Tag Info

Hot answers tagged

6

The Active Directory functional level cannot exceed (to be "supported") 2008 R2. It appears there are still issues with SAMBA4 + 2012 schema.


6

My first approach to this would be: Create a new domain user and give it rights to join computers to the domain. Embed its username and password into your automation tool (puppet, chef, shell script, whatever). Once all the computers are joined to the domain, you can delete the domain-joining user. If you keep the user, you should change its password or ...


6

I'm going to shoot in the dark here. Your Samba servers can be WINS servers. I'd consider turning on WINS server functionality on a test Samba DC, passing out its address as an NBNS server (option 44), and telling the clients to do H-node type NetBIOS name resolution (option 46, value 8). You'll have to make a static WINS entry on the Samba server if it ...


6

The schemas for each are different, so there's no direct way to copy the LDAP data. You could write a script to translate data from one format to the other, I don't know of any tool that does this automatically.


3

I'm not sure what exactly you've done. If you've stood up a separate parallel domain, you're in for some work. If you've added samba4 DCs to your samba3 environment and then just decomissioned the samba3 DCs, then you're in good shape. Assuming you've done the second option, it's as simple as pointing the clients to DNS servers that host the zone(s) for ...


3

Building from source is fine as long as you package the software, or you will soon find yourself managing a dependency hell. Always try backporting first, or at a very least package the software using checkinstall or fpm. Regarding your question, the same wiki page tells you where the configuration file is expected to be found: ...


3

No. What you are describing will not work. The domains will have different SIDs and will not have an object for your computer account in it.


2

Assuming I understand your question's intent that you want admin rights to YOUR company laptop and not the company's AD domain itself... Can I set at my home, another AD server (Microsoft or Samba 4), that have the same domain ASDF as my office laptop. Sure, this is totally possible. You CAN setup a domain at home named ASDF...nobody will stop you. ...


2

alright, so i actually solved this a week ago and just didn't make it back to update because i have been doing active directory things since then. as it turns out my network adapter was losing its mind silently, i did a packet capture and read through all the packets and everything was fully functional, the entire process was successfully negotiated, so ...


2

If you only look at the section NAME MANGLING, you'll miss these handy parameters: # sets it to the old Samba 2 way of doing things, closer to what you're used to with Windows mangling method = hash or, in our case, we wanted the first 6 characters to be seen, so we ended up going with: # only with hash2 method, but lets you set the number of chars to ...


2

Nope. Having the same name on the domain does not mean the same domain. The malicious domain controller you set up at home is not on the domain, and is not capable of making any changes.


2

Answering my own question : the only thing wrong was the valid users section in smb.conf - it appears that %S didn't work at all. Thus, for a security group named "WebDevGrp" in Windows, on CentOS it will be shown as webdevgrp@mydomain.local ( you can test via groups myuser@mydomain.local ), and you can then make the Samba share like so : [vHosts] ...


2

It's a long shot but I'd try: it seems to me some incompatibility between win7 and samba-based RODC in terms of security level settings. I'd also assume some default security setting on win 7 is too restrictive that samba doesn't support. I will try to relax security settings on win 7 by change local policy: Computer Configuration->Windows Settings->Security ...


1

The schema extensions from ypServ30.ldif must be added: $ kinit administrator@AD.NETDIRECT.CA Password for administrator@AD.NETDIRECT.CA $ sed -e 's/${DOMAINDN}/dc=AD,dc=NETDIRECT,dc=CA/g' \ -e 's/${NETBIOSNAME}/NETDIRECT/g' \ -e 's/${NISDOMAIN}/NETDIRECT/g' \ /usr/share/samba/setup/ypServ30.ldif | ldbmodify ...


1

I found the solution after spending a few days working on it. Considering that this was a test environment, the firewall on the server and client windows were disabled. SAMBA running on Fedora19, I cut iptables but not firewalld. (Which I was totally unaware of the existence ...) Under Windows, I also had to change some registry keys: HKLM \ SYSTEM \ ...


1

According to the MS-KILE documentation When clients perform a password-based initial authentication, they MUST supply the PA-ENC-TIMESTAMP pre-authentication type when they construct the initial AS request. You're Windows client apparently is not doing this. I am not pertaining to know the Windows side very well, but perhaps there are 'compatibility ...


1

Recently I had to configure a Windows/Samba test environment on Fedora and Windows 2012/Windows 7 and had some similar issues. After changing this registry keys on Windows servers/clients everything worked nice : HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\DomainCompatibilityMode=1 ...


1

I solved all my Apple+Samba issues by also installing Netatalk (AFPd) on the server in question... 'They' say the Apple SMB implementation is really poor.


1

it is selinux bug , disable selinux for nmbd : chcon -t unconfined_exec_t /usr/sbin/nmbd or add rule for socket semanage fcontext -a -t nmbd_var_run_t /var/run/samba/nmbd/unexpected


1

I had to do the following: Install: libpam0g-dev with: # apt-get install libpam0g-dev and then recompile and reinstall samba 4 from source. in stead of the winbind 4 wiki: # ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/libnss_winbind.so # ln -s libnss_winbind.so /lib/libnss_winbind.so.2 I used: # ln -s /usr/local/samba/lib/libnss_winbind.so.2 ...



Only top voted, non community-wiki answers of a minimum length are eligible