date:20090318

Re: [Samba] Samba Configuration

2009-03-18 Thread guido

Is hard for me to keep up with what you are doing for the hour here ...

But I can tell you this. If you are going to have a share with multiple
users accessing a directory the best thing you can do is to have a
domain-users like.

So...

For example:

[ADD]
path = /home/ADD
browseable = no
public = no
writable = yes
nt acl support = no
valid users = @add @addrw

(You should change the browseable to see the share from the clients)

ls -ld /home/ADD
drwxrwx---+ 10 root addrw 4096 Mar  6 12:31 /home/ADD/
bowman:/etc/samba# getfacl /home/ADD/
getfacl: Removing leading '/' from absolute path names
# file: home/ADD
# owner: root
# group: addrw
user::rwx
group::rwx
group:add:rwx
group:addrw:rwx
mask::rwx
other::---


Now if you like to manage permissions from the clients, you should start
thinking about using acls in the filesystem.

/dev/mapper/storage-home on /home type ext3 (rw,acl)

And you should change the nt acl support to yes.

I hope this helps.


 I think I'm making some progress.. I can now write to the directory.

 If I chown admin:domain admins admin I can then write to the directory
 on
 the XP side. I can see domain permissions, but cannot edit them.

 However in doing this, I can no longer access the directory as my user on
 the Linux side.

 I tried creating a new group called 'samba' and added my admin user, along
 with my XP user. I kept the owner as admin. Now I can access the folder on
 the Linux side, but not the XP. *frustration!*

 And thanks for the help.
 --
 View this message in context:
 http://www.nabble.com/Samba-Configuration-tp22566973p22572874.html
 Sent from the Samba - General mailing list archive at Nabble.com.

 --
 To unsubscribe from this list go to the following URL and read the
 instructions:  https://lists.samba.org/mailman/options/samba



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Upgrade Samba Server Operating System version

2009-03-18 Thread Ooi Kwan Chen


Hi all,

I'm using Samba 3.0.24-6etch10 in Debian Etch 64bit with kernel Linux 
2.6.18-6-amd64.


I'm planning to upgrade my Samba Server from Debian Etch to Debian Lenny.

Will this affect Samba? Is it safe to perform upgrade from apt-get upgrade?

Thank you all for your help.

--
Best regards,

Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com 


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Open Files (MSOFFICE, xls, word) on samba share extreme slow

2009-03-18 Thread Daniel Müller

Dear all,

 

I have a samba 3.2.07 server up and running. All is working fine but W2000
clients have a heavy problem opening files on network shares.

Did someone recognized the same behavior and solved it?

 

Greetings

Daniel

 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Upgrade Samba Server Operating System version

2009-03-18 Thread Tim Bates


Ooi Kwan Chen wrote:

I'm planning to upgrade my Samba Server from Debian Etch to Debian Lenny.
Will this affect Samba? Is it safe to perform upgrade from apt-get 
upgrade? 
It generally goes fine I'd get apt to download all the required 
packages the night before you plan to do the upgrade, and then set aside 
2-3 hours to do the actual upgrade (it should take less than 1, but if 
something goes wrong you need a bit more time to get it going again).


I had no issues with Samba in my upgrades.

TB
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Upgrade Samba Server Operating System version

2009-03-18 Thread guido

 Hi all,

 I'm using Samba 3.0.24-6etch10 in Debian Etch 64bit with kernel Linux
 2.6.18-6-amd64.

 I'm planning to upgrade my Samba Server from Debian Etch to Debian Lenny.

 Will this affect Samba? Is it safe to perform upgrade from apt-get
 upgrade?

 Thank you all for your help.

 --
 Best regards,

 Ooi Kwan Chen (John), System Support, Server Management Section,
 Group IT Department, DXN Holdings Berhad
 Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
 Website : www.dxn2u.com

 --
 To unsubscribe from this list go to the following URL and read the
 instructions:  https://lists.samba.org/mailman/options/samba


Hi! I have several debian etch to upgrade. But I didn't upgrade any samba
yet. I did a fresh install of a new server in Lenny and the only problem
that I have was with openldap. A few things changed in my scenario...
Like:

* In pam_ldap now is mandatory to have ssl on to use a ssl connection
* Slapd now is compiled agains gnutls, so you need to change the Ciphers
list in slapd.conf.

Please, post any problems. Im interested 'coz I have like ten PDC to
migrate from etch to lenny.

Bye.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Upgrade Samba Server Operating System version

2009-03-18 Thread Ooi Kwan Chen


Tim Bates wrote:

Ooi Kwan Chen wrote:
I'm planning to upgrade my Samba Server from Debian Etch to Debian 
Lenny.
Will this affect Samba? Is it safe to perform upgrade from apt-get 
upgrade? 
It generally goes fine I'd get apt to download all the required 
packages the night before you plan to do the upgrade, and then set 
aside 2-3 hours to do the actual upgrade (it should take less than 1, 
but if something goes wrong you need a bit more time to get it going 
again).


I had no issues with Samba in my upgrades.

TB


Hi Tim,

Thanks for your information. I just finished upgraded my Samba server 
smoothly. Everything is fine.


--
Best regards,

Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com 


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Upgrade Samba Server Operating System version

2009-03-18 Thread Ooi Kwan Chen


gu...@lorenzutti.com.ar wrote:

Hi all,

I'm using Samba 3.0.24-6etch10 in Debian Etch 64bit with kernel Linux
2.6.18-6-amd64.

I'm planning to upgrade my Samba Server from Debian Etch to Debian Lenny.

Will this affect Samba? Is it safe to perform upgrade from apt-get
upgrade?

Thank you all for your help.

--
Best regards,

Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba




Hi! I have several debian etch to upgrade. But I didn't upgrade any samba
yet. I did a fresh install of a new server in Lenny and the only problem
that I have was with openldap. A few things changed in my scenario...
Like:

* In pam_ldap now is mandatory to have ssl on to use a ssl connection
* Slapd now is compiled agains gnutls, so you need to change the Ciphers
list in slapd.conf.

Please, post any problems. Im interested 'coz I have like ten PDC to
migrate from etch to lenny.

Bye.


  

Hi guido,

I'm just finish upgraded my Samba server to Lenny successfully. 
Everything is fine except for openldap that I'm not familiar with.


Hope this info helps.

--
Best regards,

Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com 


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Creating users while preventing bash login

2009-03-18 Thread Ooi Kwan Chen


David Miller wrote:
On Mon, Feb 23, 2009 at 10:52 PM, Ooi Kwan Chen 
ooi_kwanc...@dxn2u.com mailto:ooi_kwanc...@dxn2u.com wrote:


Hi all,

I'm using Samba 3.0.24-6etch10 in Debian Etch 64bit with kernel
Linux 2.6.18-6-amd64.

Is it possible to disable the bash login permission for my clients
in the sharing group while they are only able to login to view share?

Example:-

I have created a system user which is able to connect and view the
share files, but i do not want to allow bash login to the server
such as ssh.

Thank you all for your help.

-- 
Best regards,


Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com http://www.dxn2u.com
-- 
To unsubscribe from this list go to the following URL and read the

instructions:  https://lists.samba.org/mailman/options/samba


All you need to do is set the users shell to /bin/false.
--
David

Hi David,

Just want to say thank you for your advice. Everything works fine.

--
Best regards,

Ooi Kwan Chen (John), System Support, Server Management Section,
Group IT Department, DXN Holdings Berhad
Office Phone : +604 771 6688 Ext 122 Fax : +604 772 4785
Website : www.dxn2u.com 


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] AD and winbindd madness

2009-03-18 Thread Robert Gehr

Hello all

I tried for a couple of days now to get our samba domain hooked up with
an AD controller. I followed these instructions: 
http://www.msadfaq.de/wiki/ActiveDirectory/trust_relationship_samba_ad

I've solved a couple of problems over the years but this is a hard nut
to crack.

The setup is as follows

AD runs the domain BAUMANN (realm: baumann.local)
samba runs the domain BAUMANN-GMBH
The trust relationship has been esatblished, at least so it seems.

What I can do when I fire up winbind on the samba PDC (baadm1)

wbinfo -u: works
wbinfo -g: works
wbinfo -m: works
wbind -t: never returns but spits out no errors

getent passwd/group show the users/groups of the AD BAUMANN domain

I can assign file/group ownership to users/groups from the BAUMANN
domain.

If I don't have winbindd running I can connect to a share located on the
PDC of the samba controlled BAUMANN-GMBH domain, but can not write to
it.

If I run winbindd I can't connect to the share anymore. Same user, same
password. The error winbindd comes up with:

SCHANNEL: schannel_decode seq_num=13 data_len=32
SCHANNEL: schannel_decode seq_num=13 data_len=32
cli_pipe_validate_current_pdu: got pdu len 96, data_len 20, ss_len 12
rpc_api_pipe: got PDU len of 96 at offset 0
rpc_api_pipe: host baad1.baumann.local, pipe \NETLOGON, fnum 0x8006
returned 40 bytes.
netr_LogonSamLogonEx: struct netr_LogonSamLogonEx
out: struct netr_LogonSamLogonEx
validation   : *
validation   : union netr_Validation(case 3)
sam3 : NULL
authoritative: *
authoritative: 0x01 (1)
flags: *
flags: 0x (0)
result   : NT_STATUS_LOGON_FAILURE
NTLM CRAP authentication for user [BAUMANN]\[gehr] returned
NT_STATUS_LOGON_FAILURE (PAM: 4)


Here the relevant entries of smb.conf on the samba PDC

 [global]
   dos charset = 850
   unix charset = ISO8859-1
   display charset = ISO8859-1
   workgroup = BAUMANN-GMBH
   server string = %h
   passdb backend = ldapsam:ldap://baadm1.baumann-gmbh.de,
ldap://bafs2.baumann-gmbh.de;
   username map = /usr/local/samba/lib/user.map
   lanman auth = No
   socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384
   add user script = /usr/local/sbin/smbldap-useradd -m %u
   add group script = /usr/local/sbin/smbldap-groupadd -a -p %g
   add user to group script = /usr/local/sbin/smbldap-groupmod -m %u
%g
   delete user from group script = /usr/local/sbin/smbldap-groupmod -x
%u %g
   set primary group script = /usr/local/sbin/smbldap-usermod -g %g %
u
   add machine script = /usr/local/sbin/smbldap-useradd -w %u
   logon path =
   domain logons = Yes
   os level = 65
   domain master = Yes
   wins support = Yes
   kernel oplocks = No
   ldap admin dn = cn=ldap-admin,dc=baumann-gmbh,dc=de
   ldap group suffix = ou=groups
   ldap idmap suffix = ou=idmap
   ldap machine suffix = ou=computers
   ldap passwd sync = Yes
   ldap suffix = dc=baumann-gmbh,dc=de
   ldap ssl = start tls
   ldap user suffix = ou=people
   #idmap backend = ldap:ldap://baadm1.baumann-gmbh.de
   #idmap domains = BAUMANN-GMBH
   idmap uid = 1-2
   idmap gid = 1-2
   ldapsam:trusted = yes
   idmap config BAUMANN-GMBH:ldap_url = ldap://baadm1.baumann-gmbh.de
   idmap config BAUMANN-GMBH:ldap_base_dn =
ou=idmap,dc=baumann-gmbh,dc=de
   idmap config BAUMANN-GMBH:backend = ldap
   idmap config BAUMANN-GMBH:default = yes


Here the conf winbindd gets started with:

[global]

workgroup = baumann
netbios name = baadm1

idmap uid = 3-4
idmap gid = 3-4
winbind enum users = yes
winbind enum groups = yes
#winbind separator = +

realm = BAUMANN.LOCAL
#winbind use default domain = Yes
security = ADS
domain master = No
encrypt passwords = yes
password server = baad1.baumann.local
client use spnego = yes
winbind trusted domains only = No


Help is greatly appreciated, for it is must that we get this thing
going. 

Thanks and regards

Rob






Success is going from failure to failure without loss of enthusiasm.
~ Winston Churchill


-- 
baumann GmbH
Oskar-von-Miller-Str. 7
92224 Amberg - Deutschland / Germany

GF / CEO: Dr. Georg Baumann, Rudi Neumann, Josef Konrad
HR: Amberg HRB 1067 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Domain Privileges on Samba 3.2

2009-03-18 Thread G.W. Haywood

On Tue, 17 Mar 2009 David Markey wrote:

Re: [Samba] Domain Privileges on Samba 3.2

 I think 3.2.5 has a privileges bug, You'll have to upgrade to the latest
 in the 3.2 series, probably compile it from scratch.

http://www.mail-archive.com/debian-bugs-d...@lists.debian.org/msg624481.html

--

73,
Ged.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

RE: [Samba] Open Files (MSOFFICE, xls, word) on samba share extreme slow

2009-03-18 Thread Wikked one


Hi Daniel,
  A couple quick items to check.
Make sure you have log level set to 2 or less. (unless you are troubleshooting)
Another parameter worth looking into is 
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192



 From: muel...@tropenklinik.de
 To: samba@lists.samba.org
 Date: Wed, 18 Mar 2009 09:17:33 +0100
 Subject: [Samba]  Open Files (MSOFFICE, xls, word) on samba share extreme 
 slow
 
 Dear all,
 
  
 
 I have a samba 3.2.07 server up and running. All is working fine but W2000
 clients have a heavy problem opening files on network shares.
 
 Did someone recognized the same behavior and solved it?
 
  
 
 Greetings
 
 Daniel
 
  
 
 -- 
 To unsubscribe from this list go to the following URL and read the
 instructions:  https://lists.samba.org/mailman/options/samba

_
Hotmail® is up to 70% faster. Now good news travels really fast. 
http://windowslive.com/online/hotmail?ocid=TXT_TAGLM_WL_HM_70faster_032009--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba LDAP troubleshooting

2009-03-18 Thread Brad C

Hi There,

Yep, Ok now I understand the SID needs to be the same as the server the
client formed the initial security relationship with,

Is this correct?

Kind Regards
Brad

On Tue, Mar 17, 2009 at 7:47 PM, Adam Williams awill...@mdah.state.ms.uswrote:

 well the user's sid is invalid.  does it match the domain's sid with net
 getdomainsid?


 Brad C wrote:

 Hello

 I'm hoping someone can provide some insight, sample snippet from smb.conf
 and the samba log.
 Password authentication is working  succeeding, complains about an
 invalid
 SID which I know is the trust relationship that is formed between server
 and
 client, this is a duplicate ldap database from a samba domain controller.

 On the topic, anyone have a good book to recommend on Samba, I feel I am
 only using 10% of its capability and not really well at that... something
 is
 staring me in the face and Im missing it.

 [global]
workgroup = companyx
printing = cups
 hosts allow = 192.168.1.printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
security = user
encrypt passwords = Yes
obey pam restrictions = No
log level = 2
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=manager,dc=companyx,dc=co,dc=za
ldap suffix = dc=companyx,dc=co,dc=za
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
ldap ssl = off
ldap delete dn = Yes

 [testdir]
comment = test1
path = /data/test
browseable = yes
writable = yes
read only = no
available = yes
valid users = bradleyc
admin users = bradleyc



 [2009/03/13 08:36:39,  2]
 lib/access.c:check_access(406)

  Allowed connection from ___192.168.2.154
 (:::192.168.2.154)

 [2009/03/13 08:36:39,  2]
 lib/smbldap.c:smbldap_open_connection(796)

  smbldap_open_connection: connection
 opened

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_sam_from_ldap(571)

  init_sam_from_ldap: Entry found for user:
 bradleyc

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 513

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 513

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 1010

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 512

 [2009/03/13 08:36:39,  2]
 auth/auth.c:check_ntlm_password(308)

  check_ntlm_password:  authentication for user [bradleyc] - [bradleyc] -
 [bradleyc] succeeded
 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 544

 [2009/03/13 08:36:39,  2]
 lib/access.c:check_access(406)

  Allowed connection from :::192.168.2.154
 (:::192.168.2.154)

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_sam_from_ldap(571)

  init_sam_from_ldap: Entry found for user:
 bradleyc

 [2009/03/13 08:36:39,  2]
 passdb/pdb_ldap.c:init_group_from_ldap(2344)

  init_group_from_ldap: Entry found for group:
 513

 [2009/03/13 08:36:39,  0]
 passdb/passdb.c:lookup_global_sam_name(595)

  User bradleyc with invalid SID
 S-1-5-21-1571991244-1820204139-1100571284-3420 in
 passdb
 [2009/03/13 08:36:39,  2]
 smbd/service.c:make_connection_snum(736)

  user 'bradleyc' (from session setup) not permitted to access this share
 (testdir)



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] fill_share_mode_lock failed

2009-03-18 Thread Mario Fetka

Hallo,

the subject says everything

the error is comming every now and then.

the system is a ubuntu server intrepid
the samba server uses ldap
version is 3.2.3
mounted with:
/dev/sde1 on /home type ext3 (rw,relatime,acl)

the clients windows xp prof (SP3)

the log
2009/03/18 13:20:41,  3] locking/locking.c:fetch_share_mode_unlocked(857)   

  
  fill_share_mode_lock failed   

   
[2009/03/18 13:20:41,  3] smbd/process.c:process_smb(1549)  

   
  Transaction 3143 of length 272 (0 toread) 

   
[2009/03/18 13:20:41,  3] smbd/process.c:switch_message(1361)   

   
  switch message SMBtrans2 (pid 6284) conn 0xb92772d8   

   
[2009/03/18 13:20:41,  3] smbd/trans2.c:call_trans2qfilepathinfo(3932)  

   
  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004   

   
[2009/03/18 13:20:41,  3] locking/locking.c:fetch_share_mode_unlocked(857)  

   
  fill_share_mode_lock failed   

   
[2009/03/18 13:20:41,  3] smbd/trans2.c:call_trans2qfilepathinfo(4006)  

   
  call_trans2qfilepathinfo 
/Anwendungsdaten/OpenOffice.org/3/user/config/soffice.cfg/modules/StartModule/statusbar
 
(fnum = -1) level=1004 call=5 total_data=0  
[2009/03/18 13:20:41,  3] smbd/process.c:process_smb(1549)  

   
  Transaction 3144 of length 282 (0 toread) 

   
[2009/03/18 13:20:41,  3] smbd/process.c:switch_message(1361)   

   
  switch message SMBtrans2 (pid 6284) conn 0xb92772d8   

   
[2009/03/18 13:20:41,  3] smbd/trans2.c:call_trans2findfirst(1918)  

   
  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, 
close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384  
 
[2009/03/18 13:20:41,  3] smbd/dir.c:dptr_create(520)   

   
  creating new dirptr 256 for path 
/Anwendungsdaten/OpenOffice.org/3/user/config/soffice.cfg/modules/StartModule/statusbar,
 
expect_close = 1   
[2009/03/18 13:20:41,  3] locking/locking.c:fetch_share_mode_unlocked(857)  

   
  fill_share_mode_lock failed   

   
[2009/03/18 13:20:41,  3] locking/locking.c:fetch_share_mode_unlocked(857)

[Samba] Samba Password Question.

2009-03-18 Thread mparsons

Hi All - Quick question. Is there anyway that when a user first invokes 
Samba to map to a network share that they are asked to change their 
(samba) password. 

I've got a whole bunch of (samba) users who all have been given the same 
password and I want them to have to change it to one of their own choosing 
upon first login.

Kind Regards,

Mark Parsons

Ernst  Young is proud to bring you Entrepreneur Of The Year - the prestigious 
global business awards for entrepreneurs. www.eoy.co.uk

This e-mail and any attachment are confidential and contain proprietary 
information, some or all of which may be legally privileged.  It is intended 
solely for the use of the individual or entity to which it is addressed.  If 
you are not the intended recipient, please notify the author immediately by 
telephone or by replying to this e-mail, and then delete all copies of the 
e-mail on your system.  If you are not the intended recipient, you must not 
use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any 
attachment has been checked for viruses, we cannot guarantee that they are 
virus free and we cannot accept liability for any damage sustained as a result 
of software viruses.  We would advise that you carry out your own virus checks, 
especially before opening an attachment.

Ernst  Young refers to the global organization of member firms of Ernst  
Young Global Limited, each of which is a separate legal entity. Ernst  Young 
Global Limited, a UK company limited by guarantee, does not provide services to 
clients.

The UK firm Ernst  Young LLP is a limited liability partnership registered in 
England and Wales with registered number OC31 and is a member practice of 
Ernst  Young Global.  A list of members' names is available for inspection at 
1 More London Place, London, SE1 2AF, the firm's principal place of business 
and its registered office. 
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba Password Question.

2009-03-18 Thread David Wells

mpars...@uk.ey.com wrote:
Hi All - Quick question. Is there anyway that when a user first invokes
Samba to map to a network share that they are asked to change their
(samba) password.

I've got a whole bunch of (samba) users who all have been given the same
password and I want them to have to change it to one of their own choosing
upon first login.

Kind Regards,

Mark Parsons

Ernst Young is proud to bring you Entrepreneur Of The Year - the prestigious
global business awards for entrepreneurs. www.eoy.co.uk

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged. It is intended
solely for the use of the individual or entity to which it is addressed. If
you are not the intended recipient, please notify the author immediately by
telephone or by replying to this e-mail, and then delete all copies of the
e-mail on your system. If you are not the intended recipient, you must not
use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any
attachment has been checked for viruses, we cannot guarantee that they are
virus free and we cannot accept liability for any damage sustained as a result
of software viruses. We would advise that you carry out your own virus checks,
especially before opening an attachment.

Ernst Young refers to the global organization of member firms of Ernst Young
Global Limited, each of which is a separate legal entity. Ernst Young Global Limited,
a UK company limited by guarantee, does not provide services to clients.

The UK firm Ernst Young LLP is a limited liability partnership registered in England and Wales with registered number OC31 and is a member practice of Ernst Young Global. A list of members' names is available for inspection at 1 More London Place, London, SE1 2AF, the firm's principal place of business and its registered office.

Is samba the DC of the domain?

Best regards,
David Wells.

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba Password Question.

2009-03-18 Thread mparsons

Hi David, 

Its Samba Release 3 on an HP-UX 11.11 machine. We are allowing users to 
map folders from the unix box as shares on their windows laptops. 

Cheers, 

Mark P.













David Wells d.we...@vitalcan.com.ar 
18/03/2009 14:38

To
mpars...@uk.ey.com
cc
samba@lists.samba.org
Subject
Re: [Samba] Samba Password Question.






mpars...@uk.ey.com wrote:
 Hi All - Quick question. Is there anyway that when a user first invokes 
 Samba to map to a network share that they are asked to change their 
 (samba) password. 

 I've got a whole bunch of (samba) users who all have been given the same 

 password and I want them to have to change it to one of their own 
choosing 
 upon first login.

 Kind Regards,

 Mark Parsons

 Ernst  Young is proud to bring you Entrepreneur Of The Year - the 
prestigious global business awards for entrepreneurs. www.eoy.co.uk

 This e-mail and any attachment are confidential and contain proprietary 
information, some or all of which may be legally privileged.  It is 
intended solely for the use of the individual or entity to which it is 
addressed.  If you are not the intended recipient, please notify the 
author immediately by telephone or by replying to this e-mail, and then 
delete all copies of the e-mail on your system.  If you are not the 
intended recipient, you must not use, disclose, distribute, copy, print or 
rely on this e-mail.

 Whilst we have taken reasonable precautions to ensure that this e-mail 
and any attachment has been checked for viruses, we cannot guarantee that 
they are virus free and we cannot accept liability for any damage 
sustained as a result of software viruses.  We would advise that you carry 
out your own virus checks, especially before opening an attachment.

 Ernst  Young refers to the global organization of member firms of Ernst 
 Young Global Limited, each of which is a separate legal entity. Ernst  
Young Global Limited, a UK company limited by guarantee, does not provide 
services to clients.

 The UK firm Ernst  Young LLP is a limited liability partnership 
registered in England and Wales with registered number OC31 and is a 
member practice of Ernst  Young Global.  A list of members' names is 
available for inspection at 1 More London Place, London, SE1 2AF, the 
firm's principal place of business and its registered office. 
 
Is samba the DC of the domain?

Best regards,
David Wells.






Ernst  Young is proud to bring you Entrepreneur Of The Year - the prestigious 
global business awards for entrepreneurs. www.eoy.co.uk

This e-mail and any attachment are confidential and contain proprietary 
information, some or all of which may be legally privileged.  It is intended 
solely for the use of the individual or entity to which it is addressed.  If 
you are not the intended recipient, please notify the author immediately by 
telephone or by replying to this e-mail, and then delete all copies of the 
e-mail on your system.  If you are not the intended recipient, you must not 
use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any 
attachment has been checked for viruses, we cannot guarantee that they are 
virus free and we cannot accept liability for any damage sustained as a result 
of software viruses.  We would advise that you carry out your own virus checks, 
especially before opening an attachment.

Ernst  Young refers to the global organization of member firms of Ernst  
Young Global Limited, each of which is a separate legal entity. Ernst  Young 
Global Limited, a UK company limited by guarantee, does not provide services to 
clients.

The UK firm Ernst  Young LLP is a limited liability partnership registered in 
England and Wales with registered number OC31 and is a member practice of 
Ernst  Young Global.  A list of members' names is available for inspection at 
1 More London Place, London, SE1 2AF, the firm's principal place of business 
and its registered office. 
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba Configuration

2009-03-18 Thread ElihuJ


Thanks Guido. I think I'm a little confused though :)

Here's what I added to my smb.conf:

[admin]
 path = /home/admin
 browseable = yes
 public = no
 writable =  yes
 nt acl support = no
 valid users = @admin

When I do ls -ld /home/admin I get:

drwx--x--x 8 admin wheel 4096 2009-03-18 00:49 /home/admin

And getfacl:

getfacl /home/admin
# file: home/admin
# owner: admin
# group: wheel
user::rwx
group::--x
other::---

So should I create a group, say addrw and add my admin user to it?

Thank you again, I appreciate your help.
-- 
View this message in context: 
http://www.nabble.com/Samba-Configuration-tp22566973p22585997.html
Sent from the Samba - General mailing list archive at Nabble.com.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Can SAMBA make a kerberos keytab on Solaris 10?

2009-03-18 Thread Rob LaRose


Hi Samba people!

	I'm trying to use SAMBA (the version included with Solaris 10) with  
an AD.


	NET ADS JOIN works like a charm to create a computer object in the AD  
for the solaris machine, and SAMBA users are authenticating without a  
problem.  This is good.  HOWEVER -- I also need other protocols  
(including ssh and Xinet KA-Share) to authenticate users.


	As I understand it, SAMBA uses kerberos to authenticate against AD,  
so as long as everyone is using the same keytab file, I'd expect all  
to be well.  However, I find that when I do net ads join it doesn't  
create or modify a keytab file that I can find.  I have use kerberos  
keytab = true in my smb.conf file, but I can't see that it actually  
does anything.


	Can anyone steer me in the right direction here?  I've been chasing  
this for over a month.


--Rob


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] samba ldap configuration attributes needed

2009-03-18 Thread John Goubeaux


Folks,

I am attempting to get an install of Samba authenticating against a Sun 
DS as a stand alone smb server eg. non PDC.
I have the host OS ( solaris 10) properly configured to authenticate 
against the directory, the directory schema modified
to accept the PosixAccount and SambaSamAccount objectclasses, smb.conf 
configured and in place and a test user in place as well.


My two question(s) are:

What are the minimal directory account attributes needed to get a user 
to authenticate?  eg my understanding is that many
of the attributes are used for a samba server acting as a PDC, which in 
my case are not needed.


My user base in the DS allready exists, so I will want to just add the 
extra necessary object classes and attributes to the
user's existing entries. What mechanism determines what the  sambaSID  
and  sambaPrimaryGroupSID values are ? I am unclear
how these values are derived and what they are based on. Realize my 
users already have passwd's in their entries that I am hoping

to not have to change.

any help is appreciated!   -john

--

John Goubeaux
Systems Administrator
Gevirtz Graduate School of Education
UC Santa Barbara
Phelps Hall 3534
805 893-8190

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Can SAMBA make a kerberos keytab on Solaris 10?

2009-03-18 Thread Rob LaRose

Hi Edward,

Thanks for the link. Creating a computer account keytab on the
Windows side and copying it back to the Solaris works for my other
services (ssh, etc.) but net ads join clobbers the existing account
and creates a new one which no longer matches the keytab. Is there a
way to get samba / net ads join to just use the existing kerberos
setup / keytab and NOT try to create a new account?

--Rob

On Mar 18, 2009, at 4:56 PM, Edward Irvine wrote:

Rob,

Hi Samba people!

I'm trying to use SAMBA (the version included with Solaris 10)
with an AD.

NET ADS JOIN works like a charm to create a computer object in the
AD for the solaris machine, and SAMBA users are authenticating
without a problem. This is good. HOWEVER -- I also need other
protocols (including ssh and Xinet KA-Share) to authenticate users.

As I understand it, SAMBA uses kerberos to authenticate against
AD, so as long as everyone is using the same keytab file, I'd
expect all to be well. However, I find that when I do net ads join
it doesn't create or modify a keytab file that I can find. I have
use kerberos keytab = true in my smb.conf file, but I can't see
that it actually does anything.

Can anyone steer me in the right direction here? I've been
chasing this for over a month.

The following is a little dated. But see the section in http://users.tpg.com.au/adsl95uc/gssapi-sol10/
that refers to Windows Active Directory. This is how you get a
vailid /etc/krb5/krb5.keytab file onto your Solaris machine.

Not that you don't *have* to have a krb5.keytab file on your Solaris
Servers to authenticate users, unless you want to do single sign on.

If you just want to have same sign on (same username, same password)
then all the PAM stack needs is a correctly configured /etc/krb5/
krb5.conf file.

There is a section about building your own PAM/OpenSSH/Kerberos
stack which you may be able to ignore.

--Rob

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Samba] Log entries with truncated service names

2009-03-18 Thread Miguel Medalha


Hello all

I am running Samba 3.2.8 over CentOS 5.2, with a LDAP back end.

On some days, not all, strange entries appear in the Samba logs. I get 
entries like this:



[2009/03/18 18:35:09,  0] smbd/service.c:make_connection(1366)
 aurora (192.168.0.22) couldn't find service netlogo


The real name of the service is of course netlogon.

Another example for the share named comercial:


[2009/03/13 09:48:00,  0] smbd/service.c:make_connection(1366)
 ana (192.168.0.12) couldn't find service comercia


And so on. The name of the service appears truncated by ONE character, 
the last one.


There is one less frequent exception to this rule:


[2009/03/18 14:51:47,  0] smbd/service.c:make_connection(1366)
 antonia (192.168.0.21) couldn't find service


Here the service name does not appear at all. Al I get is one space 
after the word service.


Does anyone here know why this happens?


Also, the logs get filled with:


[datetime,  0] smbd/trans2.c:call_trans2qfsinfo(2568)
call_trans2qfsinfo: not an allowed info level (0x102) on IPC$.


This goes to several hundreds of kilobytes in just a few days:

What does this mean? I asked about this twice here but I didn't get an 
answer. I searched in Google and I got nothing.


I would appreciate any help with these issues.
Thank you.
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Re: Can not clear Read-only attribute - thank you

2009-03-18 Thread Jaroslav Fojtik

Dear Jeremy Allison,

 Logged it as bug #6186, I've attached the patch and described
 the workaround.
Thank you very much for this fix. I confirm that it works and I hope that 
it will be incorporated into a next Samba release.

You could also close this bug:
 https://bugzilla.samba.org/show_bug.cgi?id=4325


   Yes, you'll lose current DOS attribute mapping, but you'll
   be much happier in the long run :-).
I also do not want to loose existing attributes and rebuild reiserfs with 
support of extended attributes. I am interested only in Read Only attribute.

regards
   Jara


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Re: Can not clear Read-only attribute - thank you

2009-03-18 Thread Jeremy Allison

On Thu, Mar 19, 2009 at 12:23:55AM +0100, Jaroslav Fojtik wrote:
 Dear Jeremy Allison,
 
  Logged it as bug #6186, I've attached the patch and described
  the workaround.
 Thank you very much for this fix. I confirm that it works and I hope that 
 it will be incorporated into a next Samba release.

Yes, it's in the git trees so it will be in all future Samba releases.

 You could also close this bug:
  https://bugzilla.samba.org/show_bug.cgi?id=4325

Thanks, will do.

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba Configuration

2009-03-18 Thread guido


 Thanks Guido. I think I'm a little confused though :)

 Here's what I added to my smb.conf:

 [admin]
  path = /home/admin
  browseable = yes
  public = no
  writable =  yes
  nt acl support = no
  valid users = @admin

 When I do ls -ld /home/admin I get:

 drwx--x--x 8 admin wheel 4096 2009-03-18 00:49 /home/admin

 And getfacl:

 getfacl /home/admin
 # file: home/admin
 # owner: admin
 # group: wheel
 user::rwx
 group::--x
 other::---

 So should I create a group, say addrw and add my admin user to it?

 Thank you again, I appreciate your help.

I only give you an example of my groups. I have a group called addrw.
You should have a group in /home/admin (not wheel) and 770 (not 711).
Then, join the users that need to write in the share to this group.

Now in the linux filesystem they have the right to write in the share.

I hope this helps.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba Configuration

2009-03-18 Thread ElihuJ


Hey Guido, I just wanted to update you in that I got it working.

For /home/admin, I chowned admin:admins, and chmoded 770

After doing this I was able to write to the directory as admin, and also
write to it as admin on XP. Also other users are unable to see the
directory.

Just wanted to say thank you again for the help.
-- 
View this message in context: 
http://www.nabble.com/Samba-Configuration-tp22566973p22592802.html
Sent from the Samba - General mailing list archive at Nabble.com.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [SCM] Samba Shared Repository - branch master updated - release-4-0-0alpha7-497-g211e255

2009-03-18 Thread Stefan (metze) Metzmacher

Hi Zach,

   switch (transport-options.signing) {
   case SMB_SIGNING_OFF:
 @@ -187,7 +188,7 @@ static void continue_socket(struct composite_context 
 *creq)
   state-negprot.in.capabilities  = 0;
   unix_to_nt_time(state-negprot.in.start_time, time(NULL));
   dialects[0] = SMB2_DIALECT_REVISION;
 - dialects[1] = 0;
 + dialects[1] = SMB21_DIALECT_REVISION;
   state-negprot.in.dialects = dialects;

There was a reason to also provide dialect '0', as I want to work
against early longhorn beta versions.

I think the list should be:

dialects[0] = SMB21_DIALECT_REVISION;
dialects[1] = SMB2_DIALECT_REVISION;
dialects[2] = 0;

If we want SMB21_DIALECT_REVISION.

   req = smb2_negprot_send(transport, state-negprot);
 diff --git a/source4/libcli/smb2/smb2.h b/source4/libcli/smb2/smb2.h
 index d1d5b84..3cc3ec2 100644
 --- a/source4/libcli/smb2/smb2.h
 +++ b/source4/libcli/smb2/smb2.h
 @@ -35,6 +35,7 @@ struct smb2_negotiate {
   NTTIME system_time;
   NTTIME server_start_time;
   uint16_t security_mode;
 + uint16_t dialect_revision;
  };
  
  /* this is the context for the smb2 transport layer */
 @@ -226,8 +227,9 @@ struct smb2_request {
  
  #define SMB2_MAGIC 0x424D53FE /* 0xFE 'S' 'M' 'B' */
  
 -/* the dialect we support */
 +/* the dialects we support */
  #define SMB2_DIALECT_REVISION   0x202
 +#define SMB21_DIALECT_REVISION  0x210
  
  /* SMB2 negotiate security_mode */
  #define SMB2_NEGOTIATE_SIGNING_ENABLED   0x01
 diff --git a/source4/libcli/util/nterr.c b/source4/libcli/util/nterr.c
 index 4e7cdf5..7f544b5 100644
 --- a/source4/libcli/util/nterr.c
 +++ b/source4/libcli/util/nterr.c
 @@ -549,6 +549,7 @@ static const nt_err_code_struct nt_errs[] =
   { NT_STATUS_OBJECTID_NOT_FOUND, NT_STATUS_OBJECTID_NOT_FOUND },
   { NT_STATUS_DOWNGRADE_DETECTED, NT_STATUS_DOWNGRADE_DETECTED },
   { NT_STATUS_DS_BUSY, NT_STATUS_DS_BUSY },
 + { XXX_INVALID_RANGE, NT_STATUS_WIN7_INVALID_RANGE },

Could you please fix this, and let us display the correct name?

metze



signature.asc
Description: OpenPGP digital signature

[SCM] Samba Shared Repository - branch master updated - release-4-0-0alpha7-523-g93c2057

2009-03-18 Thread Stefan Metzmacher

The branch, master has been updated
   via  93c2057c8b5a3976cda65a9d27dc4dbb9c5c550a (commit)
   via  3b8dd79f2bc775ed94130565ec2c4383a4864348 (commit)
   via  0685031ccfc09feb0ad070df1c1a1d0cef5874f2 (commit)
   via  450252d2a1981fb04eb62eb095c1b762a96f7727 (commit)
   via  b659daf81f31678f7447545d015bd9d1db8811b9 (commit)
   via  339ea0503d5ce3bf85cf61528956345c73c668c6 (commit)
   via  445b37f4f35ff4256c46dbacc2d3b3a1e47e62b2 (commit)
  from  cd7f62ab70337ccee7ba652e7d9ed8d299938bff (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 93c2057c8b5a3976cda65a9d27dc4dbb9c5c550a
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 17:27:30 2009 +0100

s3:winbindd: accept new connections via fd events

metze

commit 3b8dd79f2bc775ed94130565ec2c4383a4864348
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 16:14:20 2009 +0100

s3:winbindd: move non event related code out of process_loop() in the the 
caller

metze

commit 0685031ccfc09feb0ad070df1c1a1d0cef5874f2
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 16:06:12 2009 +0100

s3:winbindd: remove unused close_winbindd_socket() function

metze

commit 450252d2a1981fb04eb62eb095c1b762a96f7727
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 15:55:39 2009 +0100

s3:smbd: use tevent_loop_once() in the parent event loop

metze

commit b659daf81f31678f7447545d015bd9d1db8811b9
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 15:47:57 2009 +0100

s3:printing: use tevent_loop_wait() instead of manual looping

metze

commit 339ea0503d5ce3bf85cf61528956345c73c668c6
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 14:56:11 2009 +0100

s3:printing: use a fd event to monitor the pipe to the parent

metze

commit 445b37f4f35ff4256c46dbacc2d3b3a1e47e62b2
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Mar 16 14:48:40 2009 +0100

s3:smbd: don't exit the parent when we have no connections

This code path can't really happen anymore, because
launchd support was removed with commit 
e5a951325a6cac8567af3a66de6d2df577508ae4.
But it's confusing to have that code there...

metze

---

Summary of changes:
 source3/printing/printing.c   |   82 ++--
 source3/smbd/server.c |   46 +
 source3/winbindd/winbindd.c   |  195 +++--
 source3/winbindd/winbindd_proto.h |1 -
 source3/winbindd/winbindd_util.c  |   18 
 5 files changed, 155 insertions(+), 187 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index 71c6344..8524cfb 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -1387,6 +1387,18 @@ static void print_queue_receive(struct messaging_context 
*msg,
return;
 }
 
+static void printing_pause_fd_handler(struct tevent_context *ev,
+ struct tevent_fd *fde,
+ uint16_t flags,
+ void *private_data)
+{
+   /*
+* If pause_pipe[1] is closed it means the parent smbd
+* and children exited or aborted.
+*/
+   exit_server_cleanly(NULL);
+}
+
 static pid_t background_lpq_updater_pid = -1;
 
 /
@@ -1415,6 +1427,9 @@ void start_background_queue(void)
}
 
if(background_lpq_updater_pid == 0) {
+   struct tevent_fd *fde;
+   int ret;
+
/* Child. */
DEBUG(5,(start_background_queue: background LPQ thread 
started\n));
 
@@ -1440,60 +1455,21 @@ void start_background_queue(void)
messaging_register(smbd_messaging_context(), NULL,
   MSG_PRINTER_UPDATE, print_queue_receive);
 
-   DEBUG(5,(start_background_queue: background LPQ thread waiting 
for messages\n));
-   while (1) {
-   fd_set r_fds, w_fds;
-   int ret;
-   struct timeval to;
-   int maxfd = 0;
-
-   /* Process a signal and timed events now... */
-   if (run_events(smbd_event_context(), 0, NULL, NULL)) {
-   continue;
-   }
-
-   to.tv_sec = SMBD_SELECT_TIMEOUT;
-   to.tv_usec = 0;
-
-   /*
-* Setup the select fd sets.
-*/
-
-   FD_ZERO(r_fds);
-   FD_ZERO(w_fds);
-
-   /*
-* Are there any timed

78 matches

Mail list logo