similar to: Windows pre-requisites for login with winbind?

Also, I see the following repeated in syslog:- ==> syslog <== Aug 21 15:25:41 hostname01 winbindd[691]: [2017/08/21 15:25:41.438959, 0] ../source3/libsmb/cliconnect.c:1895(cli_session_setup_spnego_send) Aug 21 15:25:41 hostname01 winbindd[691]: Kinit for HOSTNAME01$@DOMAIN.LOCAL to access cifs/LOCAL_AD02.domain.local at DOMAIN.LOCAL failed: Cannot contact any KDC for requested realm

Hi, Can anyone explain the following to me? Two zpool devices points at the same data, I was installing osol 2008.11 in xVM when I saw that there already was a partition on the installation disk. An old dataset that I deleted since i gave it a slightly different name than I intended is not removed under /dev. I should not have used that name, but two device links should perhaps not

OK, obviously I am slightly sanitising the output here, but I'm preserving the case, and just replacing local names with generic ones as I did for the config. # more /etc/hostname hostname01 # more /etc/hosts 127.0.0.1 localhost 127.0.1.1 hostname01 # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix

August 21, 2017 5:34 PM, "Rowland Penny via samba" <samba at lists.samba.org> wrote: > On Mon, 21 Aug 2017 15:37:03 +0000 > "A. James Lewis" <james at fsck.co.uk> wrote: > >> OK, obviously I am slightly sanitising the output here, but I'm >> preserving the case, and just replacing local names with generic ones >> as I did for the

Hi! Indeed!, this sounds like good advice... there are certainly bugs, I had to get the 7.04.5 package from "proposed" to get resolve a PAM library issue!... although I suppose that's a packaging problem. What is the best way to get an updated Samba package here, I'm trying to make this system reproduceable, I have a single script that builds the entire container, and sets up

I'm slightly confused, you appear to have trimmed down the config, but not changed anything.... would you think this would affect the issue where long standing users are able to log in, but new users are not... even after a couple of weeks they are not able to log in via "winbind", although they can authenticate via Kerberos, and obviously log in to Windows desktops. James August

I think we're getting confused with the kerberos issue created by my errant DNS server... with the original problem, all the commands I have sent showing an issue with kerberos were working originally, with the config which explicitly defined "kdc =", and are now working again, with your new config, now that I have fixed the DNS... but the original problem is that I have a very small

Rowland, I'm following this thread because I'm trying to use Linux member server (Debian 9) and use Windows AD users in Linux (filesystem etc). It seems I have working Kerberos and to a degree, Winbind too, because both wbinfo -u wbinfo -g give me valid and complete results. However I'm stuck with NIS. First I attempted to use AD idmap with settings (smb.conf) idmap config *

Hi, Rowland You were right, it was the Domain Users issue. After setting the gidnumber to a number inside range, users are there. Thank You. And as of change from AD to RIS, the 'net cache flush' is not enough. For the record, I must have rebooted the server. Probably the records have been stored in some NIS cache or so too, that I don't know how to flush on-the-fly. After the

You did not look right it should be there. https://packages.ubuntu.com/zesty/libpam-krb5 https://packages.ubuntu.com/artful/libpam-krb5 Check this folder to see if "winbind unix krb5" is there. ls /usr/share/pam-configs And run pam-auth-update --force to update the files. ! Note, krb5 has by default set : minium_uid=1000 Greetz, Louis > -----Oorspronkelijk bericht-----

Well, network connectivity to the other DC would probably also be required... and I don't have that currently... so there's the first hurdle... but thanks for confirming that there's no other configuration required. I'm slightly surprised that the smb.conf does not require the full realm name like "DOMAIN2.LOCAL" somewhere in there. James August 24, 2017 12:14 PM,

I have a Solaris 10 U5 system massively patched so that it supports ZFS pool version 15 (similar to U8, kernel Generic_141445-09), live upgrade components have been updated to Solaris 10 U8 versions from the DVD, and GRUB has been updated to support redundant menus across the UFS boot environments. I have studied the Solaris 10 Live Upgrade manual (821-0438) and am unable to find any

Hello everyone, I've been reading through the articles on the website trying to understand what's needed to use the libvirt Java bindings with a QEMU hypervisor, but still have some uncertainties/questions: 1. It is my understanding that libvirtd has to be running on the machine hosting the hypervisor. Correct? 2. For libvirtd to communicate with QEMU, QEMU has to be installed on the

Please, could the documentation be enhanced so that it mentions this prerequisite? (Domain Users group must have gidnumber attribute set, and it must be inside idmap range)? Dňa 25.08.2017 o 18:37 tuharsky--- via samba napísal(a): > Hi, Rowland > > You were right, it was the Domain Users issue. After setting the > gidnumber to a number inside range, users are there. > >

OK, that is the answer, but can you explain what an "RID" is from a Windows perspective?... I had thought that the mapping was not a 1-1, and it appears it is, once the idmap range is taken into account. idmap config DOMAIN:range = 5000-300000 My UID's appear to be offset by 5000 from the RID... but I'd love to know exactly what RID is. Many thanks tho, I probably should have

I'm inclined to agree with you regarding resolveconf, but I don't think that's the issue here, clearly it was able to get the name and IP of the AD server.... and connect to it. The error from kinit had the hostname of one of the AD servers in it, that name is not in the config, and that address was reachable... so I can't think that it's DNS. What is worrying me is if this

On Thu, 24 Aug 2017 12:26:11 +0000 "A. James Lewis" <james at fsck.co.uk> wrote: > Well, network connectivity to the other DC would probably also be > required... and I don't have that currently... so there's the first > hurdle... but thanks for confirming that there's no other > configuration required. > > I'm slightly surprised that the

Indeed!... you are correct... this does appear to be the kerberos issue uncovered by Rowlands pointing out that I should not need to be manually defining "kdc =", in my krb5.conf.... so with that resolved, I'm hoping we can also find the cause of my original problem. Incidentally, this was my solution to upgrading Samba on my 17.04 test server, I think moving to 17.10 will

On Fri, 25 Aug 2017 16:03:08 +0200 "Mgr. Peter Tuharsky via samba" <samba at lists.samba.org> wrote: > Rowland, > > > I'm following this thread because I'm trying to use Linux member > server (Debian 9) and use Windows AD users in Linux (filesystem etc). > > It seems I have working Kerberos and to a degree, Winbind too, > because both > >

Yes indeed.... I know a lot about the Linux side, but Windows is a bit of a mystery to me... and I have to confess to not knowing exactly how nss links various directory services into the system.... hence my comment earlier with "Password file entry" in quotes... I know it's not in the password file, and is amalgamated into the password "map", via nss, but I'm not sure