search for: pre01svdeb01

...looks quite ok, but somehow it seems better to rejoin all the PCs and > member servers. We are through ~50% .. maybe inefficient, but the > fastest way for now. > > GPOs work, etc maybe I should start a new thread? I see issues on the fileserver, winbind crashes. Jul 08 10:12:38 pre01svdeb01 systemd[1]: Starting Samba Winbind Daemon... Jul 08 10:12:38 pre01svdeb01 systemd[1]: winbind.service: Supervising process 24915 which is not our child. We'll most likely not notice when it exits. Jul 08 10:12:38 pre01svdeb01 winbindd[24915]: [2017/07/08 10:12:38.759158, 0] ../source3/winbindd...

On Fri, 7 Jul 2017 10:43:41 +0200 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2017-06-30 um 09:41 schrieb Stefan G. Weichinger via samba: > > > I have an appointment to switch over a domain next friday, until > > then I have time to test packages in my test environment and decide > > what to use in real life there. I will

...1] ../source3/auth/auth_generic.c:172(auth3_generate_session_info_pac) Failed to map kerberos pac to server info (NT_STATUS_UNSUCCESSFUL) Yes, I have FQDNs in /etc/hosts and I *really* hesitate to edit these right now when so far most of things work. I paste my /etc/hosts and ask for hints. pre01svdeb01 = member server pre01svbmd01 = a windows server (member) pre01svdeb02 = samba ADS DC, not even listed here (192.168.16.205) -> 127.0.0.1 localhost 127.0.1.1 pre01svdeb01.my.tld pre01svdeb01 ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouter...

..._generate_session_info_pac) > Failed to map kerberos pac to server info (NT_STATUS_UNSUCCESSFUL) > > > Yes, I have FQDNs in /etc/hosts and I *really* hesitate to edit these > right now when so far most of things work. > > I paste my /etc/hosts and ask for hints. > > pre01svdeb01 = member server > pre01svbmd01 = a windows server (member) > pre01svdeb02 = samba ADS DC, not even listed here (192.168.16.205) > > -> > > 127.0.0.1 localhost > 127.0.1.1 pre01svdeb01.my.tld pre01svdeb01 > > ::1 localhost ip6-localhost ip6-loopba...

...tickets = Yes winbind use default domain = Yes idmap config buero:range = 10000-99999 idmap config buero:backend = rid idmap config *:range = 2000-9999 idmap config * : backend = tdb printing = bsd # smbclient \\\\server\\daten -Usgw%pw session setup failed: NT_STATUS_UNSUCCESSFUL root at pre01svdeb01:~# getent passwd sgw sgw:x:1000:1000:Stefan G. Weichinger,,,:/home/sgw:/bin/bash root at pre01svdeb01:~# wbinfo -i sgw sgw:*:11041:10513::/mnt/samba/Daten/sgw:/bin/bash

Am 31.07.19 um 15:59 schrieb L.P.H. van Belle via samba: > Ok, after that reboot > > ! Note, atm dont care about secrets.keytab (yet) > .. I was a bit ahead with things... > > One thing at a time, for the keytab to be corrected, you need a perfect correct working > A PTR CNAME GUIDs for the DC(3) first then we start thinking in kerberos corrections. > > Run

Am 2017-07-11 um 14:40 schrieb Rowland Penny: >> Restarted winbind, did "killall -HUP" on smbd and nmbd. >> >> still can't login to DM via smbclient and that mentioned user. >> >> I assume I need to restart all the smbd daemons ... ? > > Well, you wouldn't be able to, would you, what with having this in > smb.conf: > > template

...hare) >> >> there it is correctly displayed in smbstatus >> >> So I expect some wrong/outdated mapping on the DM/fileserver? >> >> >> > On a Unix domain member, this could only be in a user.map, so check this. username map = /etc/samba/smbusers root at pre01svdeb01:/etc/samba# cat smbusers !root = BUERO\Administrator BUERO\administrator Administrator administrator I could remove that for a test ... > I would also get the user to log into another PC and connect to another > fileserver and see what happens. That will have to wait until I am there. Very...

Am 2017-07-10 um 12:08 schrieb Rowland Penny via samba: > I would change /etc/hosts to this: > > 127.0.0.1 localhost > 127.0.1.1 pre01svdeb01.my.tld pre01svdeb01 > > ::1 localhost ip6-localhost ip6-loopback > ff02::1 ip6-allnodes > ff02::2 ip6-allrouters > > But replace '127.0.0.1' with the real ipaddress of pre01svdeb01.my.tld > if it has a fixed IP, if it hasn't, you can remove the entire line...

Am 2017-07-11 um 09:34 schrieb Stefan G. Weichinger via samba: > [2017/07/11 09:31:17.790046, 2] > ../source4/dns_server/dns_query.c:1019(dns_server_process_query_send) > Not authoritative for 'SERVER', forwarding > [2017/07/11 09:31:17.826966, 2] > ../source4/dns_server/dns_query.c:1019(dns_server_process_query_send) > Not authoritative for 'SERVER',

...idmap config buero:range = 10000-99999 > idmap config buero:backend = rid > idmap config *:range = 2000-9999 > idmap config * : backend = tdb > printing = bsd > > > # smbclient \\\\server\\daten -Usgw%pw > session setup failed: NT_STATUS_UNSUCCESSFUL > > root at pre01svdeb01:~# getent passwd sgw > sgw:x:1000:1000:Stefan G. Weichinger,,,:/home/sgw:/bin/bash > > root at pre01svdeb01:~# wbinfo -i sgw > sgw:*:11041:10513::/mnt/samba/Daten/sgw:/bin/bash Do you by any chance have a user in /etc/passwd on the DM called 'sgw' ? Rowland

I forgot. dig a pre01svdeb02.pilsbacher.at @192.168.16.205 dig a pre01svdeb02.pilsbacher.at @192.168.16.206 Can you run these also for me. And there are no CNAMEs pointing to the AD-DCs ?

same user uses a share on one of the DCs (yes, I know ... administrative small share) there it is correctly displayed in smbstatus So I expect some wrong/outdated mapping on the DM/fileserver?

On Tue, 11 Jul 2017 12:05:28 +0200 "Stefan G. Weichinger" <lists at xunil.at> wrote: > Am 2017-07-11 um 11:57 schrieb Rowland Penny: > > > Remove this local Unix group, you cannot have a group (or a user) > > in AD and /etc/group > > ok, done > > > Probably because '11029' isn't a 'RID', it will be a uidNumber. > >

Am 05.08.19 um 10:41 schrieb Rowland penny via samba: > On 05/08/2019 09:33, Stefan G. Weichinger via samba wrote: >> The saga around the misnamed DC seems over, so let's open a new thread >> ;-) >> >> In the same AD I see this: >> >> in smbstatus I see a smbd-PID for a Username "root", Group "root" >> >> But the actual

...ash sdb:schema update allowed = no time server = yes usershare path = [netlogon] path = /var/lib/samba/sysvol/secret.at/scripts read only = No acl_xattr:ignore system acls = Yes [sysvol] path = /var/lib/samba/sysvol read only = No acl_xattr:ignore system acls = Yes ---- DM: root at pre01svdeb01:~# cat /etc/samba/smb.conf # This file is managed remotely, all changes will be lost [global] workgroup = BUERO realm = secret.AT netbios name = SERVER security = ADS map to guest = Bad User username map = /etc/samba/smbusers dedicated keytab file = /etc/krb5.keytab kerberos method = secrets and...

...in smbstatus > >> > >> So I expect some wrong/outdated mapping on the DM/fileserver? > >> > >> > >> > > On a Unix domain member, this could only be in a user.map, > so check this. > > username map = /etc/samba/smbusers > > root at pre01svdeb01:/etc/samba# cat smbusers > !root = BUERO\Administrator BUERO\administrator Administrator > administrator > > I could remove that for a test ... > > > I would also get the user to log into another PC and > connect to another > > fileserver and see what happens. >...

...> path = /var/lib/samba/sysvol/secret.at/scripts > read only = No > acl_xattr:ignore system acls = Yes > > [sysvol] > path = /var/lib/samba/sysvol > read only = No > acl_xattr:ignore system acls = Yes > > > ---- > > > DM: > > > root at pre01svdeb01:~# cat /etc/samba/smb.conf > # This file is managed remotely, all changes will be lost > > [global] > workgroup = BUERO > realm = secret.AT > netbios name = SERVER > > security = ADS > map to guest = Bad User > username map = /etc/samba/smbusers > > dedicated...