similar to: Using GPO to mount shares on Linux

On Wed, 11 Oct 2017 11:51:02 +0200 "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > > > > -----Oorspronkelijk bericht----- > > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > > Rowland Penny via samba > > Verzonden: woensdag 11 oktober 2017 11:39 > > Aan: samba at lists.samba.org > > Onderwerp: Re: [Samba]

Hello, I'm using a Samba 4 as domain server and I've a lot of Windows computers that mounts shared drives on another server through GPO applied by user groups. Is there any way to do something similar on a Linux box, or I've to use a local script? Thanks! -- _________________________________________ Daniel Carrasco Marín Ingeniería para la Innovación i2TIC, S.L.

On Wed, 11 Oct 2017 11:00:59 +0200 Michael Wandel <m.wandel at t-online.de> wrote: > On 11.10.2017 10:37, Rowland Penny via samba wrote: > > On Wed, 11 Oct 2017 10:13:35 +0200 > > "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > > > >> If you mean, Linux <=> Linux , use automounting, of dedicated > >> mounts.

Thank you for that, i did have a good look at that one. And i use Debian 9, if you test what i posted below in the thread, you will see NFSv4 works fine. Below is missing one more thing, the "allow to delegate (kerberos only) " on the computer object in the AD, should be enabled. And yes, i've see bugchecks also but only on my debian .. Lenny.. Stt.. ;-) .. Its my last lenny

On Wed, 11 Oct 2017 12:03:38 +0200 Michael Wandel <m.wandel at t-online.de> wrote: > On 11.10.2017 11:38, Rowland Penny via samba wrote: > > On Wed, 11 Oct 2017 11:00:59 +0200 > > Michael Wandel <m.wandel at t-online.de> wrote: > > > >> On 11.10.2017 10:37, Rowland Penny via samba wrote: > >>> On Wed, 11 Oct 2017 10:13:35 +0200 >

I was used to integrate some linux client in my samba network mounting homes with 'unix extensions = yes', and works as expected, at least with some old lubuntu derivatives. Client side i use 'pam_mount'. Now i'm working on a ubuntu mate derivative, and i've not found a way to start the session properly in CIFS. If i create a plain local home (pam_mkhome), session start as

Sorry for the delayed response, Louis, I'm not sure how to tell about having "cifs/UPN" - Please advise. I was able to mount with sec=krb5 after the user is logged in but that does not help getting "home" mounted during the login. But here is where I am now: I have been able to pam_mount "home" during the login but could not get the ACLs during the mount

I think MJ is using samba with AD backend and Rowland RID. Rowland, try AD backend if your using rid atm. Gr. Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens mj via samba > Verzonden: woensdag 11 oktober 2017 13:25 > Aan: samba at lists.samba.org > Onderwerp: Re: [Samba] Using GPO to mount shares on Linux > > >

THANK YOU FOR YOUR REPLY THE RESULT : KVNO Principal ---- -------------------------------------------------------------------------- 1 HOST/samba4 at FSS.LAN (des-cbc-crc) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) 1 SAMBA4$@FSS.LAN (des-cbc-crc) 1 HOST/samba4 at FSS.LAN (des-cbc-md5) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) 1 SAMBA4$@FSS.LAN (des-cbc-md5) 1

Rowland, How would I find this info? Check if 'Rachel Jones' has a 'gecos' attribute in AD. You seem to be being denied access to '.Xauthority', was it created on another machine ? No However, I am sure '-13' usually means incorrect password. I am sure the password is correct, the /mnt/home/rachel folder is created but the user files are not created because

No, no idee, but really, upgrade to samba, best option, in my opinion. If thats not possible, it happens.. A timeout option can be set in krb5.conf for example : kdc_timeout = 5000 You have these for krb5.conf to try out also. the complete list. des-hmac-sha1 DES with HMAC/sha1 (weak) aes256-cts-hmac-sha1-96 aes256-cts AES-256 CTS mode with 96-bit SHA-1 HMAC

Ok, Your keytab looks ok now. oldsamba.dom.corp is an alias for fs-a.oldsamba.dom.corp. fs-a.dom.corp has address 10.0.0.2 i would have expected here. oldsamba.dom.corp is an alias for fs-a.dom.corp. fs-a.dom.corp has address 10.0.0.2 Or was that a typo? I assuming a typo.. About your setup from the script outpout. Change this one. /etc/hosts 10.0.0.2 fs-a.dom.corp fs-a oldsamba #

Ok, you did to much as far i can tell. You want to see this: i'll show my output, then i is better to see what i mean. this is where you start with. klist -ke |sort ( default member ) ---- -------------------------------------------------------------------------- 3 host/HOSTNAME1 at REALM.DOMAIN.TLD (aes128-cts-hmac-sha1-96) 3 host/HOSTNAME1 at REALM.DOMAIN.TLD

Hai, You may need to add the the following in krb5.conf [libdefaults] allow_weak_crypto = true ; for Windows 2003 ; default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5 ; default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5 ; permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5 ; for Windows 2008 with AES default_tgs_enctypes = aes128-cts-hmac-sha1-96

Can someone help me with samba4 with internal dns. Something strange showing in log.smbd when computers are doing gpupdate (becouse of this error computers cant apply gpo) log.smbd on DC1: [2017/01/13 13:49:16.075361, 1] ../source4/auth/gensec/gensec_gssapi.c:619(gensec_gssapi_update) GSS server Update(krb5)(1) Update failed: Miscellaneous failure (see text): Failed to find

Hai,   I noticed something strange in the keytab file on my member server. This is a followup of : [Samba] winbind question. (challenge/response password authentication) Samba 4.5.3 on Debian Jessie.   Leave the domain. net ads leave -k Deleted account for 'PROXY2' in realm 'REALM'   I checked in windows, and the computer is gone in the “Computer” ou.   Removed the

I have a Windows 2008 domain (one Win 2008 DC, one Win 2012 R2 DC.) I am trying to join a Solaris 11 machine to the domain for both Samba and other services. For "unix" logins and ssh, Solaris 11 is configured to use LDAP for user and group lookup and kerberos for authentication. The "kclient -T ms_ad" command joins the Solaris machine to the AD domain. It even

am getting this error in smbd.log when user try to open Share from Windows box: gss_accept_sec_context failed with [ Miscellaneous failure (see text): Failed to find cifs/mymember.my.domain.tld at MY.DOMAIN.TLD(kvno 58) in keytab MEMORY:cifs_srv_keytab (aes256-cts-hmac-sha1-96)] SPNEGO(gse_krb5) NEG_TOKEN_INIT failed: NT_STATUS_LOGON_FAILURE I have made a research here in google and here in mail

Ok .. maybe if seen something, dont know for sure, so Rowland, what do you think about below. Post the result of : klist -e -k /etc/krb5.keytab i see in your logs. AS key obtained for encrypted timestamp: aes256-cts/000A In my setup, i dont have aes256-cts available in my keytab, do you? You can try adding this, to krb5.conf. ; for Windows 2003 ; default_tgs_enctypes = rc4-hmac

On Fri, 3 Feb 2017 16:00:45 +0100 Łukasz Sellmann via samba <samba at lists.samba.org> wrote: > any ideas ? please i got stuck and have no ideas what else i can do > > > pozdrawiam > > Łukasz Sellmann > > 2017-02-01 17:50 GMT+01:00 Łukasz Sellmann <bravo.galaxy at gmail.com>: > > > Can someone help me with samba4 with internal dns. Something