similar to: Running off pre-created keytabs

Am 2019-01-10 um 17:02 schrieb Rowland Penny via samba: > On Thu, 10 Jan 2019 16:23:06 +0100 > "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > >> Hi folks, >> >> we'd like to provision new Samba servers (file sharing only) with the >> system keytab. It will precreated by some other process (msktutil) >> because we

> On 11 Jan 2019, at 10:33, Rowland Penny via samba <samba at lists.samba.org> wrote: > > On Fri, 11 Jan 2019 09:39:35 +0100 > "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > >> Am 2019-01-10 um 17:02 schrieb Rowland Penny via samba: >>> On Thu, 10 Jan 2019 16:23:06 +0100 >>> "Osipov, Michael via samba"

> On 11 Jan 2019, at 12:34, Rowland Penny via samba <samba at lists.samba.org> wrote: > > On Fri, 11 Jan 2019 12:03:30 +0100 > "Remy Zandwijk \(Samba\) via samba" <samba at lists.samba.org> wrote: > >> >> >>> On 11 Jan 2019, at 10:33, Rowland Penny via samba >>> <samba at lists.samba.org> wrote: >>> >>>

> -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Remy > Zandwijk (Samba) via samba > Verzonden: vrijdag 11 januari 2019 14:38 > Aan: Remy Zandwijk (Samba) via samba > Onderwerp: Re: [Samba] Running off pre-created keytabs > > > > > On 11 Jan 2019, at 14:25, Rowland Penny via samba > <samba at

On Fri, 11 Jan 2019 09:39:35 +0100 "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > Am 2019-01-10 um 17:02 schrieb Rowland Penny via samba: > > On Thu, 10 Jan 2019 16:23:06 +0100 > > "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > > > >> Hi folks, > >> > >> we'd like to provision

On Fri, 11 Jan 2019 12:03:30 +0100 "Remy Zandwijk \(Samba\) via samba" <samba at lists.samba.org> wrote: > > > > On 11 Jan 2019, at 10:33, Rowland Penny via samba > > <samba at lists.samba.org> wrote: > > > > On Fri, 11 Jan 2019 09:39:35 +0100 > > "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > >

Hai, And you are not looking for this? https://wiki.samba.org/index.php/Delegation/Joining_Machines_to_a_Domain Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Osipov, Michael via samba > Verzonden: donderdag 10 januari 2019 16:23 > Aan: samba at lists.samba.org > Onderwerp: [Samba] Running off pre-created

On Fri, 11 Jan 2019 13:14:16 +0100 "Remy Zandwijk \(Samba\) via samba" <samba at lists.samba.org> wrote: > > > > On 11 Jan 2019, at 12:34, Rowland Penny via samba > > <samba at lists.samba.org> wrote: > > > > On Fri, 11 Jan 2019 12:03:30 +0100 > > "Remy Zandwijk \(Samba\) via samba" <samba at lists.samba.org> wrote: >

> On 11 Jan 2019, at 14:48, L.P.H. van Belle via samba <samba at lists.samba.org> wrote: > > > >> -----Oorspronkelijk bericht----- >> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Remy >> Zandwijk (Samba) via samba >> Verzonden: vrijdag 11 januari 2019 14:38 >> Aan: Remy Zandwijk (Samba) via samba >> Onderwerp: Re: [Samba]

On Thu, 10 Jan 2019 16:23:06 +0100 "Osipov, Michael via samba" <samba at lists.samba.org> wrote: > Hi folks, > > we'd like to provision new Samba servers (file sharing only) with the > system keytab. It will precreated by some other process (msktutil) > because we don't have direct access to a domain admin account. Is > there any degragation in

On Fri, 1 Mar 2019 22:00:05 +0100 Michael Ströder via samba <samba at lists.samba.org> wrote: > Sorry for chiming in so late. > > On 1/11/19 2:48 PM, L.P.H. van Belle via samba wrote: > >>> On 11 Jan 2019, at 14:25, Rowland Penny via samba > >> <samba at lists.samba.org> wrote: > >>> On Fri, 11 Jan 2019 13:14:16 +0100 > >>>

On Sat, 2 Mar 2019 10:25:49 +0100 Michael Ströder <michael at stroeder.com> wrote: > On 3/1/19 10:17 PM, Rowland Penny via samba wrote: > > You don't need to precreate the computer, the join with 'net' will > > do it for you. > > But then I need to have administrative rights on the OU for the admin > doing the actual join. For security reasons I

Hi, Following that link https://support.microsoft.com/en-us/kb/932455 we created a delegation to permit some group to add computers into AD. That works except if some computer with same name was already added (even if this computer with same name was previously cleanly removed from AD). Anyone who has idea what we missed? Cheers, M.

On Tue, 06 Feb 2018 14:09:08 -0500 Dan Oriani via samba <samba at lists.samba.org> wrote: > > I'm not opposed to the idea. Does 'net ads join' support supplying > the machine name as the user, and the one-time-password given to it? > The only reason I'm using adcli at all is the preset-computer option > which I couldn't find an analogue to in 'net

Quoting Dan Oriani via samba <samba at lists.samba.org>: > Quoting Dan Oriani via samba <samba at lists.samba.org>: > >> Quoting Dan Oriani via samba <samba at lists.samba.org>: >> >>> Quoting Rowland Penny via samba <samba at lists.samba.org>: >>> >>>> On Tue, 06 Feb 2018 14:09:08 -0500 >>>> Dan Oriani via samba

Was trying to use autofs on ubuntu and mounting a samba shared failed. Then, i came across a note that 'unless you need to authenticate to cifs' -- wish I could find the exact quote now. The point is autofs fails to mount a windows server share. I can mount the share using mount.cifs but it fails with autofs. So I just thought I would check to see if anyone has pointers on using autofs on

Quoting Dan Oriani via samba <samba at lists.samba.org>: > Quoting Rowland Penny via samba <samba at lists.samba.org>: > >> On Tue, 06 Feb 2018 14:09:08 -0500 >> Dan Oriani via samba <samba at lists.samba.org> wrote: >> >>> >>> I'm not opposed to the idea. Does 'net ads join' support supplying >>> the machine name as

Hello Kevin, We have a  Samba/Windows20008R2 domain that's been running a few years now. Here are the details: * clients auth with SSSD (ldap, kerberos, ldap_schema=rfc2307bis) * idmap * samba on clients/server for joining domain We have scripts that automatically create users with UnixHomeDir, UID and GUID numbers within AD. I don't know about using WInbind...  I dropped that

Hi, we use kerberos with keytabs on our clients. We do *not* trust root on the clients! One client should never have access to any other client''s keytab. This is my proposed solution to get the keytabs to the clients, any comments welcome! 1. Use file to get /root/.ssh/authorized_keys 2. Use exported resource to let the client "notify" the server that it wants a keytab 3. On

> Does it work if you manually add userPrincipalName=CLIENT02.DOMAIN.TLD to your clients ldap entry and reexport the keytab? I already thought about trying that. So by now, I tried tweaking the client's LDAP entry. Adding userPrincipalName=CLIENT02.DOMAIN.TLD does not succeeed, however, after reviewing the ldap filter once again, I added userPrincipalName=nfs/client02.domain.tld at