Hot answers tagged

10

The standard answer that Windows admins have given to this question is five: Schema Master (One per forest) Domain Naming Master (One per forest) PDC Emulator (One per domain) RID Master (One per domain) Infrastructure Master (One per domain) But it turns out that there are two other roles that usually don't matter, but can cause trouble if the server ...


6

Durable handles are part of SMB 2.0 Resilient handles are part of SMB 2.1 Persistent handles are part of SMB 2.2 which is now called SMB3 My main references for the following are: https://wiki.samba.org/index.php/SMB3_kernel_status and although this was originally for Samba3, it has more details: https://wiki.samba.org/index.php/Samba3/SMB2 Durable ...


4

It seems like the vfs_full_audit feature should get you the required info: Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba: vfs objects = full_audit full_audit:prefix = %u|%I|%m|%S full_audit:success = unlink open full_audit:failure = none full_audit:priority = NOTICE


3

I have a similar configuration with an AD joined server sharing from zfs, and have experienced the 'sleep' issue in FreeBSD 10.1 and 11.0, and several versions of Samba 3 and 4. I began to notice the lockup would occur mainly on changes to existing files, and not creation or deletion. After running very high samba debug levels, and catching a couple of ...


2

Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and then make sure that the privileged pipe is owned by root:winbindd_priv. The winbind privileged pipe is usually in /var/lib/samba/winbindd_privileged/, or a ...


2

I had to remember to do one other thing before I could get this to work... it was to make sure the permissions on my shared unix directory were read/write for the nobody user or the nogroup group. Debian Jessie, Samba 4.1.


2

Samba 4.x in domain controller mode stores the entire user account information in its built-in directory service database (not to be confused with a filesystem directory), very much like Windows DCs do. The directory can be accessed with LDAP protocol, so you can use ldapsearch command to query account information, including pwdLastSet attribute. However be ...


2

Try to add the following line to your smb.conf: client ldap sasl wrapping = plain It seems as this has caused some trouble lately.


2

More about persistent handles...Persistent handles are available across several servers of the same cluster. When one server goes down for any reason, the client machine can semi-transparently continue using this handle over a connection to another server. That's why the implementation of persistent handles (in contrary to durable and resilient handles) is ...


1

you probably need to import the samba ADS CA certificate in the openfire system Edit: I installed samba4 in a centos vm and configured openfire to use ldap with startls. After installing samba4 from sources as indicated in the samba wiki (https://wiki.samba.org/index.php/Build_Samba_from_source, https://wiki.samba.org/index.php/...


1

Ok, first of all, thanks to @Jason-Walker for the pointer at kclient -- a typical Sun's implementation (functional but ugly) in ksh with helper-utilites implemented in C. Apparently, joining a domain consists of creating the host's entry via standard LDAP -- Sun's script uses ldapsearch, ldapmodify, and ldapadd from the OpenLDAP. Once the host is registered ...


1

Ok, this caught me completely off guard. While a Samba Active Directory domain can be usually fully configured without any issues using RSAT, it seems that the password policy is one of these very few things where this doesn't work, or at least not in its entirety. The solution is to turn off complexity directly on the Samba server, using # samba-tool ...


1

Ignoring FGPP, there can be only one domain Password Policy. This is by default defined in the Default Domain Policy GPO. If you want to use a different Password Policy GPO then you need to link it to the domain and give it a higher precedence than the Default Domain Policy GPO. I suspect that's where your problem lies. https://blogs.manageengine.com/active-...


1

Along with the suggestion to use Organizational Units to target your Group Policy objects, you can also use Security Filtering in the applicable GPO's to have them apply to only specific computers and/or users. You'd simply remove Authenticated Users from the Security Filtering of the GPO and add the relevant computer or user accounts, or more preferably, ...


1

Eventually found out myself. The Windows permissions are stored in "Extended attributes". The raw data of these attributes can be displayed by xattr from Debian package python-xattr: xattr -l <local_path> To display and manipulate these permissions, you can use smbcacls from Debian package smbclient: smbcacls //localhost/share <...


1

I haven't actually done this. But there are no other answers yet, so... According to classes/documentation, things are never really delted from the AD schema, they are only marked inactive. I am unsure what affect this will have on user accounts that were created when the attributes in question were deleted (aka marked inactive). I kind of doubt the ...


1

As I am familiar with samba and the way it works, I don't think there's such an option.


1

Arguments for the valid users parameter must be comma-separated. Also, notice that you typed "writable" instead of writeable. And, because writeable is the inverted synonym of read only, there's no need to declare the read only parameter. Here's the correct config: [Daze] comment = Default connect path = / valid users = admin, root force user = root force ...


1

Forget about POSIX.1e ACLs with Samba - they just don't make sense, as Windows uses ACL model that is totally different from POSIX.1e, and it's impossible to properly convert between the two (which doesn't prevent some folks, particularly in the Linux kenrel community, from trying - but it just cannot work well for design reasons). Use NFSv4 ACLs, they are ...


1

If you don't mind the work, you cloud give this a try: https://sourceforge.net/projects/libsunacl/ That would involve some compiling i guess. You can find more informations here: https://wiki.freebsd.org/NFSv4_ACLs


1

"unicodePwd" field or attribute can contains only password under unicode form and encoded with base64: Password to set : MyNewPassw0rd Encoding this password to push it into "unicodePwd" attribute is done like this: echo -n '"MyNewPassw0rd"' | iconv -f utf8 -t utf16le | base64 -w 0 Note the simple quotes around double quotes: simple quotes are here for ...


1

I asked about this in the #suse channel on Freenode, and Miuku suggested the same as Arul, however, he mentioned two things, if I were using a Windows domain I could set the loginShell attribute. Sadly, I'm on a samba domain, so that didn't help. But his final suggestion was perfect, get the output of: getent passwd USERNAME This will have the valid ...


1

If you have access to edit the samba domain controller config, you can set the following property that allows you to set the shell in smb.conf template shell = /bin/zsh Not sure what happens if you login to a machine that does not have zsh installed (not all distros have zsh installed by default), but my guess is that it will invoke distro default ...


1

Look like it's a problem between 'User Account Control' and the 'Built-in Administrator' account. I had the same issue and this worked for me: Win + R and type 'secpol.msc' for open the Local Security Policy console. In the Security Settings tree, open Local Policies > Security Options. Find the policy: User Account Control: Admin Approval Mode for the ...


1

You have already in place the DNS configuration so I guess in this case you won't need to use add option but update because you are updating the DNS, right? Add -U Administrator to specify which user you want to make these changes as. First, lookup all records, then use update to change them according to the new network: samba-tool dns query localhost ...


1

According to this github thread the feature may be available in near future, as the code already exists. So the answer for this time is probably no, as this update has not yet been merged. You can, however, try to use the patch yourself (and recompile SoftEther) or work this problem around with RADIUS.


1

Does it allow the user to log in with the same credential on adifferent PC in the domain? Yes. If so, how is the profile handled? Each profile is local to the computer that the user logs onto. There is no profile synchronization between computers. Changes to the profile on one computer are not reflected in the profile on any other computer. If I ...


1

From the Samba Wiki: I keep getting asked for username/password when trying to access a public share on the AD DC. On a non AD domain, you can use 'map to guest = bad user' in smb.conf to allow windows machines that are not part of the domain, to access public shares. This will not work with an AD domain, guest access to the domain needs to be ...


1

I do owncloud authentication against samba4 without LDAP. enable "external_user_support" app check "/var/www/owncloud/apps/user_external/lib/smb.php" for "const SMBCLIENT = 'smbclient -L';" (add -L if missing) edit "/var/www/owncloud/config/config.php" and append: 'user_backends' => array ( 0 => array ( 'class' => 'OC_User_SMB', 'arguments' => ...


1

The guys from samba.org sometimes update/change samba's wiki. Few weeks earlier the added to the main wiki page, https://wiki.samba.org, two new entries: Setup and configure file shares using POSIX ACLs and Setup and configure file shares using Windows ACLs (which where "hidden" inside the "more..." link with bit less text). Now using both methods (not yet ...



Only top voted, non community-wiki answers of a minimum length are eligible