Il 03/12/24 10:13, Rowland Penny via samba ha scritto:> On Tue, 3 Dec 2024 09:15:36 +0100
> Mitja Tav?ar via samba <samba at lists.samba.org> wrote:
>
>> Hi, i have some problems with a recently joined Read Only Domain
>> controller.
>>
>> I had 2 Domain Controllers based on Windows Server 2019 (hosts
>> vmw2srvdc1 an vmw2srvdc2). I and i recently added a new site (PSN)
>> and Read Only DC in this second site based on samba (host lvsrvdc).
>
> I know that RODCs sound like a good idea, except for two things, they
> were only really designed for a small site user base, but more
> importantly, what happens if the site link goes down for any
> considerable period ?
This is the first time we have used a RODC; our choice was more of a
security-oriented one.
The remote site should have about 30 servers, and we consider the connection to
be
sufficiently reliable and redundant. It is possible since there was some moment
of disconnection
between the various domain controllers while we were fixing the firewalling
rules but not prolonged for hours.
> You also haven't told us what Linux distro you are using and how you
> set up the RODC and fileserver, what is in their smb.conf files for
> instance ?
All samba servers are debian12 samba on domain members is 4.17.12-Debian
while on RODC is backports version 4.21.1-Debian-4.21.1+dfsg-2~bpo12+1
The smb.conf of RODC was generate at join time:
# Global parameters
[global]
dns forwarder = 8.8.8.8 8.8.4.4
netbios name = LVSRVDC
realm = INTRA.COMUNE.TRENTO.IT
server role = active directory domain controller
workgroup = INTRA
[sysvol]
path = /var/lib/samba/sysvol
read only = No
[netlogon]
path = /var/lib/samba/sysvol/intra.comune.trento.it/scripts
read only = No
This is one of the fileservers smb.conf.
[global]
realm = INTRA.COMUNE.TRENTO.IT
workgroup = INTRA
security = ADS
local master = no
domain master = no
preferred master = no
mangling method = hash2
server string = File server psn-lvsrv39
idmap config * : backend = tdb
idmap config * : range = 1000000-2000000
idmap config INTRA : backend = rid
idmap config INTRA : range = 10000-99999
template shell = /bin/bash
template homedir = /home/%D/%U
winbind use default domain = no
winbind enum users = Yes
winbind enum groups = Yes
winbind expand groups = 2
server min protocol = NT1
log file = /var/log/samba/%M_%U_%R.smbd
log level = 1
hosts allow = \
192.168.0.0/255.255.0.0 \
10.48.0.0/255.240.0.0
load printers = no
printcap name = /dev/null
disable spoolss = yes
usershare path
deadtime = 60
use sendfile = true
include = /etc/samba/fileshares/fsapp.conf
--
Mitja Tav?ar