> On 3/12/2022, at 1:10 AM, Rowland Penny via samba <samba at
lists.samba.org> wrote:
>
> ?
>
>> On 02/12/2022 11:15, Callum MacEwan via samba wrote:
>> ?
>>>
>>>> On 2/12/2022, at 8:26 PM, Rowland Penny via samba <samba at
lists.samba.org> wrote:
>>>
>>> ?
>>>
>>>> On 30/11/2022 20:57, Callum MacEwan via samba wrote:
>>>> I have checked all my smb.conf on the AD DC and Dom member
>>>> On the AD DC
>>>> wbinfo -u and -g respond normally with users and groups
prefixed with Domain
>>>> Starting samba with -i -d 4 reveals no obvious error it chats
to DOM members
>>>> The only error I saw was invalid SID (not sure if that is an
error or warning )
>>>> On Dom Member
>>>> wbinfo -u returns nothing but Wbinfo -g returns domain\groups
as expected
>>>> I have started all modules with -i -d 4 and don?t see any
obvious errors
>>>> wbinfo -p pings winbindd successfully
>>>> wbinfo -P returns an error
>>>>> checking the NETLOGON for domain[SAND] dc connection to
"" failed
>>>>> failed to call wbcPingDc: WBC_ERR_DOMAIN_NOT_FOUND
>>>> All the DNS test are good
>>>> Any guidance on what to do next appreciated
>>>
>>> Would you like to answer the question I asked:
>> Sorry Rowland with all the restarts the mail server had a meltdown
>>>
>>> Can you clarify where you where getting those numbers.
>> Initially on the DC
>> It changed mapping to 3000017 and 100
>
> From looking at your smb.conf files below, this is what I would expect on a
DC, unless you added uidNumber & gidNumer attributes.
>
>> The domain controller is also my web server so I login with my domain
account and mount the file server so I don?t have permission issues this had
been working perfectly for 5 weeks +
>
> It is not really a good idea to use a Samba DC (or any DC for that matter)
for anything other than authentication.
>
>>>
>>> I suppose I should also have asked, how you are getting those
numbers ?
>> I have remote cameras capturing frames and saving to the server via ftp
they started failing with permission issues
>
> Which server ?
They ftp into the AD DC>
>>>
>>> I think you need to post the smb.conf from the DC and the Unix
domain member.
>> AD DC sub.conf minus two system volume mounts
>> These configs might not be exactly what the working confs were I lost
some lines due to a sticky keyboard and lag
>> [global]
>> bind interfaces only = Yes
>> dns forwarder = 210.55.111.1
>> interfaces = 127.0.0.1 192.168.50.0/24
>> dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool
>> netbios name = SAND
>> realm = BEACH.PEGASUSNZ.COM
>> workgroup = BEACH
>> server role = active directory domain controller
>> apply group policies = yes
>> template shell = /bin/bash
>> winbind enum users = yes
>> winbind enum groups = yes
>
> I keep telling people this, but nobody seems to listen, you only need the
'winbind enum' lines for testing purposes, Samba works perfectly well
without them.
>
I only added them when my trouble began they are commented out
>> log level = 4
>> Dom Member
>> [global]
>> bind interfaces only = Yes
>> interfaces = lo 192.168.50.0/24
>> netbios name = DUNE
>> workgroup = BEACH
>> realm = BEACH.PEGASUSNZ.COM
>> server role = member server
>> security = ADS
>> #kerberos method = secrets and keytab
>> #dedicated keytab file = /etc/krb5.keytab
>> #winbind refresh tickets = Yes
>> log file - /var/log/samba/%m.log
>> log level = 4
>> idmap config *: backend = autorid
>> idmap config *: range = 100000-2999999
>> idmap config BEACH : backend = rid
>> idmap config BEACH : range =10000-99999
>> #idmap config BEACH : unix_nss_info = yes
>
> ARGGGGHHHH!
>
> If you are going to use the 'autorid' idmap backend, you only use
the 'autorid' idmap backend, the other 'rid' lines should be
removed (I take it you have set up a two trust to BALEWAN), also, you only use
'unix nss info' with the 'ad' idmap backend. To put it bluntly,
you couldn't have got it more wrong.
Sorry to upset you!
BALEWAN was actually BEACH
>
>> template shell = /bin/bash
>> #template homedir = /media/home/%U
>> username map = /usr/local/samba/etc/user.map
>
> I take that you you used to compile Samba yourself.
No I used the Debian package
When I use a windows box to look at the Domain Controller it does not find the
domain controller if I select manually the DC it status changes from pending to
online but the DC column is blank?> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba