search for: pam_member_attribute

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is for the same file server I wrote about earlier. I would like to restrict access by group, as defined in LDAP. The obvious solution is to add a filter to the login LDAP search that restricts to gidNumber=10038 or 10001, since those are the groups I need. From what I'm seeing, I need to add that to /etc/ldap.conf in the nss_base_

...;s /etc/ldap.conf base dc=example,dc=com uri ldapi:///127.0.0.1 uri ldap://127.0.0.1 ldap_version 3 binddn cn=admin,dc=example,dc=com bindpw mysecret rootbinddn cn=admin,dc=example,dc=com scope sub bind_policy soft pam_filter objectclass=posixAccount pam_login_attribute uid pam_check_host_attr yes pam_member_attribute memberUid pam_password md5 nss_base_passwd ou=people,dc=example,dc=com?sub nss_base_passwd ou=computers,dc=example,dc=com?sub nss_base_group ou=groups,dc=example,dc=com?sub And the smbldap.conf: SID="S-1-5-21-158730468-2379596502-3695168017" sambaDomain="REALM" slaveLDAP=&quo...

...g:range = 50000-500000 #logging log level = 1 --- my nsswitch/pam /etc/ldap.conf --- ssl off suffix "dc=th-domain,dc=lan" uri ldap://localhost pam_password exop rootbinddn "cn=root,dc=th-domain,dc=lan" ldap_version 3 pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute memberuid nss_base_passwd ou=peoples,dc=th-domain,dc=lan nss_base_shadow ou=peoples,dc=th-domain,dc=lan nss_base_group ou=groups,dc=th-domain,dc=lan nss_base_hosts ou=hosts,dc=th-domain,dc=lan scope one ----

Hi, Problem: I seem to be able to add users to ACLs from windows due to an "Name Not Found" error when looking up a username. According to what I have been able to find, you cannot browse users on a samba server from windows without winbind and "security = domain/ads". However, winbind does not have any place in my environment aside from remedying this problem. Is

...le ldap idmap suffix = ou=Idmap ldap ssl = start tls ldap passwd sync = yes /etc/ldap.conf uri ldaps://ldap2.adastral.ucl.ac.uk:636 base dc=adastral,dc=ucl,dc=ac,dc=uk rootbinddn cn=nssldap,ou=DSA,dc=adastral,dc=ucl,dc=ac,dc=uk scope one pam_filter objectclass=posixaccount pam_login_attribute uid pam_member_attribute gid pam_template_login_attribute uid pam_password md5 nss_base_passwd ou=People,dc=adastral,dc=ucl,dc=ac,dc=uk?one nss_base_shadow ou=People,dc=adastral,dc=ucl,dc=ac,dc=uk?one nss_base_group ou=Group,dc=adastral,dc=ucl,dc=ac,dc=uk?one nss_base_hosts ou=Hosts,dc=ada...

OK, just went through the research on how to set up scalable LDAP backends. By scaleable I mean without having Samba use the root dn to access ldap. This way, if you are going through the logs, you will be able to tell which domain controller is doing what. As far as I know, it *HAS* to be done this way because the posixGroup schema is way out of date (it wont take a dn as a member). This

...= 0750 browseable = Yes ..... ect ..... ===== END of SAMBA CONF FILE : /etc/samba/smb.conf ===== ===== NSS CONF FILE : /etc/libnss-ldap.conf ===== host 127.0.0.1 base dc=serveur,dc=domaine,dc=fr ldap_version 3 port 389 scope one pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute gid pam_password crypt nss_base_passwd dc=serveur,dc=domaine,dc=fr?sub nss_base_shadow ou=Users,dc=serveur,dc=domaine,dc=fr?sub nss_base_group ou=Groups,dc=serveur,dc=domaine,dc=fr?one nss_base_hosts ou=Computers,dc=serveur,dc=domaine,dc=fr?one ===== END of NSS CONF FILE : /etc/libnss-ldap.conf ===...

Hi, I have a question about getting linux workstation to authenticate users against a Samba PDC when they log in and mount all the necessary shares. Current setup: Linux server with Samba as the PCD Windows 2k and XP workstations are on the Samba domain and authenticate all users with the Samba PDC. Wants: Linux server with Samba as the PCD Windows 2k and XP workstations are on the Samba

...nix charset = UTF-8 == ldap.conf == base dc=example,dc=com uri ldap://127.0.0.1 ldap_version 3 binddn cn=admin,dc=example,dc=com bindpw mysecret rootbinddn cn=admin,dc=example,dc=com scope sub bind_policy soft pam_filter objectclass=posixAccount pam_login_attribute uid pam_check_host_attr yes pam_member_attribute memberUid pam_password md5 nss_base_passwd ou=people,dc=example,dc=com?sub nss_base_passwd ou=computers,dc=example,dc=com?sub nss_base_group ou=groups,dc=example,dc=com?sub == slapd.conf == include /etc/openldap/schema/core.schema include /etc/openldap/schema/collective.schema include...

.../lib/security/$ISA/pam_env.so session optional /lib/security/$ISA/pam_ldap.so /etc/ldap.conf is : # PADL Software # http://www.padl.com # host 10.79.52.1 base dc=naturecare,dc=com,dc=au scope sub timelimit 30 bind_timelimit 30 pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute memberUid nss_base_passwd ou=People,dc=naturecare,dc=com,dc=au?sub nss_base_shadow ou=People,dc=naturecare,dc=com,dc=au?sub nss_base_group ou=Group,dc=naturecare,dc=com,dc=au?sub ssl no pam_password md5 ********************************* The log.smbd shows : [2004/08/0...

...ch/pam /etc/ldap.conf > --- > ssl off > suffix "dc=th-domain,dc=lan" > uri ldap://localhost > pam_password exop > > rootbinddn "cn=root,dc=th-domain,dc=lan" > > ldap_version 3 > pam_filter objectclass=posixAccount > pam_login_attribute uid > pam_member_attribute memberuid > nss_base_passwd ou=peoples,dc=th-domain,dc=lan > nss_base_shadow ou=peoples,dc=th-domain,dc=lan > nss_base_group ou=groups,dc=th-domain,dc=lan > nss_base_hosts ou=hosts,dc=th-domain,dc=lan > > scope one > ---- > >

...o yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login. #pam_check_host_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_templ...

...nter$' -U Administrator* Password: tree connect failed: Call returned zero bytes (EOF) Here are my configuration files: */etc/ldap.conf file* host pdc.nijacol.net base dc=nijacol,dc=net rootbinddn cn=root,dc=nijacol,dc=net scope one pam_filter objectclass=posixaccount pam_login_attribute uid pam_member_attribute gid pam_password md5 nss_base_passwd ou=people,dc=nijacol,dc=net?one nss_base_shadow ou=People,dc=nijacol,dc=net?one nss_base_group ou=Groups,dc=nijacol,dc=net?one nss_base_hosts ou=Hosts,dc=nijacol,dc=net?one ssl off */etc/openldap/slapd.conf file *include /usr/s...

...s no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_templ...

-----Original Message----- From: Scott Phelps [mailto:sphelps@ridgways.com] Sent: Friday, July 11, 2003 9:19 PM To: 'samba@lists.samba.org' Subject: Samba-2.2.8a & LDAP - Can't join Domain - SID mapping error Hi everyone, I am at my wits end and am hoping one of you can help me out. I am getting the following error when attempting to join Windows XP/2000 machine to the domain:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have seen this problem posted several times and the common answer doesn't seem to be doing it for me. Here's the error: Trying to load: ldapsam_compat:ldap://127.0.0.1/ Attempting to register passdb backend ldapsam Successfully added passdb backend 'ldapsam' Attempting to register passdb backend ldapsam_compat Successfully added

...o # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_templ...

...s no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_templ...

Hi all I have samb3 with LDAP , My query is 1. My clients are windows 2000 professional, and the clients are not able to join the domain but if add the computer name in /etc/passwd ie computername$:x:110:200::/bin/false:/dev/null and then do smbpasswd -a -m computername , the computer is able to join the domain but i have mentioned the add machine script in smb.conf file 2. After Joining the

...o # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_templ...