similar to: Enabling LDAPS in Samba in a dual-DC setup

Hi All, I am currently running a setup with a main DC ad1, that has ntpd installed and is currently configured to retrieve the time from the UK NTP time pool. I also have a second backup AD DC, ad2, on which I have not installed ntpd but I have installed ntpdate. My current understanding is that the setup I have just described is in-line with the recommended best practices outlined in the

Hello I wonder if anyone here could possibly help me? I am using Samba version 4.5.16-Debian (version information taken from sudo smbstatus) on Raspbian and attempting to prototype some future network infrastructure with a couple of Raspberry Pis. So far I have sucessfully created a Samba 4 AD DC ad1.samdom.example.com. I have successfully joined my Windows 10 dekstop client to the SAMDOM

Hi All, This Samba release changelog (https://wiki.samba.org/index.php/Updating_Samba#Incorrect_TLS_File_Permissions) specifically mentions a security issue and that that the multiple *.pem files needed for LDAP via TLS all need "special permissions" - and mentions to delete old files without the required permissions to force file renewal. Yet in the official Samba documentation

Hi everyone, I have two AD DCs that I am experimenting with, hostnames ad1 and ad2 respectively. I am using Raspberry Pi hardware, and accordingly I am using Samba 4.5.16-Debian on Raspbian Linux. I have already had some success so far setting up a second AD DC, ad2, and joining this to my existing Active Directory domain SAMDOM. I have already verified that I can create new user accounts on

Dear samba-list, please disregard my previous post. Since posting I have found a way to avoid the need to create a dedicated AD service account purely to allow Redmine to authenticate via LDAPS and AD. This neatly circumvents my original issue and is much more secure to boot. For future Redmine users googling, refer to this document here:

Hello I have two MS AD 2008 let's say AD1 and AD2. They have bi-direction trusted relationship. I have two linux servers joined into AD2, let's say LNX1 and LNX2. On LNX1, it can authenticate any users both from AD1 or AD2. Howerver, on LNX2, it can only authenticate users in AD2 but failed against AD1. It reports NT_STATUS_TRUSTED_DOMAIN_FAILURE (0xc000018c). I'm sure the smb.conf

Hi Guys. Today i experienced a problem with my samba 4 AD. I have a master(AD1) and a member(AD2) in a replicated environment. I´ve just checked that my AD2 has some issues when i did this test: ---------------------------------------------------------------------------------- ldbsearch --url=/usr/local/samba/private/sam.ldb '(invocationid=*)' --cross-ncs objectguid # record 1 dn:

Hi, I have an Active Directory with a single domain and 2 domain controllers: AD1 and AD2, both are on different sites (and subnets). I've initiallly insatlled AD1 and then joined AD2 to the domain. I've found that if I join desktop computers to the domain using AD1 as DNS, it joins successfully and propagates the change to AD2, but if I try to join a computer using AD2 as DNS, then the

Rowland - good news - the instructions in that document you suggested appear to have made all the difference! Now I find that if I do: pi at ad2:~ $ sudo systemctl restart samba-ad-dc pi at ad2:~ $ sudo samba-tool drs showrepl Default-First-Site-Name\AD2 DSA Options: 0x00000001 DSA object GUID: e676dfc3-670d-46bb-b1f7-756bae990a30 DSA invocationId: b7fb9a73-a5c5-4672-9d0f-83e0323f9f3b ====

Mandi! Stephen via samba In chel di` si favelave... AFAIK. > 1) Since I have a dual DC setup do I need to manually enable tls for LDAPS > separately on the secondary DC, or will this be automatically detected from > the primary and the settings copied over automatically? Settings are in smb.conf, and i doubt certs config can reside on LDAP because... a cert config would be necessary

Hi all, I have a couple of Samba 4 DCs on my network and I created a new service account LDAPReader on my DCs that my non-Samba third-party services such as Redmine successfully use to access AD via the LDAPS protocol. I have a couple of questions that relate to having service account of this nature implemented in Samba and I wondered if the group could possibly provide some advice? 1)

Hello Everyone, I have been tasked to work on consolidating authentication to achieve single sign-on using Active Directory. We have mix of Linux and Windows Hosts. All Linux hosts do local authentication currently and Windows hosts authenticates Active directory. I have been thinking of using Samba to authenticate Linux Hosts against Active Directory. I am fairly confident of configuring

Hi Rowland, I made the change you suggested to auto refresh kerberos. It didn't seem to fix the issue unfortunately, even after a machine restart. Following your line of reasoning that it is a Kerberos issue, I then tried to grab a new kerberos ticket on the server in question which appears to fail though. Perhaps this gives some further insight? pi at fs1:~ $ kinit administrator at

Hi folks, Does anybody have experience using ADCS in conjunction with Samba? I would like to create certificates using ADCS as a CA to create certificates to be deployed to servers running web applications. It would be very convenient to have joined Windows computers automatically trust certificates issued my own CA instead of having to import certificates manually on every browser on every

Hi there, I wonder if anyone can help me? I recently created an active directory setup with a primary domain controller ad1 and secondary domain controller ad2 for a domain SAMDOM. In-line with what I understand to be Samba best practices I then setup a separate file-server fs1 on which I created a file share, /fsrv/shares/OgdenFiles/. This has all been done using Samba version

I have 2 ADSL ad1 and ad2 , one PC for my firewall and some deamon on it with 3 ethernet : eth0 connect to my LAN ( 192.168.60.0/24 ) and 2 other connect to ad1 and ad2 |eth1 (10.0.1.2)--------------------ad1 ( ADSL 1 ) | My LAN(192.168.60.0/24) |---------eth0( 192.168.60.2)--> PC | |eth2 (10.0.2.2)---------------------ad2 (ADSL 2 ) All computer in LAN has default router =

Hello, I have installed an samba ad1 and an samba ad2 with replication. On the dc1 "samba-tool drs showrepl" say "... was successful" On dc2 there is the same. When dc1 goes down I get an Error (on my client): Active Directory Users and Computers error: "server is not operational" What is wrong here? For my understand that is no Replication, when one goes down and

Cheers Louis, i just ran the diagnostic snippet you sent me: pi at ad1:/var/lib/samba/private $ sudo ls -al $(samba -b | grep STATEDIR | awk {' print $NF '})/sysvol total 20 drwxrwx---+ 3 root 3000000 4096 Mar 25 16:36 . drwxr-xr-x  8 root root    4096 Mar 25 17:31 .. drwxrwx---+ 4 root 3000000 4096 Mar 25 16:36 samdom.example.com pi at ad2:/var/lib/samba/private $ sudo ls -al $(samba

Hi, after a successfully migrating my NT4 with OpenLDAP to a Samba4 AD...I got a problem. Like in the sambawiki tutorial (https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC) I tried to configure LDAPS. I used the auto-configured certs. They are located in "/var/lib/samba/private/tls". My smb.conf: # Global parameters [global] netbios name = PDC

With a lot of help, I just got AD authentication working (Samba 4.8.3, CentOS 7.6, using Winbind). I then added a local account to a share, but I can’t login. My smb.conf has “security = ads”, but I can’t figure out how to use that AND authenticate local users. How can I authenticate Active Directory AND local users? Brian