to by another 
> package.
> This may mean that the package is missing, has been obsoleted, or
> is only available from another source
> 
> E: Package 'libgpgme-dev' has no installation candidate
> E: Unable to locate package perl-modules-5.26
> E: Couldn't find any package by glob 'perl-modules-5.26'
> E: Couldn't find any package by regex 'perl-modules-5.26'
> E: Unable to locate package python-gpg
> E: Unable to locate package python3-gpg
> 
> Regardless, using plain apt-get on that version of Ubuntu results in
> 
> krb5-kdc (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])
> 
> libkrb5-dev (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])
> 
> When the Samba install/build docs state that version "MIT Kerberos 
> 1.15.1 or later" is required. I couldn't figure out how to install
> that version on Ubuntu 16.04.3 without just downloading the krb5
> sources and compiling myself. Doing that required a lot of other
> tweaking to get all the krb5 dependencies and install directories
> "correct" to complete the build and have a subsequent Samba 4.7.4
> build actually find a functioning krb5
> 
> 
Samba by default uses Heimdal, you do not need to use MIT. 
The ability to use MIT was added to allow red-hat distros to finally
have AD DC packages and is still being worked on. 
On distros other than red-hat ones, you should continue to use the
Samba supplied Heimdal kdc.

Rowland

Hai, 

A bit quick help here.. 

If you go to http://apt.van-belle.nl 

Get the debian stretch-unstable lines and put then in your ubuntu. 
Now disable the deb line and enable the deb-src line. 

Now have a look here and get all the sources, listed on the bottem. 
http://apt.van-belle.nl/current-packages-in-stretch-unstable-apt.txt

I use this build order.
1 talloc
2 teven
3 teb
4 cmocka
5 ldb
6 nss-wrapper
7 revolv-wrapper
8 uid-wrapper
9 socket-wrapper
10 pam-wrapper
11 samba

Create a "file" repo include it in the apt list. ( deb only ) 
I use this:  
Files, .deb new builded, are 1 folder below the source folder. 

The script creates an "$ARCH" folder and create the packages.gz for
apt-get.
Put this file in there.  ( code below ) and run it. 

You might need to install dpkg-dev

#!/bin/bash

set -e

BUILDARCH=$(dpkg-architecture -q DEB_BUILD_ARCH)
echo "Processing for Arch: ${BUILDARCH}"

if [ ! -e /etc/apt/sources.list.d/file-repo.list ]; then
    echo "deb [trusted=yes] file:/home/pbuilder/archive/build-samba 
${BUILDARCH}/" > /etc/apt/sources.list.d/file-repo.list
fi

if [ ! -d ${BUILDARCH} ]; then
    mkdir ${BUILDARCH}
fi

if [ $(ls ${1}/*| grep "_${BUILDARCH}.deb" | wc -l) -ge 1 ]; then
    echo "Copy ${BUILDARCH}.deb to ${BUILDARCH}/"
    cp $1/*${BUILDARCH}.deb  ${BUILDARCH}/
else
    echo "No files detected in $1"
fi

if [ $(ls ${1}/*| grep "_all.deb" | wc -l) -ge 1 ]; then
    echo "Copy _all.deb to ${BUILDARCH}/"
    cp $1/*_all.deb  ${BUILDARCH}/
else
    echo "no *_all.deb detected in $1"
fi

dpkg-scanpackages ${BUILDARCH} /dev/null > ${BUILDARCH}/Packages
echo "Running: apt-get update -qq  ... Please wait..."
apt-get -qq update

And build in above order. 
You might need to change the debian/control files a bit for ubuntu. 
Just run apt-get build-dep package and if its still wrong or to low in version, 
The build wil stop. 

Im but buzzy atm, but if there are more people that want ubuntu packages,
i'll think about it.
But if i do that, then its only for the latest LTS version. 

A tip in finding package..
> > E: Package 'libgpgme-dev' has no installation candidate
> > E: Unable to locate package perl-modules-5.26
> > E: Couldn't find any package by glob 'perl-modules-5.26'
> > E: Couldn't find any package by regex 'perl-modules-5.26'
> > E: Unable to locate package python-gpg
> > E: Unable to locate package python3-gpg
https://packages.ubuntu.com/ 
Search for the missing, like libgpgme-dev and get the one for your system. 
If its not available get one version up. ( get the sources and rebuild it ! ) 
For perl-modules-5.26 change in the control files perl to perl-modules-5.24. 
https://packages.ubuntu.com/zesty/any/perl-modules-5.24 
And 
https://packages.ubuntu.com/zesty/python-gpg 
For you python-gpg

Good luck, if you have "small" questions, mail the list and pm me. 
Im very buzy atm, but i'll try to give bit help here. 


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: donderdag 1 februari 2018 9:55
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Changing expired Samba AD password 
> during Windows login
> 
> On Wed, 31 Jan 2018 19:01:42 -0500
> Ken McDonald via samba <samba at lists.samba.org> wrote:
> 
> > On another clean install (with all updates) of Ubuntu 
> Server 16.04.3, 
> > trying your line of dependencies fails:
> > 
> > Package libgpgme-dev is not available, but is referred to 
> by another 
> > package.
> > This may mean that the package is missing, has been obsoleted, or
> > is only available from another source
> > 
> > E: Package 'libgpgme-dev' has no installation candidate
> > E: Unable to locate package perl-modules-5.26
> > E: Couldn't find any package by glob 'perl-modules-5.26'
> > E: Couldn't find any package by regex 'perl-modules-5.26'
> > E: Unable to locate package python-gpg
> > E: Unable to locate package python3-gpg
> > 
> > Regardless, using plain apt-get on that version of Ubuntu results in
> > 
> > krb5-kdc (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])
> > 
> > libkrb5-dev (1.13.2+dfsg-5ubuntu2 
> Ubuntu:16.04/xenial-updates [amd64])
> > 
> > When the Samba install/build docs state that version "MIT
Kerberos
> > 1.15.1 or later" is required. I couldn't figure out how to
install
> > that version on Ubuntu 16.04.3 without just downloading the krb5
> > sources and compiling myself. Doing that required a lot of other
> > tweaking to get all the krb5 dependencies and install directories
> > "correct" to complete the build and have a subsequent Samba
4.7.4
> > build actually find a functioning krb5
> > 
> > 
> 
> Samba by default uses Heimdal, you do not need to use MIT. 
> The ability to use MIT was added to allow red-hat distros to finally
> have AD DC packages and is still being worked on. 
> On distros other than red-hat ones, you should continue to use the
> Samba supplied Heimdal kdc.
> 
> Rowland
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Ah, I see now. I went back and re-read the Samba wiki on MIT Kerberos 
with your comments in mind

https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC

"For this reason, vendors of operating systems that only support MIT 
Kerberos could not provide packages with AD DC-capabilities"

So I now understand this does not mean other Windows Server OS's or 
Windows OS AD-specific server applications or 3rd-party Windows 
software. It means Linux OS's running Samba itself and their ability to 
provide Samba-compatible Kerberos support.

Great! Thanks for clarifying it. I will just proceed with my plans based 
on Heimdal only. I will be moving several of my customer's MS Server 
2008 AD DC's domains/PCs/users to Linux based Samba DC's instead of 
paying license fees to upgrade their MS Windows OS's.

Much appreciate everyone's help along the way with answers towards my 
solution.


On 02/01/2018 03:55 AM, Rowland Penny via samba wrote:
> On Wed, 31 Jan 2018 19:01:42 -0500
> Ken McDonald via samba <samba at lists.samba.org> wrote:
>
>> On another clean install (with all updates) of Ubuntu Server 16.04.3,
>> trying your line of dependencies fails:
>>
>> Package libgpgme-dev is not available, but is referred to by another
>> package.
>> This may mean that the package is missing, has been obsoleted, or
>> is only available from another source
>>
>> E: Package 'libgpgme-dev' has no installation candidate
>> E: Unable to locate package perl-modules-5.26
>> E: Couldn't find any package by glob 'perl-modules-5.26'
>> E: Couldn't find any package by regex 'perl-modules-5.26'
>> E: Unable to locate package python-gpg
>> E: Unable to locate package python3-gpg
>>
>> Regardless, using plain apt-get on that version of Ubuntu results in
>>
>> krb5-kdc (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])
>>
>> libkrb5-dev (1.13.2+dfsg-5ubuntu2 Ubuntu:16.04/xenial-updates [amd64])
>>
>> When the Samba install/build docs state that version "MIT Kerberos
>> 1.15.1 or later" is required. I couldn't figure out how to
install
>> that version on Ubuntu 16.04.3 without just downloading the krb5
>> sources and compiling myself. Doing that required a lot of other
>> tweaking to get all the krb5 dependencies and install directories
>> "correct" to complete the build and have a subsequent Samba
4.7.4
>> build actually find a functioning krb5
>>
>>
> Samba by default uses Heimdal, you do not need to use MIT.
> The ability to use MIT was added to allow red-hat distros to finally
> have AD DC packages and is still being worked on.
> On distros other than red-hat ones, you should continue to use the
> Samba supplied Heimdal kdc.
>
> Rowland
>
>