similar to: moved DM config to new server : gids different etc

Am 26.11.19 um 18:06 schrieb Stefan G. Weichinger via samba: > Am 26.11.19 um 17:19 schrieb L.P.H. van Belle: >> Hai Stefan, >> >> Remove the netbios alias and then put that as CNAME in the DNS >> Verify if the server its PTR is set also. >> >> And yeah, your totaly correct that your ACL is messed up.. >> Because your using backend RID. >>

On 27/11/2019 09:52, Stefan G. Weichinger via samba wrote: > Am 26.11.19 um 18:06 schrieb Stefan G. Weichinger via samba: >> Am 26.11.19 um 17:19 schrieb L.P.H. van Belle: >>> Hai Stefan, >>> >>> Remove the netbios alias and then put that as CNAME in the DNS >>> Verify if the server its PTR is set also. >>> >>> And yeah, your totaly

Am 26.11.19 um 17:15 schrieb Rowland penny via samba: > On 26/11/2019 16:00, Stefan G. Weichinger via samba wrote: >> Last week the mobo in a DM server died, so we had to set up a fallback >> machine and reinstall Debian 10.2 including Samba >> >> I had smb.conf but not /var/lib/samba in backups. >> >> Restored krb5.conf and smb.conf, rejoined. >>

Am 26.11.19 um 17:37 schrieb Rowland penny via samba: > How about 'getent group Domain\ Users' ? no result = empty reply The "admin" there is able to access stuff and reset his ACLs already. So ... things work so far. thanks. I will consider the config Louis suggested ... but not now (my reply was rejected by some samba-ml-SMTP-server ... another problem)

(resend 3 !) Am 27.11.19 um 14:28 schrieb L.P.H. van Belle via samba: > Hai, > > DM, right.. > > (short version) > Just install/setup a the new DM. Add it to the domain. > Transfer all data and correct rights where needed. can't: data is on SAN ... will get "plugged in" via FibreChannel tmrw > Test it, all ok, poweroff the old server, > Remove the

Last week the mobo in a DM server died, so we had to set up a fallback machine and reinstall Debian 10.2 including Samba I had smb.conf but not /var/lib/samba in backups. Restored krb5.conf and smb.conf, rejoined. Things work mostly ... but for example I get gid 10006 for "domain users" instead of 10513 before. and getent group doesn't show the AD groups, btw - I have: #

On 27/11/2019 10:12, Stefan G. Weichinger via samba wrote: > (resend 2 ... blocked again) > > Am 27.11.19 um 11:02 schrieb Rowland penny via samba: > >>> I now have the name of the domain and the IPs of the DCs etc ... so I >>> could theoretically start from scratch more or less and *maybe* switch >>> to backend AD here. >>> >> Do you use the

On 26/11/2019 16:28, Stefan G. Weichinger via samba wrote: > Am 26.11.19 um 17:15 schrieb Rowland penny via samba: >> On 26/11/2019 16:00, Stefan G. Weichinger via samba wrote: >>> Last week the mobo in a DM server died, so we had to set up a fallback >>> machine and reinstall Debian 10.2 including Samba >>> >>> I had smb.conf but not /var/lib/samba in

On 26/11/2019 17:21, Stefan G. Weichinger via samba wrote: > Am 26.11.19 um 17:37 schrieb Rowland penny via samba: > >> How about 'getent group Domain\ Users' ? > no result = empty reply Then there is something wrong, something isn't set correctly, I take it you replaced 'Domain\ Users' with its German equivalent. > > The "admin" there is able to

Hai, DM, right.. (short version) Just install/setup a the new DM. Add it to the domain. Transfer all data and correct rights where needed. Test it, all ok, poweroff the old server, Remove the old DM hostname from AD and DNS, and add CNAME oldname -> new name in the dns. And your done, at least, thats how i do it. And, offcourse above only works in one go if you used

On 26/11/2019 16:00, Stefan G. Weichinger via samba wrote: > Last week the mobo in a DM server died, so we had to set up a fallback > machine and reinstall Debian 10.2 including Samba > > I had smb.conf but not /var/lib/samba in backups. > > Restored krb5.conf and smb.conf, rejoined. > > Things work mostly ... > > but for example I get gid 10006 for "domain

I hav a problem porting my ACLS from my old filserver to a new one... My old Fileserver: I have my shares on a partition supporting acls with ext3 /dev/md0 on /data/raid type ext3 (rw,acl,user_xattr) My new Fileserver: /dev/md0 on /data/raid type ext4 (rw,acl,user_xattr) Now I copied all my shares to the new Fileserver with rsync and backed up my acls with: getfacl -R

(resend 2 ... blocked again) Am 27.11.19 um 11:02 schrieb Rowland penny via samba: >> I now have the name of the domain and the IPs of the DCs etc ... so I >> could theoretically start from scratch more or less and *maybe* switch >> to backend AD here. >> > Do you use the AD DCs for anything other than authentication and GPOs ? > > If you do, then the

Am 26.11.19 um 20:53 schrieb Stefan G. Weichinger via samba: > Am 26.11.19 um 20:50 schrieb Rowland penny via samba: >> On 26/11/2019 19:44, Stefan G. Weichinger via samba wrote: >>> Am 26.11.19 um 20:39 schrieb Rowland penny via samba: >>> >>>>> I assume I have to start over: demote that DC2 etc >>>>> >>>>> Should have left

On 26/11/2019 19:44, Stefan G. Weichinger via samba wrote: > Am 26.11.19 um 20:39 schrieb Rowland penny via samba: > >>> I assume I have to start over: demote that DC2 etc >>> >>> Should have left office when I could an hour ago. >>> >> Definitely sounds like you should, you are probably tired and it is >> easy? to make mistakes when you are

Ahh, yes good one, totaly forgot about that one. That also possible. Just one more thing.. And I dont understand this... Because.. And im sorry to say.. You .. Should .. Know .. This .. This share. > [rsnapshots] > path = /mnt/rsnapshots > read only = Yes > valid users = problem-user, sgw Now, you tell my, why are you using valid users here and explain also why your not

Hai Stefan, > > ;-) > > 3000 errors ... I mean ... what? No.. Not error, out of sync objects. > > ~30 users: small Ok thats small, a dc should be rebooted within 1-2 min and 1-2 min really max for AD sync. > > maybe I risk a DC1 reboot after 6pm > Not much time tmrw, so I am hesitating. Otherwise I'd like to have it > solved (again/for a a while). If

Am 26.11.19 um 21:37 schrieb Rowland penny via samba: > Ah, that could be worded better ;-) > > What it means is: > > If a DC fails for some reason and is stopped and then demoted on another > DC (the failed DC is no longer a DC), you must not simply fix the old DC > and restart it. This is because the domain no longer recognises the > demoted DC, but it will still think

Am 26.11.19 um 22:02 schrieb Rowland penny via samba: > On 26/11/2019 20:54, Stefan G. Weichinger via samba wrote: >> Am 26.11.19 um 21:37 schrieb Rowland penny via samba: >> >>> Ah, that could be worded better ;-) >>> >>> What it means is: >>> >>> If a DC fails for some reason and is stopped and then demoted on another >>> DC

But thats easy scriptable. ;-) I have my scripts always ready for that. This is why i run samba in AD mode and not RID. If you compair the AD backend disavantage Disadvantages: If the Windows Active Directory Users and Computers (ADUC) program is not used, you have to manual track ID values to avoid duplicates. The values for the RFC2307 attributes must be set manually. To RID Disadvantages: