similar to: Samba4: "MYDOM\Administrator" quite useless on a member server?

Hello list, I'm stuck since 2 days and I have no clue how to troubleshoot and solve that problem. Any help really really appreciated. Scenario: ========= I am using Samba 4.1.12/sernet on DC1 (172.19.100.1) and DC2 (172.19.100.2) with default [netlogon] and [sysvol] share only. I installed an additional samba4 server with fileserving role which is called MEMBERSRV1 (172.19.100.3), which is

Hi, For several linux server on our network we want to allow the AD domain group called "MYDOM\Domain Admins" to login through ssh with their AD credentials. Our DC1 and DC2 are running on Debian 64bit using Samba 4.1.12/Sernet. I'm kinda confused, what exactly I need therefore. Do I need to setup a PAM_authentication as explained on that tutorial here?

Hello, I am running Samba 4.1.12/Sernet on Debian Wheezy 64bit and I am about to setup my member server. The DC was provisioned with rfc2307 and extended attributes. I have assigned to the domain group called "Domain Users" the GID=10000. My member server was prepared with ACL+user_xattr and winbind support. My /etc/nsswitch.conf is using "winbind" for passwd+group, and

Hello list, I am using the Microsoft ADUC (Active Directory Users & Computers) tool from the RSAT suite for creating and modifying my domain users. I am aware of the "copy" functionality which really is very nice to use. Unfortunately I am missing two important actions during the user-creation process which I try to describe: 1.) When I use the template feauture (by using the

Dear Davor, would you please stop abusing this thread? The topic and initially posting is talking of something quite different than Rowland used in his first answer and to what you have replied. Thanks for your understanding. And no, uid and gid is not the same (uid!=gid) Regards, Mirco

Oh! I think I did find the error now :-) If I understand "NOW" correctly, I have also to assign a UID to EACH of my AD users in ADUC tool in the [UNIX Attribute] tab, is that correct? I just tried out. In ADUC tool I did choose "testuser3", and on the [UNIX Attribute] tab I activated the NIS domain so it reflects to "MYDOM". Then by default there was UID=10000, I

> Comment from Rowland: > [...]an AD user without a uidNumber is merely a windows user Hi Rowland, just for my understanding, I have a question. If a domain user in my samba4 AD domain does not have been assigned with a "uid" on the [UNIX Attribute] tab of my ADUC tool, that user in general *cannot* access any of the shares of that particular member server? Is that correct? My

> You are very nearly correct, your smb.conf on the member server has > these lines: > > idmap config MYDOM:backend = ad > idmap config MYDOM:schema_mode = rfc2307 > idmap config MYDOM:range = 500-40000 > > The first line makes winbind use the ad backend, the second ensures that > the rfc2307 attributes are used and the third line sets the range of > users to

Hi, I have a samba 4.7 DC (Red Hat) and a Solaris 10 Member (also 4.7.0). I started winbindd and can get all users in my domain via "getent passwd" except MYDOM\Administrator. I can get it via wbinfo however: # wbinfo -n "MYDOM\Administrator" S-1-5-21-.......-500 SID_USER (1) In the winbind log with log level = 10, when I do getent passwd "MYDOM\Administrator I always

Hello list, using AD with rfc2307 provisioned and NIS extensions are available. In ADUC tool I choose the group "Domain Admins" and click on the [UNIX Attributes] tab. I activate it for my domain and choose the GID=500. When I execute on my member server "net cache flush && getent group 500" I get the result domain admins:x:500:johndoe,name1,name2 So far so good,

Hi all, I am referring to the official wiki here: https://wiki.samba.org/index.php/Setting_up_a_home_share#Setting_up_the_share_and_filesystem_permissions I was struggling around for many hours before I have found out what caused my issue. Well, I have created the [home] share exactly as epxlained on the How-To, in detail: I am creating on the linux prompt at the member server the directory with

Hi list, I am experimenting with two member servers (both samba4). I am using following configuration: membersrv:/etc/samba/smb.conf: ========================== [...] username map = /etc/samba/smbmap [...] membersrv:/etc/samba/smbmap: ========================= !root = MYDOM\johndoe MYDOM\foo MYDOM\bar MYDOM\Administrator Administrator So the domain users from my AD called "John Doe",

Hey all, I decided to use the default ranges in the smb.conf of my member server, so I changed my smb.conf and it looks like that: ================================================== [global] netbios name = MEMBERSRV workgroup = MYDOM security = ADS realm = MYDOM.EXAMPLE.COM encrypt passwords = yes idmap config MYDOM:backend = ad idmap

I have made some changes to try and get the PDC working and now I am down to one thing where I believe the problem lies. All such documents on the setup show that the addition of users to the PDC should be added to passwd as well as LDAP but for my system that is not the case. I am running the listed software: Fedora Core 4 OpenLDAP 2.2.23 Samba 3.0.14a This is what currently happens when I

Hello list, I am not sure if this is a bug or known already but I will describe it. I have two domain controllers running on 4.1.12/sernet which are linked together. I am using unison for bidirectional sync for the sysvol directory as described on samba's wiki, although in my opinion the problem I will describe in the following has nothing to do with the sync process. The sync occurs every

Dear Rowland, our windows admin assured me that they have set uidNumber and gidNumber in the range. I have requested screenshots for confirmation. Now we are one step further: "getent passwd | grep mdecker" now lists the AD account. mdecker:*:13667:7142:Decker, Martin:/home/MYDOM/mdecker:/bin/false With "getent passwd mdecker" however, it shows

Thanks Rowland and Louis, after changing from ad to rid, i get all users listed with "getent passwd", not just the ones with uidNumber - which is good. But "getent passwd MYDOM\\mdecker" still does not resolve. In addition, no groups are listed with "getent group". Looking at winbindd debug, it seems that after trying getgrsid on the very first group "Exchange

I have a problem that is now becoming very annoying. Namely I have a Centos 7 member server running Sernet Samba 4.7.4 for which everything seems to work except gdm or ftp logins. On the linux client it seems winbindd is set up correctly. For example (the data shown below has been sanitized): > getent passwd testuser2:*:3001108:3000513::/home/testuser1:/bin/bash

Does mdecker exist in AD ? => Yes root at solaris1:~# getent passwd "MYDOM.ADS\\mdecker" mdecker:*:13767:613::/home/mdecker:/bin/bash winbind log: getpwnam MYDOM.ADS\mdecker wb_request_done[24254:GETPWNAM]: NT_STATUS_OK Does 'getent passwd mdecker' work ? => No getent passwd mdecker getpwnam mdecker winbindd_getpwnam: My domain -- rejecting getpwnam() for

Thank you for your feedback. I have changed the parameters, but still no success. winbind use default domain = yes idmap config * : range = 1000000-1999999 idmap config MYDOM : range = 100-999999 Regards, Martin 2017-08-18 15:00 GMT+02:00 Rowland Penny via samba <samba at lists.samba.org>: > > See inline comments: > > On Fri, 18 Aug 2017 14:40:54 +0200 >