similar to: CUPS and Samba4

I run a Samba4 AD and joined a Synology NAS running Samba 3.6.9. I can access the shares using smbclient or mount -t cifs from all Linux machines (usually running Samba 3.6.6 clients). I can mount the shares from WinXP home and Win7 home. However, with a Win7 Ultimate machine joined to the AD most of the time it doesn't work. I can logon to the machine with my AD credentials, but I am

On Tue, Dec 30, 2014 at 5:04 PM, Lars Hanke <debian at lhanke.de> wrote: > Hi, > > I'm going to migrate my old CUPS server to a new setup. It shall provide the > printing backend for Samba4 and should integrate as seamless as possible. > Both Windows and Linux users should not require additional passwords, but > should be authenticated by their Kerberos tickets. There

Greg, > Unfortunately, these attributes do not exist as standard, so you would > either have to add a user with ADUC or manually add them yourselves with > ldbedit. As standard on windows, they both start at '10000', though you > can set them to whatever you require, just make sure that they do not > interfere with any local Unix users. If you like to manage Unix users

I created a demo share on my AD DC. After obtaining a copy of Win7 Ultimate I could now verify that the share has all rights granted to anyone (don't know how Windoze call "Jeder" in English). I can read and write the Share using AD\Administrator. AD\StandardUser can mount the share and read, what the Administrator put there. But he cannot create or modify files.

It is actually rather easy to set the attributes via powershell, and that is probably the best way to add them in a Server 2012 R2 environment. I wrote a powershell script to do this automatically for users and groups in an entire domain that should be pretty generic to be reused. It also mirrors the logic used in automatic winbind UID/GID generation to be able to coexist in an environment where

I set-up a basic AD DC using samba 4.1.9 successfully. I joined my NAS to the domain, i.e. I saw no errors and see the users and groups of my AD listed in the GUI of the NAS. When I try to connect to a share of the NAS the following happens: mgr at ws1:~$ smbclient -U 'AD\mgr' //nas/Test Enter AD\mgr's password: Domain=[AD] OS=[Unix] Server=[Samba 3.6.9] tree connect failed:

Ok, it's here: http://pastebin.com/JEnr5wUq The id_offset is that value because i initially didn't use rfc2307 attributes, but instead On 29 January 2015 at 23:27, Tim <lists at kiuni.de> wrote: > @Hans-Kristian: > I'd like to see it. How did you automate this? > > @Andrew: > In another thread I suggested to set the rfc2307 info automatically when a > domain

This topic has been on the list two years ago, already, but apparently to no conclusion. I'm trying to join a Debian Wheezy machine (Samba 3.6.6) to my freshly made backports AD (Samba 4.1.7). This is what I see: root at samba4:/# net ads join -U Administrator at AD.MICROSULT.DE Enter Administrator at AD.MICROSULT.DE's password: Using short domain name -- AD Joined 'SAMBA4' to

On 29/01/15 22:56, Hans-Kristian Bakke wrote: > Something went wrong and the message got sent before it was finished. > Here is the complete one: > > Ok, it's here: http://pastebin.com/JEnr5wUq > > The id_offset is that value because i initially didn't use rfc2307 > attributes, but instead had > > idmap config EXAMPLE : range = 300000-499999 > > in

But if they take it away how to set them in future? Am 29. Januar 2015 19:50:22 MEZ, schrieb Andrew Bartlett <abartlet at samba.org>: >On Wed, 2015-01-28 at 17:22 +0100, Tim wrote: >> I got the chance to test samba 4 with windows 2012 R2 domain >> controller on its highest functional level. >> >> Possibly it's important to know that M$ says that the

Well, seems like I hit every mudhole that could be on the way ... root at samba4:/# getent passwd | grep mgr mgr:*:10000:10000:Lars LH. Hanke:/home/AD/mgr:/bin/bash root at samba4:/# ldapsearch -LLL -D "CN=Administrator,CN=Users,DC=ad,DC=microsult,DC=de" -x -W '(uid=mgr)' uid uidNumber gidNumber sAMAccountName name gecos Enter LDAP Password: dn: CN=Lars LH.

Hi Marc, >> The cause is that the password change didn' reach both AD DCs, but only >> one. The other one still had the old value as could be seen by >> samba-tool ldapcmp. Restarting the DCs and waiting for a couple of >> seconds brings them back to sync and Windows logons work as they used to. >> Any idea, what I should do next time to obtain valuable output

Il 2014-12-31 16:29 Dr. Lars Hanke ha scritto: >>> OK, you can get winbind to update your keytab, you need to alter your >>> smb.conf slightly. You need to change 'kerberos method = secrets >>> only' >>> to either 'kerberos method = secrets and keytab' or 'kerberos method >>> = >>> system keytab' and add the line

During my test phase I used to manage POSIX attributes in my AD using ldap-tools with -Y GSSAPI after kinit Administrator. Now this became impossible unless I logged in as Administrator, since the principal is tied to the user account - be it only for NFS4. ;) Administrator so far is not even a POSIX user. My first idea was to join my POSIX user to some group, which is allowed to modify user

My tool is growing fast and it takes me to the finishing line for setting up my new user database. But nw I came across another strange issue: I'd like to change the primaryGroupID. It is currently set to 513, which simply does not exist. I wanted to set to 100, which exists and actually the user is a member of this group, but then I get the following exception: ldap.UNWILLING_TO_PERFORM:

Is it a bug or a feature? While --gid maps to the gidNumber OID of posixAccount, --uid maps to uid, which is supposed to contain the textual user name. The numerical uid should be in uidNumber, but there doesn't seem to be an option to set this. Of course the aim is to migrate an existing OpenLDAP, Kerberos, Samba3 infrastructure to Samba4 AD. Thanks for your help, - lars.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 02.02.2015 um 13:30 schrieb Sven Schwedas: > On 2015-02-02 12:56, Lars Hanke wrote: >> I currently plan to move my storage to Gluster. One of the >> anticipated advantages is to have Gluster replicate data among >> physical nodes, i.e. if one node dies the file service can live >> on. >> >> AD for

I have a running Bind9 infrastructure and intend to have Samba its specialities, but leave the bulk to Bind. My idea is to configure a slave zone with Samba as master in my top level Bind. However, this would need Samba to allow-forward. Is there any way to configure the internal DNS like that? Or do I have to run a Bind instance on the samba machine for that purpose? Thanks for your help, -

Any ideas how to custom format the usernames mapped by winbind? Background: I successfully set up an AD DC and several members, including a file server, which can serve both samba and NFS4. So far so good. However my prime goal is to use my Synology NAS and share data between Linux and Windows. The NAS joined the AD and lists its users and groups as AD\uid and AD\gid. The standard setup of

I joined a machine. net ads testjoin says OK. The join exported a keytab, which among others contains MACHINE$@REALM. However, trying k5start I get "Client not found in Kerberos database". Also kinit -t /etc/krb5.keytab MACHINE\$@REALM claims that the client was not found. But then, how did it come into the keytab? Is there a tool to list the principals in AD? Kind regards, -