similar to: Multiple Winbindd Instances and Disjoint AD domains

Hi , I need to use ntlm_auth across two different AD domains and their is no trust between the 2 domains. I followed the post http://samba-multiple- domains.blogspot.co.uk/2010/03/how-to-join-one-linux-box-to-two.html <https://deref-mail.com/mail/client/44YIgEylY9w/dereferrer/?redirectUrl=http%3A%2F%2Fsamba-multiple-domains.blogspot.co.uk%2F2010%2F03%2Fhow-to-join-one-linux-box-to-two.html>

Hi , Any suggestions on the config I really need to get this working I am on fedora with samba 4.45 ? I know their is a probable way of getting this to work but not seen a complete example anywhere.. I have seen a commercial product which runs centos use samba and Kerberos across multiple disjoint domains. Your help would really appreciated. Many thanks Arnab On 21 May 2017 9:34 am,

Hi Rowland, The only thing I'm using is winbindd the smbd and nmbd daemons are disabled. However I have now found the bottleneck is because freeradius is calling the ntlm_auth binary and effectively forking out. The guys at freeradius wrote a direct client libwbclient however their is no way of specifying the winbind privileged path using that method as it's hardcoded during compile

Hi, I just want to migrate my Samba PDC (with LDAP backend) to a Active Directory. On the migration page (https://wiki.samba.org/index.php/Migrating_a_Samba_NT4_Domain_to_Samba_AD_(Classic_Upgrade[https://deref-web-02.de/mail/client/IywWde3X0uo/dereferrer/?redirectUrl=https%3A%2F%2Fwiki.samba.org%2Findex.php%2FMigrating_a_Samba_NT4_Domain_to_Samba_AD_%28Classic_Upgrade])) is a section

Anyone on how to get libwbclient some kind of runtime parameter from smb conf? On 3 Sep 2017 23:22, "Arnab Roy" <arniekol at gmail.com> wrote: > > > Wouldn't it be nice if the end user had a choice . Why would it be unsafe > considering all the info is in smb.conf and it just needs to read like all > other samba processes like smbd or nmbd? > > The

Hello Everyone, Thanks for your inputs I have followed whats here https://wiki.freeradius. org/guide/Active-Directory-direct-via-winbind . Apart from the different location for the directories. I have added the recommended options in samba. However I cannot see why this would make a difference to performance. The guide for setting up a samba domain member seems more to be aimed at the whole

Am 23.11.2017 um 23:16 schrieb Arnab Roy: > No dice :( removed as suggested updated unit file looks like this "Type=notify" can not work until systemd-support was successful built which does not seem to be the case looking at the starting posts! > [Unit] > Description=KKonnect KHIPU-NETWORKS Service > After=syslog.target network.target > > [Service] >

Thanks for this, looks like you have nailed it that was the root cause of the problem! Any ideas what is required to build with systemd support, I have installed every systemd-devel package I could find ..? On Thu, Nov 23, 2017 at 10:26 PM, Reindl Harald via samba < samba at lists.samba.org> wrote: > > > Am 23.11.2017 um 23:16 schrieb Arnab Roy: > >> No dice :( removed

Am 23.11.2017 um 23:03 schrieb Rowland Penny via samba: > On Thu, 23 Nov 2017 21:46:17 +0000 > Arnab Roy <arniekol at gmail.com> wrote: > >> The systemd unit file looks like as follows: >> >> [Unit] >> Description=Winbindd Service >> After=syslog.target network.target >> >> [Service] >>

Hi Rowland/Andrew, Apologies I think I overlooked something here, its just previously winbindd wasn't complaining and now it is, on closer look it looks like winbindd socket directory is still valid phew!! please dont take this away or I will be dead in the water :( after a little careful attention I was missing ntlm auth = mschapv2-and-ntlmv2-only which is why I was upgrading samba in the

The systemd unit file looks like as follows: [Unit] Description=Winbindd Service After=syslog.target network.target [Service] Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba Type=notify NotifyAccess=all PIDFile=/var/run/samba/ ExecStart=/usr/local/samba/sbin/winbindd -D ExecReload=/usr/bin/kill -HUP $MAINPID LimitCORE=infinity [Install] @Rowland I am not blaming samba at all, certainly is

hai,   Please keep it mailing to the list, this way is shows up of others also. A workaround for disabling SMBv1, you can make your server less secure but thats not what i would do. Setting these to enable NTLM v1 again. lanman auth = yes ntlm auth = yes raw NTLMv2 auth = yes I think also this is more a question for the free raduis list, but i would to for a ldap(s) setup. just dont mixup

Yes I have /var/run/samba/ , I spotted the error with not having an actual filename while I was posting this message. Does the pid file need to be in the same path as samba ? On Thu, Nov 23, 2017 at 10:04 PM, Sonic <sonicsmith at gmail.com> wrote: > On Thu, Nov 23, 2017 at 4:46 PM, Arnab Roy <arniekol at gmail.com> wrote: > > > > PIDFile=/var/run/samba/ > > >

Hi Rowland, No I am running samba as a member, purely using it for ntlm_auth for freeradius. If i run it manually i.e. /usr/local/samba/sbin/winbindd -D it starts up and stays up no issues. Yes selinx is disabled sestatus SELinux status: disabled Any pointers...? Many Thanks Arnab On Thu, Nov 23, 2017 at 8:34 PM, Rowland Penny via samba < samba at lists.samba.org> wrote:

No dice :( removed as suggested updated unit file looks like this [Unit] Description=KKonnect KHIPU-NETWORKS Service After=syslog.target network.target [Service] Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba Type=notify NotifyAccess=all ExecStart=/usr/local/samba/sbin/winbindd ExecReload=/usr/bin/kill -HUP $MAINPID LimitCORE=infinity [Install] WantedBy=multi-user.target I had lifted the

Hi , I just need some clarification ; We currently use ntlm_auth + winbind for AD auth on Freeradius, will disabling SMBv1 break authentication for ntlm_auth + Freeradius ? Many Thanks Arnab

Hi , I have just upgraded samba from 4.5.10 to 4.7.3 and my NTLM auth is completely broken on starting winbind its complaining about Unknown parameter encountered: "winbindd privileged socket directory" Ignoring unknown parameter "winbindd privileged socket directory" In our case it needs to be specified on startup via smb.conf and not at compile time. This was working fine

Hi All, I am using winbind and ntlm auth in Freeradius. At the moment that seems to be a major bottleneck. It seems like the ntlm_auth execution is taking a while , what all options can improve this . For starters adding TCP_NODELAY in smb.conf seems to have helped a little. Many Thanks

Hi Louis, Yes of course that would help duh! apologies the OS is fedora 25 Samba version samba-4.5.10-0.fc25.x86_64 smb.conf server string = Samba Server MY-NETWORKS hosts allow = 127. log file = /var/log/samba/log-MY-NETWORKS.%m log level = 0 max log size = 50 security = ads encrypt passwords = yes passdb backend = tdbsam load printers = no cups options = raw printcap name = /dev/null allow