Hey.
I'm trying to move my existing MS-AD over to SAMBA, the place I'm
working for is changing all servers from MS to Debian, but all the
clients is still a mixed environment for now.
We have MAC, *NIX, and Windows clients, so its imported that everything
keeps running in the same or almost the same way as before the change but.
When I try to join a Windows Vista Ultimate ore Windows XP Pro to the
domain it takes 30 sec and then it says "The machine account dos not
exist" but as I understand that is what
"add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u"" has to
do right ?
I have pasted my config + log from OpenLDAP and SAMBA, can anybody see
what I have don wrung
# cat /etc/samba/smb.conf
-------------------------
# Defining domain name, hostname
####################################################
[global]
workgroup = MY-DOMAIN
netbios name = HDS-Linux - PDC
server string = Debian Samba-PDC %v
name resolve order = host bcast
hosts allow = 192.168.1. 192.168.2. 127.
wins support = yes
# Network settings #
#interfaces = 192.168.5.11
#username map = /etc/samba/smbusers
# Security #
security = ads
realm = MY-DOMAIN
nt acl support = Yes
enable privileges = yes
encrypt passwords = Yes
obey pam restrictions = Yes
password server = my-server.my-domain
#min passwd length = 5
#pam password change = no
# method 1:
#unix password sync = no
#ldap passwd sync = yes
# method 2:
unix password sync = No
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd -u "%u"
passwd chat = "Skift kode: *\n Ny kode*" %n\n "*Gentag ny kode*"
%n\n"
# Log #
log level = 1
syslog = 1
log file = /var/log/samba/samba_my-domain.log
max log size = 100000
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
Dos charset = 850
Unix charset = ISO8859-1
# Logon scripts #
logon script = scripts/logon.bat
logon path = \\%L\profile\%U
logon drive = H:
logon home = \\%L\%u
# Server settings #
time server = Yes
domain logons = Yes
domain master = Yes
os level = 65
preferred master = Yes
# Winbind settings #
winbind use default domain = yes
winbind separator = %
winbind uid = 10000-21000
winbind gid = 10000-21000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/%U
# LDAP settings #
# passdb backend = ldapsam:"ldap://ldap1.company.com
ldap://ldap2.company.com";
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=admin,dc=domain,dc=dk
ldap suffix = dc=domain,dc=dk
ldap group suffix = ou=groups
ldap user suffix = ou=people
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Idmap
idmap uid = 10000-21000
idmap gid = 10000-21000
ldap ssl = No
ldap delete dn = Yes
add user script = /usr/sbin/smbldap-useradd -a -m "%u"
add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user script = /usr/sbin/smbldap-userdel "%u"
delete group script = /usr/sbin/smbldap-groupdel "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%u" "%g"
# printers configuration #
printer admin = @"Print Operators"
load printers = Yes
create mask = 0640
directory mask = 0750
#force create mode = 0640
#force directory mode = 0750
printing = cups
printcap name = cups
deadtime = 10
guest account = nobody
map to guest = Bad User
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
show add printer wizard = yes
; to maintain capital letters in shortcuts in any of the profile
folders:
preserve case = yes
short preserve case = yes
case sensitive = no
[netlogon]
path = /home/netlogon/
browseable = No
read only = yes
[profiles]
comment = Roaming Profiles
#path = /var/lib/samba/profiles
path = /home/profiles
read only = no
writeable = yes
create mask = 0600
directory mask = 0700
browseable = No
guest ok = Yes
profile acls = yes
csc policy = disable
# next line is a great way to secure the profiles
force user = %U
# next line allows administrator to access all profiles
valid users = %U "Domain Admins"
[printers]
comment = Network Printers
printer admin = @"Print Operators"
guest ok = yes
printable = yes
path = /home/spool/
browseable = No
read only = Yes
printable = Yes
print command = /usr/bin/lpr -P%p -r %s
lpq command = /usr/bin/lpq -P%p
lprm command = /usr/bin/lprm -P%p %j
# print command = /usr/bin/lpr -...@%m -P%p -r %s
# lpq command = /usr/bin/lpq -...@%m -P%p
# lprm command = /usr/bin/lprm -...@%m -P%p %j
# lppause command = /usr/sbin/lpc -...@%m hold %p %j
# lpresume command = /usr/sbin/lpc -...@%m release %p %j
# queuepause command = /usr/sbin/lpc -...@%m stop %p
# queueresume command = /usr/sbin/lpc -...@%m start %p
[print$]
path = /home/printers
guest ok = No
browseable = Yes
read only = Yes
valid users = @"Print Operators"
write list = @"Print Operators"
create mask = 0664
directory mask = 0775
[public]
path = /tmp
guest ok = yes
browseable = Yes
writable = yes
[homes]
path = /home/%u
comment = Home Directories
valid users = %u
read only = No
browseable = Yes
create mode = 0750
# tail -200f /var/log/samba/samba_domain.log
--------------------------
[2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202)
WARNING: The "printer admin" option is deprecated
[2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202)
WARNING: The "printer admin" option is deprecated
[2009/08/14 18:22:24, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210)
pdb_get_group_sid: Failed to find Unix account for DomAdmin
[2009/08/14 18:22:24, 1] auth/auth_util.c:make_server_info_sam(562)
User DomAdmin in passdb, but getpwnam() fails!
[2009/08/14 18:22:24, 0] auth/auth_sam.c:check_sam_security(355)
check_sam_security: make_server_info_sam() failed with
'NT_STATUS_NO_SUCH_USER'
[2009/08/14 18:22:47, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210)
pdb_get_group_sid: Failed to find Unix account for DomAdmin
[2009/08/14 18:22:47, 1] auth/auth_util.c:make_server_info_sam(562)
User DomAdmin in passdb, but getpwnam() fails!
[2009/08/14 18:22:47, 0] auth/auth_sam.c:check_sam_security(355)
check_sam_security: make_server_info_sam() failed with
'NT_STATUS_NO_SUCH_USER'
Error: modifications require authentication at
/usr/share/perl5/smbldap_tools.pm line 1083.
[2009/08/14 18:22:48, 0]
passdb/pdb_interface.c:pdb_default_create_user(336)
_samr_create_user: Running the command `/usr/sbin/smbldap-useradd -t 0
-w -i "hds$"' gave 127
[2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202)
WARNING: The "printer admin" option is deprecated
[2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202)
WARNING: The "printer admin" option is deprecated
[2009/08/14 18:23:49, 1] libads/cldap.c:recv_cldap_netlogon(156)
no reply received to cldap netlogon
[2009/08/14 18:23:49, 0] printing/nt_printing.c:nt_printing_init(664)
nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2009/08/14 18:23:49, 0] groupdb/mapping.c:pdb_create_builtin_alias(802)
pdb_create_builtin_alias: Could not add group mapping entry for alias
545 (NT_STATUS_GROUP_EXISTS)
tail -200f /var/log/syslog | grep slapd
--------------------------
Aug 14 18:32:33 hds-linux slapd[4180]: connection_get(20)
Aug 14 18:32:33 hds-linux slapd[4180]: SRCH
"sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0
Aug 14 18:32:33 hds-linux slapd[4180]: 0 15 0
Aug 14 18:32:33 hds-linux slapd[4180]: filter:
(?objectClass=sambaTrustedDomainPassword)
Aug 14 18:32:33 hds-linux slapd[4180]: attrs:
Aug 14 18:32:33 hds-linux slapd[4180]: sambaDomainName
Aug 14 18:32:33 hds-linux slapd[4180]: sambaSID
Aug 14 18:32:33 hds-linux slapd[4180]:
Aug 14 18:32:33 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940]
Aug 14 18:32:33 hds-linux slapd[4180]: send_ldap_result: err=0
matched="" text="value does not conform to assertion syntax"
Aug 14 18:32:46 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: ==> hdb_bind: dn:
cn=admin,dc=domain,dc=dk
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0
matched="" text=""
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "" 0 0
Aug 14 18:33:01 hds-linux slapd[4180]: 0 0 0
Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*)
Aug 14 18:33:01 hds-linux slapd[4180]: attrs:
Aug 14 18:33:01 hds-linux slapd[4180]: supportedControl
Aug 14 18:33:01 hds-linux slapd[4180]:
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0
matched="" text=""
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH
"sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0
Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0
Aug 14 18:33:01 hds-linux slapd[4180]: filter:
(&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN))
Aug 14 18:33:01 hds-linux slapd[4180]: attrs:
Aug 14 18:33:01 hds-linux slapd[4180]:
Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=10
matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value does not
conform to assertion syntax"
Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0
Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0
Aug 14 18:33:01 hds-linux slapd[4180]: filter:
(&(uid=domadmin)(objectClass=sambaSamAccount))
Aug 14 18:33:01 hds-linux slapd[4180]: attrs:
Aug 14 18:33:01 hds-linux slapd[4180]: uid
Aug 14 18:33:01 hds-linux slapd[4180]: uidNumber
Aug 14 18:33:01 hds-linux slapd[4180]: gidNumber
[ ... ]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87]
Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841]
Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0
matched="" text=""
Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14)
Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0
matched="" text=""
Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14)
[ ... ]
Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 modifications:
Aug 14 18:33:25 hds-linux slapd[4180]: ^Ireplace: uidNumber
Aug 14 18:33:25 hds-linux slapd[4180]: ^I^Ione value, length 5
Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=8
matched="" text="modifications require authentication"
Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29)
Aug 14 18:33:35 hds-linux slapd[4180]: connection_get(14)
# net groupmap list
--------------------------
Domain Admins (S-1-5-21-3045805106-2558287267-4023452987-512) -> 512
Domain Users (S-1-5-21-3045805106-2558287267-4023452987-513) -> 513
Domain Guests (S-1-5-21-3045805106-2558287267-4023452987-514) -> 514
Domain Computers (S-1-5-21-3045805106-2558287267-4023452987-515) -> 515
Administrators (S-1-5-32-544) -> 544
Account Operators (S-1-5-32-548) -> 548
Print Operators (S-1-5-32-550) -> 550
Backup Operators (S-1-5-32-551) -> 551
Replicators (S-1-5-32-552) -> 552
Users (S-1-5-32-545) -> 10000
System info:
--------------------------
Debian Lenny 5.0.2
Kernel - 2.6.26-2-xen-686
Samba Version 3.2.5
Winbind Version 3.2.5
OpenLDAP Version 2.4.11
if there is more info you need plz just ask :)
--
Med Venlig Hilsen / Best regards
Henrik Dige Semark
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
