samba - Mar 2021 - Two SMB Domain member gateways to CEPHFS

On 30/03/2021 11:58, Oskari Koivisto wrote:
> Hi, no no, Samba is NOT an AD DC.

I never said it was, but you are running Samba as a Unix domain member, 
'security = ADS' says this and as such, AD domain rules apply. This 
means that you shouldn't use the '.local' TLD, but you haven't
actually
confirmed what the workgroup name is (though, from what you posted, it 
looks like it is 'MICT'), what is the REALM, is it the dns domain in 
uppercase ? Something like 'mict.local' ? If it is, the ensure Avahi 
isn't running.
>
> it?s only a member in Domain and should only be used to authenticate user
to the shares.
>
> the ceph clusters are in 2 separate locations but both cluster are mainly
accessed via different users and groups.
>
> There is only few services that actually connects to both cluster.

It sounds like you have one cluster at site A and another at site B, 
with at least one Unix domain member at each site, but where are the DC's ?

Rowland

Hi,

ok sorry,

The workgroup is MICT also as per documentation I?ve understood.
Both. workgroup and realm is in capitals, only realm having .local suffix.

Yes, both sites have their own DCs but they?re control the same domain.

-Oskari
> On 30. Mar 2021, at 15.12, Rowland penny via samba <samba at
lists.samba.org> wrote:
> 
> On 30/03/2021 11:58, Oskari Koivisto wrote:
>> Hi, no no, Samba is NOT an AD DC.
> 
> 
> I never said it was, but you are running Samba as a Unix domain member,
'security = ADS' says this and as such, AD domain rules apply. This
means that you shouldn't use the '.local' TLD, but you haven't
actually confirmed what the workgroup name is (though, from what you posted, it
looks like it is 'MICT'), what is the REALM, is it the dns domain in
uppercase ? Something like 'mict.local' ? If it is, the ensure Avahi
isn't running.
> 
>> 
>> it?s only a member in Domain and should only be used to authenticate
user to the shares.
>> 
>> the ceph clusters are in 2 separate locations but both cluster are
mainly accessed via different users and groups.
>> 
>> There is only few services that actually connects to both cluster.
> 
> 
> It sounds like you have one cluster at site A and another at site B, with
at least one Unix domain member at each site, but where are the DC's ?
> 
> Rowland
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba