search for: jhrozek

Hi Rowland, You say that winbind can do anything that sssd can, yet I've not been able to find winbind instructions similar to these for sssd: http://jhrozek.livejournal.com/3860.html Do you know of such instructions? More particularly, do you know how with winbind we can lock sudoers down to specific OUs? We need to do a lot more than basic authentication and simple file sharing. From both this thread and previous ones I suspect our environment is...

...joined this list because I cannot find an answer to my problem. The setup is this: I installed CentOS release 6.5 (Final) minimal version Updated all packages Added the server to the Active Directory domain as a member server using the method described here (using adcli, kerberos and sssd): http://jhrozek.livejournal.com/3581.html It worked, I tested by trying to connect through ssh with domain user credentials and by doing "su domain_user" from root ssh console. Both worked. After that, I installed Samba (Version 3.6.9-169.el6_5). Created a minimal config file like this: [global]...

...on DC where the import were done. Database with Samba 4 was always significantly bigger on this host than on the replicated ones. According to that I'll try the dump trick which would also teach me some things : ) I'll came back after tests... For LMDB the start seems to be there: https://jhrozek.fedorapeople.org/sambaxp I'll read and try if I can (ie if I'm not too thick :p) Cheers, mathias 2015-06-01 22:06 GMT+02:00 Matthieu Patou <mat at samba.org>: > On 06/01/2015 05:09 AM, mathias dufresne wrote: > >> Hi all, >> >> Still playing with a big data...

...rt with samba 4.5.12 from debian. 2) tell us the xUbuntu version and the samba (smbclient) version If i recall correct.. Sssd lower then 1.12 my have problems, but as Rowland also said, I (we) know nothing about sssd here, except what i google. If you did not read this one, please do. https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-ipa-ad-trust-deployments/ I dont know it it helps, but it shows some good settings and its good explained. And if you get it working, please share the solution. ;-) Greetz, Louis > -----Oorspronkelijk bericht----- > Van: sam...

...focues on that for companies. > > > > > > If i recall correct.. > > Sssd lower then 1.12 my have problems, but as Rowland also said, > > I (we) know nothing about sssd here, except what i google. > > If you did not read this one, please do. > > https://jhrozek.wordpress.com/2015/08/19/performance-tuning- > > sssd-for-large-ipa-ad-trust-deployments/ > > I dont know it it helps, but it shows some good settings > and its good > > explained. > > And if you get it working, please share the solution. ;-) > > > > I'...

...machines dies... Maybe one day I'll try to compile a newer version. > > If i recall correct.. > Sssd lower then 1.12 my have problems, but as Rowland also said, > I (we) know nothing about sssd here, except what i google. > If you did not read this one, please do. > https://jhrozek.wordpress.com/2015/08/19/performance-tuning- > sssd-for-large-ipa-ad-trust-deployments/ > I dont know it it helps, but it shows some good settings and its good > explained. > And if you get it working, please share the solution. ;-) > I'm not sure about the version but I think...

Hi all, Still playing with a big database (120k users, 150k computers) I tried to split my users into a lot of OUs. This increased the database size and I was not able to finish to add users into the DB because database file has reached 4GB size which seems to be the limit. First: am I right to say file /var/lib/samba/private/sam.ldb.d/DC=example,DC=com.ldb has a maximum size of 4GB? Secondly:

Hi Rowland, Those low numbers you refer to are in fact the standard numbers assigned to those groups, so I fail to see the problem. As for mapping Administrator to root, I believe that's entirely optional, rather than required. Under normal circumstances we don't use the domain Administrator account at all. We have a root account we use instead. In regard to winbind, we have never

Thanks Rowland. I'll give a try to both things (WG and SPN). To be honest, I ask here because the sssd daemon is working as expected allowing the authentication of the machine to the domain, and the real problem is that I'm not able to access to a shared drive using a Kerberos authentication (cifs and smbclient) and i've thought that maybe was a misconfiguration on member server

...h krb5_keytab = /etc/krb5.keytab krb5_realm =DOMAIN.COM ldap_search_base = dc=domain,dc=com ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt ad_hostname = Server.DOMAIN.COM ad_domain = DOMAIN.COM ldap_id_mapping = true default_shell = /bin/bash ldap_referrals = false # 2019-03-30: https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-ipa-ad-trust-deployments/ subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout #ignore_group_members = true ldap_purge_cache_timeout = 0 krb5_auth_timeout = 15 # 2019-04-01: Old config cache_credentials = True ldap_schema =...