Tag Info

Hot answers tagged

6

The schemas for each are different, so there's no direct way to copy the LDAP data. You could write a script to translate data from one format to the other, I don't know of any tool that does this automatically.


2

I found the solution after spending a few days working on it. Considering that this was a test environment, the firewall on the server and client windows were disabled. SAMBA running on Fedora19, I cut iptables but not firewalld. (Which I was totally unaware of the existence ...) Under Windows, I also had to change some registry keys: HKLM \ SYSTEM \ ...


2

This is a bit tricky because of point 3. The LDAP in IPA is available just not anonymously, so you need to either kerberize the applications making queries OR give them a generic account to bind with. Most applications I've seen support this. From the samba wiki: " Note that you cannot point Samba4 to your existing OpenLDAP server and expect things to ...


2

Answering my own question : the only thing wrong was the valid users section in smb.conf - it appears that %S didn't work at all. Thus, for a security group named "WebDevGrp" in Windows, on CentOS it will be shown as webdevgrp@mydomain.local ( you can test via groups myuser@mydomain.local ), and you can then make the Samba share like so : [vHosts] ...


2

It's caused by em1 using DHCP. If the IP is static it works, and if using DHCP it works after I restart Samba. Ubuntu is using upstart and samba is not set to be dependent on all network interfaces and will bind only to the available interfaces when it starts. See http://askubuntu.com/a/349142/332223


1

This might be something you've already looked at, but this provides some tips for how to check the different steps in the process to determine where the problem may lie: https://wiki.samba.org/index.php/Setup_a_Samba_AD_Member_Server If you can post results of those test commands or the domain-related part of your smb.conf that could help narrow down where ...


1

This is a new feature introduced with Samba 3.2 and above. It is an extension to the SMB/CIFS protocol negotiated as part of the UNIX extensions. SMB encryption uses the GSSAPI (SSPI on Windows) ability to encrypt and sign every request/response in a SMB protocol stream. When enabled it provides a secure method of SMB/CIFS communication, similar to an ssh ...


1

Ports 137 and 138 should be opened for UDP traffic instead of TCP: -A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p udp --dport 137 -j ACCEPT -A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p udp --dport 138 -j ACCEPT -A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 139 -j ACCEPT -A ...


1

What you want to do in AD terms is set a custom userPrincipalName for every user in the directory, not rename the domain; domains can't be renamed without significant changes in AD (see the RENDOM tool) and I don't believe an equivalent to that exists for samba. I don't believe Samba 4 supports this, so unless I am wrong you will have to "migrate" the user ...


1

You should have same WORKGROUP configured in Samba and in Windows machine. If you have "workgroup = WORKGROUP" then you should change this also on windows machine to WORKGROUP. Double check firewall on windows machine and other settings, run tcpdump on samba server side to verify that traffic is actually coming to your server.


1

Here is the answer. Created new_user account Logged in as new_user to initialize profile Rebooted Logged in as Administrator and copied profile from old PC's hard drive to C:\Users\old_profile Changed permissions of C:\Users\old_profile: Added new_user account with Full Access Changed new_user's ProfileImagePath key in registry: ...


1

This is because this d-w-rwx---+ 2 AD\applicationpoolidentity group 2 Sep 8 17:28 __testFolder__ represents ONLY the owner. You see the "+" at the end of the bitmask? This means, that there is a (windows) acl controlling the access. So if you have access to a file because you are in the acl with r/w, the bitmask of the owner is not applicable to you ...


1

As it turns out, the default lock directory (/var/lock) - caused with ' --PREFIX="" ' at compilation time - gets filled up by the samba locking mechanism. This is a tmpfs of 5MB, and the usual lock size is 3MB or more. I suggest to change the default directory to an unused path. For example: lock directory = /var/samba


1

First off, this is just a warning. On MS Windows the number of file handlers on the client and the server must be identical, else you will see the "too many files open" message when e. g. copying files over the network. More recent Samba versions take care of this on their own. However, if you want to remove this warning, you can do so by changing your ...


1

I am quite new to this and I was struggling with it for a few hours. But what I did to solve it was to convert my UNIX users to Samba users. That solved the problem instantly


1

Finally - I got it! The samba-tool spn add ... does not (re)name the UPN as expected in the directory. I found it by comparing with MS ADS entries. So the work around is to change the value by hand before issuing the exportkeytab command: Open the service user entry with a ldap-tool (I used Apache Directory Studio) and find the just created user Edit ...


1

For what it's worth, I just had the same problem, the solution was that the DNS server used by the RHEL6 server contained outdated information. The information in the _msdcs.DOMAIN zone did not match the current setup, causing the join to fail. After flushing all DNS servers, and the local DNS cache, the join worked fine. It probably also would've solved ...


1

According to the MS-KILE documentation When clients perform a password-based initial authentication, they MUST supply the PA-ENC-TIMESTAMP pre-authentication type when they construct the initial AS request. You're Windows client apparently is not doing this. I am not pertaining to know the Windows side very well, but perhaps there are 'compatibility ...


1

I am working for Univention, the manufacturer of UCS, which you mentioned, and yes, we have a solution for migrating the passwords to Samba 4 with UCS. You can achieve this in two steps: First install UCS with Samba 3 and migrate the sambaNTPassword hashes from your OpenLDAP to the new UCS-OpenLDAP (ldapsearch and ldapmodify seems to be the most comfortable ...


1

Recently I had to configure a Windows/Samba test environment on Fedora and Windows 2012/Windows 7 and had some similar issues. After changing this registry keys on Windows servers/clients everything worked nice : HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\DomainCompatibilityMode=1 ...



Only top voted, non community-wiki answers of a minimum length are eligible