1

I had setup a Samba 3 server as PDC with a passdb LDAP backend.

Server SID: S-1-5-21-3270... Domain: A

Every user has a SambaSID beginning with this Server SID. But now I try to setup a second server for some shares. This server should use the same LDAP backend because I don't want to have two LDAP backends. Otherwise I have to do modifcations (e.g. add users) twice.

Second Server SID: S-1-5-21-3797... Domain: B

But now when a user try to mount this new share I see this error in samba log: The primary group domain sid(S-1-5-21-3797....) does not match the domain sid(S-1-5-21-3270...) for xxx(S-1-5-21-3270...).

I understand the problem but what can I do to avoid to maintain two LDAP backends?

Regards, Simon

1

You have to think like if you were in a "real" Windows environment. In such environment, if you need to add more servers, you won't create a new domain for each of these servers. Here, it is the same.

Server A is pointing to the LDAP backend, with all the users and groups. Server is serving a domain controller.

So what you have to do is to setup your second server to be a member of the domain served by server A.

You will manage all your users and groups in one LDAP, server A as a domain controller will perform all the authentication for your users. Server B will serve your shares. And because they are both in the same domain, your users will be able to access ressources on both servers, without the need to perform Domain Trust Relationships.

This is a usual setup, even in a "real" Windows Active Directory setup : splitting the work of authentication and file services.

| improve this answer | |
  • This is really the best way to do it but I was confused by the config of an old server which I use as template. The old config: [global] workgroup = B security = user passdb backend = ldapsam:ldap://[pdc Domain A] There aren't any trust relationships between these domains. I will use your way but can anyone tell me how this works with the old server? – user2346281 Jun 13 '14 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.