New answers tagged

1

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...


0

First, please try this settings instead of yours: [datastore_share] path = /mnt/datastore browsable = yes guest ok = yes read only = no create mask = 0777 directory mask = 0777 Second, if the previous settings didn't work, please try upgrading your samba to the latest version (now I would recommend 4.4.4 as ...


1

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key, Short CA cert length (1024b) - minimum recommended by OpenVPN developers is 2048b. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for ...


0

Samba has the capability to automatically update the BIND zone files via Kerberos. You have to configure bind with auto update. Check this article for full configuration and integration between Bind and Samba as domain controller Samba/Active Directory domain controller


0

(This is really more like a comment, but it's too long...) To set up Samba4, don't follow random guides, stick to the Samba Wiki, specifically: "Set up a Samba Active Directory Domain Controller." When you're using Samba as an AD DC, your first step in troubleshooting is to make sure DNS is working properly. Your comment Not sure where it gets this ...


1

you probably need to import the samba ADS CA certificate in the openfire system Edit: I installed samba4 in a centos vm and configured openfire to use ldap with startls. After installing samba4 from sources as indicated in the samba wiki (https://wiki.samba.org/index.php/Build_Samba_from_source, https://wiki.samba.org/index.php/...


1

Ok, first of all, thanks to @Jason-Walker for the pointer at kclient -- a typical Sun's implementation (functional but ugly) in ksh with helper-utilites implemented in C. Apparently, joining a domain consists of creating the host's entry via standard LDAP -- Sun's script uses ldapsearch, ldapmodify, and ldapadd from the OpenLDAP. Once the host is registered ...


1

Changing --domain=VBA.LAN to --domain=VBA fixed it!


0

There won't be any transparent way of doing this. The host keytab represents a copy of the host secret - a password that is known only to the Kerberos servers (Active Directory Domain Controllers) and the client. Under normal circumstances, the keytab is created when the client is joined to the Domain (at which time the user authenticates to the Domain and ...


1

Ok, this caught me completely off guard. While a Samba Active Directory domain can be usually fully configured without any issues using RSAT, it seems that the password policy is one of these very few things where this doesn't work, or at least not in its entirety. The solution is to turn off complexity directly on the Samba server, using # samba-tool ...


1

Along with the suggestion to use Organizational Units to target your Group Policy objects, you can also use Security Filtering in the applicable GPO's to have them apply to only specific computers and/or users. You'd simply remove Authenticated Users from the Security Filtering of the GPO and add the relevant computer or user accounts, or more preferably, ...


0

I am not sure you are looking at this from the right angle. AFAIK each desktop pulls the filter from the directory and then checks if the GPO should be applied or not. It's not that the server actively allocates GPOs only to a limited number of desktops. So, doesn't sound like a Samba issue. And that you cannot use WMI to query a Linux machine should be ...


1

Ignoring FGPP, there can be only one domain Password Policy. This is by default defined in the Default Domain Policy GPO. If you want to use a different Password Policy GPO then you need to link it to the domain and give it a higher precedence than the Default Domain Policy GPO. I suspect that's where your problem lies. https://blogs.manageengine.com/active-...


0

I guess these issues are related to one of the updates that were released to fix the Badlock Bug. The full list of fixes are listed in Samba Security Releases and the announcements for each patch-set provides useful information on what has changed. After upgrading my old CentOS 5 system, I had issues connecting Winbind to an AD domain controller and the ...



Top 50 recent answers are included