Tag Info

Hot answers tagged

11

Sounds a lot like my environment, only I get to have DNS delegation. It is possible though very tricky to set up an AD DNS environment that doesn't require dynamic DNS. You'll have to hand-populate all the SRV records, as well as the needed NS and A records for the domain. PTR records aren't as important. Since you aren't going to be adding or removing ...


8

As a suffering admin of a Samba 3 domain, I am desperate to upgrade to Samba 4. However until it is formally released, it just isn't worth the risk of upgrading. If it's for a couple of computers or home, then fine. If it's for an organisation that will lose money from computer downtime then don't do it - the risks are just too great. To quote the ...


7

I've not tried it, but one of Samba 4's goals is to be able to create an AD compatible domain controller, so theoretically yes. According to the Wiki, it already has (as of today - 25 Jul 2012): support of the 'Active Directory' logon and administration protocols, supporting XP, Windows7 and OS X clients support for Group Policy definitions full NTFS ...


6

The Active Directory functional level cannot exceed (to be "supported") 2008 R2. It appears there are still issues with SAMBA4 + 2012 schema.


6

My first approach to this would be: Create a new domain user and give it rights to join computers to the domain. Embed its username and password into your automation tool (puppet, chef, shell script, whatever). Once all the computers are joined to the domain, you can delete the domain-joining user. If you keep the user, you should change its password or ...


6

I'm going to shoot in the dark here. Your Samba servers can be WINS servers. I'd consider turning on WINS server functionality on a test Samba DC, passing out its address as an NBNS server (option 44), and telling the clients to do H-node type NetBIOS name resolution (option 46, value 8). You'll have to make a static WINS entry on the Samba server if it ...


6

The schemas for each are different, so there's no direct way to copy the LDAP data. You could write a script to translate data from one format to the other, I don't know of any tool that does this automatically.


5

If you follow the FAQ link from JasonAzze, you will see there is a "map to guest" line which is also required, so you need both of these lines: security = user map to guest = Bad Password I had the same problem as the OP, and I have tested that this solution works on Fedora 18


5

Sorin-Mihai, I am the IT department for a private school. There I have a Windows domain using Samba4 on a Linux server. The school has about 70 Windows PCs which are joined to the domain. Thanks to Samba4, I take advantage of centralized account management, Group Policy (and Group Policy Preferences), shared drives, redirected folders, and roaming profiles. ...


4

If you have a Windows laptop which is a domain member, using winbind offline logon would not influence its ability for cached credential logons as Winbind is caching the credentials for your Samba installation, not its clients. Cached Credentials is a domain client feature available in Windows 2000 and newer. It is working with Active Directory DCs as well ...


4

From your question missing some vital informations, because here are 3 different situations: Your Ubuntu/Samba server is on the Internet Your Ubuntu/Sabma is in the local network, and you now want setup an new computer what should act as VPN server and internet gateway (and firewall and like). You already have a sort of simple NAT router (e.g. common ...


3

No. What you are describing will not work. The domains will have different SIDs and will not have an object for your computer account in it.


3

You could try whether "map acls = mode" in afp.conf helps with AFP permissions when dealing with ACLS.


3

Building from source is fine as long as you package the software, or you will soon find yourself managing a dependency hell. Always try backporting first, or at a very least package the software using checkinstall or fpm. Regarding your question, the same wiki page tells you where the configuration file is expected to be found: ...


3

I'm not sure what exactly you've done. If you've stood up a separate parallel domain, you're in for some work. If you've added samba4 DCs to your samba3 environment and then just decomissioned the samba3 DCs, then you're in good shape. Assuming you've done the second option, it's as simple as pointing the clients to DNS servers that host the zone(s) for ...


2

In my workplace, we switched from Windows shared folder for network use to Ubuntu server for our 4 disc hardware raid. We do not use Active Directory (I don't even know what it is) but we do use user permissions to access the raid and mount it as a network drive. You can install webmin and use that to help manage the server. There are a couple tricks: ...


2

I'm reasonably certain that Samba4 does not support hosting the Encrypting File System. None of the changelogs since Samba 3.0 mention it as a feature, and the Samba 3 page itself shows it as a feature they'd like to have since Microsoft released details about how it works; which is different than a feature they actually have.


2

Why not take another route. Have them use VPN from their own devices. The proper way would be to allow them wirelessly on a guest network and have the vpn to access relevant sources. With this you can protect your network from untrusted devices. Trust me the last thing you want to do is run around and figure out who's laptop is generating suspicious traffic. ...


2

The new Zentyal 3 (based on Ubuntu 12.04) is using Samba4 beta ( I don't think it has upgrade to the RC release of samba4 yet) and seems quite stable. They offer official paid support and claim that Canonical supports Zentyal 3 as well. http://www.zentyal.org/ I have done tests with it and am quite pleased. I haven't run into any show stoppers testing, ...


2

Per the Samba4 wiki: This document attempts to describe some of requirements that a 'general purpose' LDAP directory server must meet to have Samba4 successfully use it as a 'directory backend'. ... This is no longer an area of active development in Samba4, and is not supported, or expected to be supported I'd suggest switching whatever ...


2

I had to do the following: Install: libpam0g-dev with: # apt-get install libpam0g-dev and then recompile and reinstall samba 4 from source. in stead of the winbind 4 wiki: # ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/libnss_winbind.so # ln -s libnss_winbind.so /lib/libnss_winbind.so.2 I used: # ln -s /usr/local/samba/lib/libnss_winbind.so.2 ...


2

Undoubtedly it's a authentication mechanism failure of sorts. I assume Kerberos is working for you ? kinit administrator@MYWORKGROUP.COM and kinit some_valid_user@MYWORKGROUP.COM Afterwards check klist for the two authentication tokens should show up. If not, please post back the answer. I've seen a bunch of possible faults, but let's rule them ...


2

Nope. Having the same name on the domain does not mean the same domain. The malicious domain controller you set up at home is not on the domain, and is not capable of making any changes.


2

If you only look at the section NAME MANGLING, you'll miss these handy parameters: # sets it to the old Samba 2 way of doing things, closer to what you're used to with Windows mangling method = hash or, in our case, we wanted the first 6 characters to be seen, so we ended up going with: # only with hash2 method, but lets you set the number of chars to ...


2

Assuming I understand your question's intent that you want admin rights to YOUR company laptop and not the company's AD domain itself... Can I set at my home, another AD server (Microsoft or Samba 4), that have the same domain ASDF as my office laptop. Sure, this is totally possible. You CAN setup a domain at home named ASDF...nobody will stop you. ...


2

alright, so i actually solved this a week ago and just didn't make it back to update because i have been doing active directory things since then. as it turns out my network adapter was losing its mind silently, i did a packet capture and read through all the packets and everything was fully functional, the entire process was successfully negotiated, so ...


2

It's a long shot but I'd try: it seems to me some incompatibility between win7 and samba-based RODC in terms of security level settings. I'd also assume some default security setting on win 7 is too restrictive that samba doesn't support. I will try to relax security settings on win 7 by change local policy: Computer Configuration->Windows Settings->Security ...


2

I found the solution after spending a few days working on it. Considering that this was a test environment, the firewall on the server and client windows were disabled. SAMBA running on Fedora19, I cut iptables but not firewalld. (Which I was totally unaware of the existence ...) Under Windows, I also had to change some registry keys: HKLM \ SYSTEM \ ...


2

This is a bit tricky because of point 3. The LDAP in IPA is available just not anonymously, so you need to either kerberize the applications making queries OR give them a generic account to bind with. Most applications I've seen support this. From the samba wiki: " Note that you cannot point Samba4 to your existing OpenLDAP server and expect things to ...



Only top voted, non community-wiki answers of a minimum length are eligible