Hot answers tagged

15

If you follow the FAQ link from JasonAzze, you will see there is a "map to guest" line which is also required, so you need both of these lines: security = user map to guest = Bad Password I had the same problem as the OP, and I have tested that this solution works on Fedora 18


12

Sounds a lot like my environment, only I get to have DNS delegation. It is possible though very tricky to set up an AD DNS environment that doesn't require dynamic DNS. You'll have to hand-populate all the SRV records, as well as the needed NS and A records for the domain. PTR records aren't as important. Since you aren't going to be adding or removing ...


9

The standard answer that Windows admins have given to this question is five: Schema Master (One per forest) Domain Naming Master (One per forest) PDC Emulator (One per domain) RID Master (One per domain) Infrastructure Master (One per domain) But it turns out that there are two other roles that usually don't matter, but can cause trouble if the server ...


8

As a suffering admin of a Samba 3 domain, I am desperate to upgrade to Samba 4. However until it is formally released, it just isn't worth the risk of upgrading. If it's for a couple of computers or home, then fine. If it's for an organisation that will lose money from computer downtime then don't do it - the risks are just too great. To quote the ...


7

I've not tried it, but one of Samba 4's goals is to be able to create an AD compatible domain controller, so theoretically yes. According to the Wiki, it already has (as of today - 25 Jul 2012): support of the 'Active Directory' logon and administration protocols, supporting XP, Windows7 and OS X clients support for Group Policy definitions full NTFS ...


7

The Active Directory functional level cannot exceed (to be "supported") 2008 R2. It appears there are still issues with SAMBA4 + 2012 schema.


6

My first approach to this would be: Create a new domain user and give it rights to join computers to the domain. Embed its username and password into your automation tool (puppet, chef, shell script, whatever). Once all the computers are joined to the domain, you can delete the domain-joining user. If you keep the user, you should change its password or ...


6

I'm going to shoot in the dark here. Your Samba servers can be WINS servers. I'd consider turning on WINS server functionality on a test Samba DC, passing out its address as an NBNS server (option 44), and telling the clients to do H-node type NetBIOS name resolution (option 46, value 8). You'll have to make a static WINS entry on the Samba server if it ...


6

The schemas for each are different, so there's no direct way to copy the LDAP data. You could write a script to translate data from one format to the other, I don't know of any tool that does this automatically.


6

Durable handles are part of SMB 2.0 Resilient handles are part of SMB 2.1 Persistent handles are part of SMB 2.2 which is now called SMB3 My main references for the following are: https://wiki.samba.org/index.php/SMB3_kernel_status and although this was originally for Samba3, it has more details: https://wiki.samba.org/index.php/Samba3/SMB2 Durable ...


5

The reason you're not finding the option is that OS resolver libraries cannot use ports other than 53. While it's possible to have a nameserver forwarder use ports other than 53, it is unlikely that the authors of this software support and/or anticipate your particular use case. You would need ask them why this feature is absent. You could try something ...


5

Answering my own question : the only thing wrong was the valid users section in smb.conf - it appears that %S didn't work at all. Thus, for a security group named "WebDevGrp" in Windows, on CentOS it will be shown as webdevgrp@mydomain.local ( you can test via groups myuser@mydomain.local ), and you can then make the Samba share like so : [vHosts] ...


5

Sorin-Mihai, I am the IT department for a private school. There I have a Windows domain using Samba4 on a Linux server. The school has about 70 Windows PCs which are joined to the domain. Thanks to Samba4, I take advantage of centralized account management, Group Policy (and Group Policy Preferences), shared drives, redirected folders, and roaming profiles. ...


5

I feel obligated to share this after spending hours trying to get this to work under SAMBA4 - here is my working SAMBA4 smb.conf that does NOT require a password to get to the share from windows [global] workgroup = HOME server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog ...


5

If you have a Windows laptop which is a domain member, using winbind offline logon would not influence its ability for cached credential logons as Winbind is caching the credentials for your Samba installation, not its clients. Cached Credentials is a domain client feature available in Windows 2000 and newer. It is working with Active Directory DCs as well ...


4

From your question missing some vital informations, because here are 3 different situations: Your Ubuntu/Samba server is on the Internet Your Ubuntu/Sabma is in the local network, and you now want setup an new computer what should act as VPN server and internet gateway (and firewall and like). You already have a sort of simple NAT router (e.g. common ...


4

You create the group policy on one of the windows workstations: Download and install the Windows RSAT tools (link is for Win7, it's easy to find them for 8) on one of the windows workstations. Logged in as a domain admin, open Group Policy Management, either create a new policy or pick one that applies to the right users (I'm skipping over some GP ...


4

It seems like the vfs_full_audit feature should get you the required info: Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba: vfs objects = full_audit full_audit:prefix = %u|%I|%m|%S full_audit:success = unlink open full_audit:failure = none full_audit:priority = NOTICE


3

I'm reasonably certain that Samba4 does not support hosting the Encrypting File System. None of the changelogs since Samba 3.0 mention it as a feature, and the Samba 3 page itself shows it as a feature they'd like to have since Microsoft released details about how it works; which is different than a feature they actually have.


3

No. What you are describing will not work. The domains will have different SIDs and will not have an object for your computer account in it.


3

Building from source is fine as long as you package the software, or you will soon find yourself managing a dependency hell. Always try backporting first, or at a very least package the software using checkinstall or fpm. Regarding your question, the same wiki page tells you where the configuration file is expected to be found: ...


3

If you only look at the section NAME MANGLING, you'll miss these handy parameters: # sets it to the old Samba 2 way of doing things, closer to what you're used to with Windows mangling method = hash or, in our case, we wanted the first 6 characters to be seen, so we ended up going with: # only with hash2 method, but lets you set the number of chars to ...


3

Try something like: [homes] browseable = no read only = no create mask = 0700 directory mask = 0700 valid users = %S That should set it so that users can't see each other's home folders, files/folders are created securely, and should auto-create the folders.


3

You could try whether "map acls = mode" in afp.conf helps with AFP permissions when dealing with ACLS.


3

I'm not sure what exactly you've done. If you've stood up a separate parallel domain, you're in for some work. If you've added samba4 DCs to your samba3 environment and then just decomissioned the samba3 DCs, then you're in good shape. Assuming you've done the second option, it's as simple as pointing the clients to DNS servers that host the zone(s) for ...


3

I found the solution after spending a few days working on it. Considering that this was a test environment, the firewall on the server and client windows were disabled. SAMBA running on Fedora19, I cut iptables but not firewalld. (Which I was totally unaware of the existence ...) Under Windows, I also had to change some registry keys: HKLM \ SYSTEM \ ...


3

I have a similar configuration with an AD joined server sharing from zfs, and have experienced the 'sleep' issue in FreeBSD 10.1 and 11.0, and several versions of Samba 3 and 4. I began to notice the lockup would occur mainly on changes to existing files, and not creation or deletion. After running very high samba debug levels, and catching a couple of ...


3

See this bug: https://bugs.centos.org/view.php?id=7897 It looks like the cifs module needs to be patched in order to properly distinguish different reparse points. Since the bug is still open though, it doesn't look like the CentOS team has done anything to fix it. If you're feeling adventurous, the bug does have a link to a mailing list thread with a ...


2

Regarding Kerberos configuration Samba as an AD/DC ships and runs its own Kerberos server (KDC). So there should not be a need to separately install and configure the kerberos server. Also, Samba's provisioning tool (samba-tool domain provision) produces an example krb5.conf file at the end. You should be able to simply copy that to /etc/krb5.conf. ...



Only top voted, non community-wiki answers of a minimum length are eligible