similar to: msktutil with samba4 -- solved

Hi all, can anybody confirm the tool msktutil (used to extract keytab from AD and import to linux clients) works with samba4? In my environment, the command: /usr/sbin/msktutil --create --service host/drudgesk.example.org --computer-name drudgesk --service HTTP --verbose fails without a error, after a successful connection to the AD ldap: [...] -- ldap_connect: Connecting to LDAP server:

I'm trying to install samba4 with openldap, as from http://wiki.samba.org/index.php/Samba4/LDAP_Backend/OpenLDAP, I have got the yesterday realease, last git commit: commit 2024d4fb27514869d78e9bb39085f98e80413529 Date: Mon Jan 25 12:41:48 2010 +0100 My system is GNU/Debian Linux Lenny. ./configure --prefix=/opt/samba4 make sudo make install all worked ./setup/provision from the source4

Hi, Not sure of the etiquette of this, so apologies if this is frowned upon, but a couple of months ago, this[1] question was asked. I'm trying to join a Samba 4.2.2 server to a Samba 3.4.7 PDC (e.g. Think NT4, not AD), which is also our OpenLDAP principal server. I'm failing because, although my "net rpc join" command seems to succeed, and the host entry is added to the

hello Achim, yes, if you change the  userPrincipalName LDAP attributethats suffient, thats what i changed through the windows tool. greetz, Louis Op 29 aug. 2016 om 19:42 heeft Achim Gottinger via samba <samba at lists.samba.org> het volgende geschreven: Am 29.08.2016 um 17:17 schrieb L.P.H. van Belle via samba: No, That was not sufficient, i had to use the windows tool to

No, That was not sufficient, i had to use the windows tool to change it. The is the explanation from the developer of squid helper. /snap I would say they are bugs. The first “issue” is as you say more about understanding the difference between UPN and SPN and how the tools use them. The helper tries to “authenticate” squid to AD as a user with the found SPN name, so the UPN must be the same

Hai Rowland, Simply put, - UPN: An entity performing client requests to some service. Entity may be human or machine. Source : https://msdn.microsoft.com/en-us/library/windows/desktop/ms721629(v=vs.85).aspx#_security_user_principal_name_gly - SPN: An entity processing requests for a specific service, e.g., HTTP, LDAP, SSH, etc. Entity is Machine only. Source:

Just a pointer.. try with settings like : client lanman auth = yes client NTLMv2 auth = no client plaintext auth = yes i dont know the exact setting are which you need, but look in the man of smb.conf man smb.conf search for NT4, you see more settings. Greetz, Louis >-----Oorspronkelijk bericht----- >Van: dmorgan at westquad.med.harvard.edu >[mailto:samba-bounces at

no thats not it samba-tool does not set upn but msktutil does set the upn. So an option for samba-tool to set upn would be nice... Greetz Louis > Op 28 dec. 2016 om 18:38 heeft Rowland Penny via samba <samba at lists.samba.org> het volgende geschreven: > > On Wed, 28 Dec 2016 17:05:39 +0100 > "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:

I was trying to follow howto at http://wiki.samba.org/index.php/Samba4/LDAP_Backend/OpenLDAP with today's source (15 february 2010) (latest commit: 6ec6fa0ac4e71f9b14a3cbfef328d50e321b0544) ./configure --enable-developer worked as well as make && make install. Provision fails: ./setup/provision --realm=unimore.it --ldapadminpass=atmlite --ldap-backend-type=openldap

Hi all, I am having problems with using XP Pro to connect to a samba share. All I get from XP are repated dialogs asking for my username and password. My linux box has been joined to the local windows domain. I am using encrypted passwords and the security level is set to user. If I set the log level to 10 I can see that LM and NT4 MD password checks failed on the challenge returned by the XP

dear experts, is it possible to set a interdomain trust between an AD domain (samba-4.7.4) and an NT4 domain (samba-4.7.4 again)? My naive experiments have failed so far. If AD trusts NT: "samba-tool domains trust" cmd on AD controller seems to look for another AD domain: can't contact NT domain. Did I overlook some configuration switch? If NT trusts AD: I can not create a

Hi, during my tests to use Samba4 as a kdc for kerberized NFS, I found a bug in the KDC code, when generating a principal without pac (e.g. with msktutil and option --no-pac), that causes Samba4 to crash: Running the following command on one of the client machines msktutil -c --upn nfs/testa.linex.org -h testa.linex.org --computer-name testa-service-nfs --server s4-dc1.linex.org --no-pac

Hi all, while fiddling with VmWare View without being able to join windows7 client to samba4 domain, we stumbled on the following article: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1028164 which says, should we run MS Windows 2008R2 AD, we should enable the "Allow cryptography algorithms compatible with Windows NT 4.0"

> On Fri, 16 Feb 2018 12:12:32 +0100 > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > >> dear experts, >> >> I would like to setup idmap config ad. I have already the uidNumber >> attribute populated on AD. >> >> But there is something very basic wrong with my config: > > Yes, there is something wrong ;-) > See below

On 03/06/15 13:42, Francesco Malvezzi wrote: > Il 03/06/15 13:58, Rowland Penny ha scritto: >> On 03/06/15 12:42, Francesco Malvezzi wrote: >>>> Hmm, '--with-ldap' is the default, so you don't really need to give it, >>>> what OS are you compiling on ? what extra packages did you install >>>> before you compiled samba ? >>>>

Il 03/06/15 13:58, Rowland Penny ha scritto: > On 03/06/15 12:42, Francesco Malvezzi wrote: >>> Hmm, '--with-ldap' is the default, so you don't really need to give it, >>> what OS are you compiling on ? what extra packages did you install >>> before you compiled samba ? >>> >>> Rowland >> >> it is Debian GNU/Linux Wheezy,

2016-08-30 16:10 GMT+02:00 Rowland Penny via samba <samba at lists.samba.org>: > On Tue, 30 Aug 2016 15:58:13 +0200 > mathias dufresne via samba <samba at lists.samba.org> wrote: > > > And reading last mails comforts me in believing the filter used by > > client side to retrieve user is not correct, that filter should use > > SPN then you won't need to

Il 16/02/18 12:58, Rowland Penny via samba ha scritto: > On Fri, 16 Feb 2018 12:39:37 +0100 > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > [...] >> >> should I remove tout-court this part? > > Not sure I understand that, but it sounds like you are asking if you > should remove the lines, if so, the answer is yes. You understood correctly.

The config looks ok, thats great. :-) Its not needed to stop samba running : net cache flush If you run: net cache list and have a look, then flush it and look again. You see its empty. If you need to copy the idmap than it is needed to stop samba. Can you show me an output of. dpkg -l | egrep "tevent|tdb|ldb|talloc|cmocka" Im running latest versions of these. Own compile or

Depending on the OS. Below is tested/in production since samba 4.9.x and debian stretch Currently running buster with samba 4.12.5 with samba and AD-Backends. All users have UID assigned, and "Domain Users". This is really easy on any setup with systemd systems with samba and winbind. I'll show how easy this is for any debian/ubuntu related system but using systemd, maybe you