samba - Sep 2022 - Windows ACLs

On 23/09/2022 16:58, Sonic wrote:
> On Fri, Sep 23, 2022 at 10:04 AM Rowland Penny via samba
> <samba at lists.samba.org> wrote:
>> Download the script and post the output here.
> 
> Output of the script looks good to me, but maybe you'll see something
awry.
> One issue with the script is that the 'kinit Administrator' check
is
> hardcoded as "kinit Administrator 2> /dev/null" which fails
for me,
> but when I changed it to the actual name of the domain administrator
> "kinit adminex 2> /dev/null" the check passed just fine. There
is no
> account named "Administrator".
Known problem, but I cannot contact Louis to get this fixed.

> Checking file: /etc/resolv.conf
> 
> domain pizza.example.com
> nameserver 192.168.114.1
> -----------
> Kerberos SRV _kerberos._tcp.pizza.example.com record(s) verified ok,
> sample output:
> Server:         192.168.114.11
> Address:        192.168.114.11#53
It should be:

search pizza.example.com

in /etc/resolv.conf instead of:

domain pizza.example.com

also is 'nameserver 192.168.114.1' a typo, because your DC appears to 
use '192.168.114.11' as its ipaddress.

Rowland

On Fri, Sep 23, 2022 at 12:19 PM Rowland Penny via samba
<samba at lists.samba.org> wrote:
> It should be:
> search pizza.example.com
> in /etc/resolv.conf instead of:
> domain pizza.example.com
Technically yes, although domain does work, but since it's deprecated
I will change it.
> also is 'nameserver 192.168.114.1' a typo, because your DC appears
to use '192.168.114.11' as its ipaddress.
Not a typo, I've tested it both ways. I generally point to the
network's local cache instead of the DC. But I also always test direct
to the DC just in case it does make a difference (never has in any of
my single DC environments).