similar to: Samba domain member DC preferred list

On 20/04/2020 17:49, Andrea Cucciarre' via samba wrote: > Does the "password server" setting in the smb.conf achieve it? No, you shouldn't use this, you should allow Samba to choose the best DC to use. > > On 4/20/2020 6:40 PM, Andrea Cucciarre' wrote: >> Hello, >> >> Is there a way to provide a list of DC that Samba should try to join? >> I

My customer complain that in the AD DC they see the following insecure communication coming from the Samba server (DC member): "The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a cleartext (non-SSL/TLS-encrypted) LDAP connection." So Samba does an insecure LDAP bind and

Hello Rowland, One of my customer is reporting that sometime intermittently they can't access the share. When the issue appear the "wbinfo ping-dc"? and "net ads info" show the following: # /opt/samba/bin/wbinfo --ping-dc checking the NETLOGON for domain[FLEET] dc connection to "" failed failed to call wbcPingDc: WBC_ERR_DOMAIN_NOT_FOUND # /opt/samba/bin/net

Sorry my bad, thanks for spotting it. Should that explains also the failure to grab the mutex? Andrea Il 3/12/2019 12:14 PM, Rowland Penny via samba ha scritto: > On Tue, 12 Mar 2019 12:01:08 +0100 > Andrea Cucciarre' <acucciarre at cloudian.com> wrote: > >> The OS is OmniOS, the DC is Windows Server (not sure about the >> release), and below the smb.conf.

Does the "password server" setting in the smb.conf achieve it? Regards Andrea On 4/20/2020 6:40 PM, Andrea Cucciarre' wrote: > Hello, > > Is there a way to provide a list of DC that Samba should try to join? > I know that in command "net ads join" I can use "-S" to select with DC > to use, but it seems it doesn't accept list, only one single

Hello, Still fighting on this issue, now sometimes I get the following (may be) relevant errors: [2019/03/18 14:46:03.329505, 10, pid=582, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:509(idmap_find_domain)   idmap_find_domain called for domain 'BITINTRA' [2019/03/18 14:46:03.329577, 10, pid=582, effective(0, 0), real(0, 0), class=winbind]

The DC is a Windows AD DC. Could you please clarify why i should change setting in the Windows DC instead of the Samba server, which is the one that does the insecure ldap bind? Regards Andrea Cucciarre' On 11/9/2020 3:13 PM, Rowland penny via samba wrote: > On 09/11/2020 13:28, Andrea Cucciarre' wrote: >> My customer complain that in the AD DC they see the following

Am 09.11.20 um 15:42 schrieb cn--- via samba: > What version of Samba is this and do you have "server schannel = no" set > in its smb.conf? It might also be some thing like this option "client ldap sasl wrapping". So it would really help to see the entire smb.conf Regards Christian > > > Regards > > Christian > > Am 09.11.20 um 15:31 schrieb

The OS is OmniOS, the DC is Windows Server (not sure about the release), and below the smb.conf. I have also noted that they have more trusted domains, but since they configured ad idmap only for one domain, then all the other domains use tdb idmap [global] client ldap sasl wrapping = plain dedicated keytab file = /etc/krb5.keytab disable spoolss = yes host msdfs = no idmap config * : backend

Hello Rowland, thanks, configuring the uidNumber and gidNumber on the AD fixed the issue, now getent passwd works. I just have one remaining issue, it seems the ACL doesn't work. As an example when I set ACL with full permission for user andrea: # /usr/bin/ls -ldV /cache/testsamba/ d---------+  3 root     root           5 Jun 19 19:40 /cache/testsamba/            

I'm not sure I have understood, I'm mounting the share as "urca" user, which is not a known user. Although I'm setting smb.conf so that for guest user it uses the privileges of the known user "andrea" Could you please advice on what I should set for "guest account" in smb.conf? Thanks Andrea Il 1/23/2019 5:15 PM, Rowland Penny via samba ha scritto:

Hello, I'm trying to setup an omnios system as a Samba DC member, and I need AD backend for consistent IDs on all Samba clients. The AD join is successful, the wbinfo shows the AD users # /opt/samba/bin/wbinfo -n andrea S-1-5-21-2680195940-2267646359-3814218302-1109 SID_USER (1) however, " getent passwd ..." returns nothing for the user (all the AD user) I have enabled debugging

Hello, is there any documented procedure to configure a samba domain member (AD windows domain) to use LDAPS instead of LDAP Thanks Andrea

Hello, I have a customer that complains that Samba (as DC member) uses UDP during? AD authentication when clients mount a share. I have run a test and traced network packet and it seems UDP is used by the CLDAP (Samba server is 10.50.50.35, AD is 10.50.50.85) Frame 1: 133 bytes on wire (1064 bits), 133 bytes captured (1064 bits) on interface vmxnet3s0, id 0 Ethernet II, Src:

Hello, I'm running Samba 4.9.5 as domain member, when I bring down the current Window DC (10.50.50.187) the winbind seems to hang instead of switching to the other available DC (10.50.50.25) The "net ads" command show that Samba switched to the other available DC: net ads join -U 'administrator' -S 'PAVONE.HYPERFILE.LOCAL' 'HYPERFILE.LOCAL'^C root at

I have checked the DNS configuration as you recommended, and run more tests. It seems that winbidndd recover itself within about 10 minutes after the DC has been shutdown, not sure where that sort of timeout comes from :( # sleep 60; while true; do date; wbinfo -u; sleep 60; done Thu Aug? 1 16:39:32 CEST 2019 HYPERFILE\guest HYPERFILE\defaultaccount HYPERFILE\krbtgt HYPERFILE\administrator

Hello, I'm trying to configure a Samba server for SMB sharing with Persistent Handles. I have viewed the youtube? video https://youtu.be/fA78hdeYi6k However, it's not clear to me how to enable it in Samba, and if any setting is needed in smb.conf (I have already set up Samba, gluster and ctdb) I'm running Samba 4.11.. Could you please advice? -- Regards Andrea Cucciarre'

Hello Ralph, thanks for the info. I have find out that "durable handles" should be available in Samba 4.11, and actually it seems to recognize the share option: durable handles = yes Do you know if any other steps are needed to setup that feature, or could you point me any doc that help to achieve that? Regards Andrea Cucciarre' On 12/12/2019 11:04 AM, Ralph Boehme wrote:

Yes, I saw that they are different I was just willing to test something similar. Actually, I'm searching for a Samba feature that allow transparent failover, or continuos availablity in a cluster setup (Samba + ctbd + gluster) Based on the following link my understanding is that such feature is not currently available in Samba:

Hello, I have a customer that complains about slow AD authentication when accessing the share, eventually succeed (Samba is a DC memer) In the logs I can see the following errors: [2020/02/24 14:11:16.775884,? 1] ../source3/libads/ldap_utils.c:93(ads_do_search_retry_internal) ? Reducing LDAP page size from 1000 to 500 due to IO_TIMEOUT [2020/02/24 14:11:16.775902,? 3]