similar to: Win7 client error after classicupgrade from S3 to S4

Hi. We're trying to upgrade an old NT domain to AD. It's our second upgrade, and while the first was successfull this one has raised some issues for existing Windows 7 clients. If we disconnect the computer from the domain and join it back to the new S4 AD it works. Existing clients throws this error in Samba: Kerberos: AS-REQ b1rd42nbtmp648$@NT4DOMAIN from ipv4:10.0.0.42:49472 for krbt

Looks like a known issue when running samba as AD DC: https://bugzilla.samba.org/show_bug.cgi?id=9673 Perhaps try logrotate service to help rotate log.samba: https://linux.die.net/man/8/logrotate -- Regards, Jones Syue | ??? QNAP Systems, Inc. On Fri, May 22, 2020 at 12:26 PM Lorenzo Milesi via samba <samba at lists.samba.org> wrote: > > I know about this param, I configured it and

> which share isn't working ? > is it 'CONDIVISIONE' ? What is really weird is: Computer01, Win10, user1 logged in as local (not using domain user), share mapped with domain user. In the path I've posted in the first message the user can access BUT cannot write. Computer01, Win10, user1 logged in as domain user: same as above, user can access the folder but cannot write.

I never said the team does recommend it, still I don't see the purpose of saying "it's possible" when can be "fraught with problems". Maybe the wiki [1] should be more explicit on this, despite discouraging and suggesting better options it doesn't say it's highly problematic, it's still offered as an option.

Samba 4.12.1 installed from source following the wiki. I noticed /usr/local/samba/var/log.samba is not being rotated at all, it starts since the day I installed and it's still growing (500M so far). Is this something which must be handled manually with a logrotate entry? What signalling does samba require after the file has been rotated? I didn't find anything on the wiki, is it worth

> By setting this: vfs objects = recycle , you have turned of 'acl_xattr'. Ouch! :( Is there a way to keep acl_xattr and recycle? Shall I specify both of them? > You should also be aware that the permissions set from Windows (you are > setting them from Windows, aren't you ?) are stored in an EA. Yes, we're using RSAT from Windows. I see ea support has been set to yes

> Can I suggest you upgrade to Ubuntu 20.04 and use Louis's repo: > http://apt.van-belle.nl/ Unfortunately it's not a viable solution in the short period... Is there any problem with S4.12 and Ubuntu 18.04? Or with the default compile options on 18.04? thanks -- Lorenzo Milesi - lorenzo.milesi at yetopen.it YetOpen S.r.l. - https://www.yetopen.it/ Via Salerno 18 - 23900 Lecco -

> Verify dig -x $(hostname -i) > Then dig A $(hostname -f) > > As long as these match any CNAME should work. These works, but why these should match a CNAME? hostname returns the "main" host... Anyway to make a test I configured a new CNAME #?dig server.wdc.mydomain.it ;; ANSWER SECTION: server.wdc.mydomain.it. 900 IN CNAME fileserver.wdc.mydomain.it.

For the record, with the support of TranquilIT we added a new server for DC an "demoted" this one to fileserver only and it's working like a charm. So I suppose the "single server" solution is not viable anyomre, or at least it doesn't seem so. -- Lorenzo Milesi - lorenzo.milesi at yetopen.it YetOpen S.r.l. - https://www.yetopen.it/ Via Salerno 18 - 23900 Lecco -

> Can I suggest you read 'man smb.conf' Thanks, but on what "topic"? Is there a specific param or config you think could be relevant? > Try adding 'server max protocol = NT1' and ensure SMBv1 is running on > all machines. Is this just for SMBv1 or because you think could be related to the login problem? > Also, is the ldap server really running on port

> I would expect to only see that on a machine with the MIT kdc installed, > try this > > apt-get -s remove krb5-kdc > > This will prove one way or other if it is installed and what it wants to > remove along with it, it will not remove anything. Apparently nothing requires it: The following packages were automatically installed and are no longer required:

Attaching logs during an attempt of browsing \\server from CM-WM-W7$ thanks ----- Original Message ----- > From: "samba" <samba at lists.samba.org> > To: "Alex MacCuish" <alex at maccuish.org.uk>, "samba" <samba at lists.samba.org> > Sent: Saturday, May 9, 2020 12:03:58 AM > Subject: Re: [Samba] Unable to access shares by server

hi , thank's for your reply . no , current DC doesn't have that GUID: samba-tool spn list zimbra$ zimbra$ ... ldap/3ecb2a51-b21d-4bef-84ed-700db7963ff4._msdcs.domain.lan samba-tool spn list landc$ landc$ ... ldap/5bf8cf1f-1e35-40c6-a20d-0abc88238d92._msdcs.domain.lan that GUID is of the machine we are trying to join to: samba-tool spn list nextcloud$ nextcloud$ ...

Mandi a te! Does it work just with the CNAME? My config actually worked in the end, but I think after I added the spn entries. I was testing on a machine which didn't reflect the change, but probably because of caching (ifconfig /flushdns didn't help) ----- Original Message ----- > From: "samba" <samba at lists.samba.org> > To: "samba" <samba at

We've recently upgraded a S3 to Samba4 with AD (4.3.11-Ubuntu). The access control on the old installation was done with "valid users" and "write list". We've ported this to ACL, but for some path users are denied access and we cannot understand why. I.e. for a generic share, user "user1" can browse and access almost everything except for directory

Hai, Well, my advice here is.. Your using Ubuntu 16.04 which is EOL this month. So the best is to upgrade to or 18.04 or goto 20.04. And else i suggest you read : https://www.samba.org/samba/security/CVE-2020-10704.html * For authenticated connections the maximum packet size is controlled by the smb.conf parameter "ldap max authenticated request size" * For anonymous connections

> Can I suggest you keep upgrading, Samba 4.3.11 is EOL and I suppose the > version of Ubuntu you are running it on will be as well ;-) It's Ubuntu 16 LTS, so it's supported until 2021. > Probably because that is the old way of doing things ;-) I said that's the old installation, in the new one we remapped all the single user entries to the new ACL from RSAT. So we opened

Single server with Samba 4.3.11. Since when we changed some shares with a richer permission set users are unable to drag and drop files into the share. They can create files, rename and delete them, but d'n'd isn't working. They never had problems in the past, it began recently. Unfortunately I cannot tell exactly what has been changed as it's administered internally and they

> samba-tool domain: no such subcommand: provision Are you sure there's no typo or hidden character? provision command is still there in 4.18.2 :) # samba-tool domain provision ERROR: No domain set! -- Lorenzo Milesi - lorenzo.milesi at yetopen.com CTO @ YetOpen Srl Corso Martiri della Liberazione 114 - 23900 Lecco - ITALY - | 4801 Glenwood Avenue - Suite 200 - Raleigh, NC 27612 - USA

I've just deployed an AD DC fileserver with Samba4 but the server itself is not available when browsing network computers from a Windows PC. Is it because of this [1][2] or did I misconfigure it? Thanks my config: # Global parameters [global] netbios name = FILESERVER realm = WDC.MYDOMAIN.IT server role = active directory domain controller server services =