samba - Apr 2024 - bad home path from AD

Why do you tell me I am using SMBv1? I can't see any parameter to set it ?


For idmapping, I'm afraid of side effects in the long term, my server 
being in AD, should I ignore the ldap in my smb.conf?
Which lines would you recommend removing or adding?

Arnaud

Le 30/03/2024 ? 12:05, Rowland Penny via samba a ?crit?:
> On Sat, 30 Mar 2024 11:42:10 +0100
> "arnaud.bougeard--- via samba" <samba at lists.samba.org>
wrote:
> 
>> This samba file server is a ldap client? and a AD client.
>>
>> So? listening port is not a problem.? I just worry about idmapping.
>>
> 
> It cannot be both, for a start, using Samba with ldap is akin to
> running an NT4-style domain and that requires SMBv1, do you really want
> to use SMBv1 ?
> 
> What you could do is, providing the ldap server is running on another
> machine and is running as an NT4-style PDC, set up a trust between the
> AD domain and the PDC.
> 
> However, because your AD domain uses IDs in the 1000-300000 range and
> your ldap uses IDs in the 500-29009894 range, you cannot do this, the
> ranges overlap, more than overlap, the AD range fits inside the ldap
> range.
> 
>  From your email address, it looks like you organisation is a
> university and, as such, I feel you should be using best practice and
> that doesn't include using SMBv1
> 
> Rowland
> 
> 
> 
> 
>

On Tue, 2 Apr 2024 09:44:35 +0200
Arnaud Bougeard via samba <samba at lists.samba.org> wrote:
> Why do you tell me I am using SMBv1? I can't see any parameter to set
> it ?
I never said you were using SMBv1, I said running an NT4-style domain
requires SMBv1.
> 
> For idmapping, I'm afraid of side effects in the long term, my server 
> being in AD, should I ignore the ldap in my smb.conf?
> Which lines would you recommend removing or adding?
It all depends on what you mean by 'ldap'.
If you are referring to an ldap server running on the same machine as
your AD, then turn the ldap off, in my opinion, you cannot use Samba as
a member of an AD domain and also run an ldap server on the same
machine.

What you can do is, run an AD DC somewhere on one machine, run Linux
clients as Unix domain members using the AD DC as their server. You
could then run your 'ldap' on another machine (not an AD DC or Unix
domain member) and sync this from AD.
A better idea (because ldap is a vital part of AD) would be to use the
AD domain as an ldap server and store everything in AD.
This what was behind the creation of AD, a single (all be it on
multiple DCs) point of maintenance.

This is just my opinion, but I wish universities would come into the
21st century.

Rowland