Hi Everyone
I installed a samba PDC on opensuse 11.1 with:
samba-winbind-3.4.2-2.1
samba-client-3.4.2-2.1
samba-3.4.2-2.1
openldap2-2.4.12-5.5.1
openldap2-client-2.4.12-5.3
perl-ldap-0.39-14.1
nss_ldap-262-10.12
smbldap-tools-0.9.5-3.1
pam_ldap-184-144.12
It runs perfectly with win xp professional and vista business domain clients.
The problem is that when I update any member of a certain domain group (let say
by adding or
removing a user from a group) on samba PDC; these changes don't update
on win clients until samba and winbind services are restarted.
For instance let say that group: grupo3 (which has user: usuario3 as member)
have full
control on this shared directory:
//bar/Documents (on linux domain server)
when I tried to access from linux using user: Fernando2
I got expected results:
bar:/data # smbclient //bar/Documents -U Fernando2%fernando2
Domain=[FOOBAR] OS=[Unix] Server=[Samba 3.4.2-2.1-2229-SUSE-CODE11]
tree connect failed: NT_STATUS_ACCESS_DENIED
Same results if I tried to access from Fernando2 winxp joined to the domain.
All these results are right.
But problems comes when I include user: Fernando2 to group: grupo3 so
group3 now has 2 members: usuario3 and Fernando2
>From linux works great:
bar:/data # smbclient //bar/Documents -U Fernando2%fernando2
Domain=[FOOBAR] OS=[Unix] Server=[Samba 3.4.2-2.1-2229-SUSE-CODE11]
smb: \> mkdir mydir
smb: \> ls
. D 0 Wed Nov 11 17:52:32 2009
.. D 0 Wed Nov 11 17:49:30 2009
mydir D 0 Wed Nov 11 17:52:32 2009
36381 blocks of size 131072. 16831 blocks available
smb: \>
but from windows xp called Fernando2 still can't access the shared folder
until samba and winbind services are restarted
I tried reload services but didn't work, I also have wait 30 minutes but no
update was done.
Is there a command to send all group changes to win clients from linux?
Is a missed parameter?
is this a feature not implemented?
Thanks in advance
Fernando Torrez
my smb.conf file: testparm -sv
[global]
dos charset = CP850
unix charset = utf8
display charset = LOCALE
workgroup = FOOBAR
realm =
netbios name = BAR
netbios aliases =
netbios scope =
server string = bar
interfaces = eth1, lo
bind interfaces only = Yes
security = USER
auth methods =
encrypt passwords = Yes
update encrypted = No
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
map to guest = Never
null passwords = No
obey pam restrictions = No
password server = *
smb passwd file = /etc/samba/smbpasswd
private dir = /etc/samba
passdb backend = ldapsam:ldap://bar.foobar.tld
algorithmic rid base = 1000
root directory =
guest account = nobody
enable privileges = Yes
pam password change = No
passwd program =
passwd chat = *new*password* %n\n *new*password* %n\n *changed*
passwd chat debug = No
passwd chat timeout = 2
check password script =
username map = /etc/samba/smbusers
password level = 0
username level = 0
unix password sync = No
restrict anonymous = 0
lanman auth = No
ntlm auth = Yes
client NTLMv2 auth = No
client lanman auth = No
client plaintext auth = No
preload modules =
dedicated keytab file =
kerberos method = default
map untrusted to domain = No
log level = 10
syslog = 0
syslog only = No
log file = /var/log/samba/%m
max log size = 50
debug timestamp = Yes
debug prefix timestamp = No
debug hires timestamp = No
debug pid = No
debug uid = No
debug class = No
enable core files = Yes
smb ports = 139
large readwrite = Yes
max protocol = NT1
min protocol = CORE
min receivefile size = 0
read raw = Yes
write raw = Yes
disable netbios = No
reset on zero vc = No
acl compatibility = auto
defer sharing violations = Yes
nt pipe support = Yes
nt status support = Yes
announce version = 4.9
announce as = NT
max mux = 50
max xmit = 16644
name resolve order = wins bcast hosts
max ttl = 259200
max wins ttl = 518400
min wins ttl = 21600
time server = Yes
unix extensions = Yes
use spnego = Yes
client signing = auto
server signing = No
client use spnego = Yes
client ldap sasl wrapping = plain
enable asu support = No
svcctl list =
deadtime = 0
getwd cache = Yes
keepalive = 300
lpq cache time = 30
max smbd processes = 0
paranoid server security = Yes
max disk size = 0
max open files = 1024
socket options = TCP_NODELAY
use mmap = Yes
hostname lookups = No
name cache timeout = 660
ctdbd socket =
cluster addresses =
clustering = No
load printers = Yes
printcap cache time = 750
printcap name = CUPS
cups server =
cups connection timeout = 30
iprint server =
disable spoolss = No
addport command =
enumports command =
addprinter command =
deleteprinter command =
show add printer wizard = No
os2 driver map =
mangling method = hash2
mangle prefix = 1
max stat cache size = 256
stat cache = Yes
machine password timeout = 604800
add user script = /usr/sbin/smbldap-useradd -m "%u"
rename user script =
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
shutdown script =
abort shutdown script =
username map script =
logon script = logon.bat
logon path =
logon drive =
logon home =
domain logons = Yes
init logon delayed hosts =
init logon delay = 100
os level = 65
lm announce = Auto
lm interval = 60
preferred master = Yes
local master = Yes
domain master = Yes
browse list = Yes
enhanced browsing = Yes
dns proxy = Yes
wins proxy = No
wins server =
wins support = Yes
wins hook =
kernel oplocks = Yes
lock spin time = 200
oplock break wait time = 0
ldap admin dn = cn=Manager,dc=foobar,dc=tld
ldap delete dn = Yes
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=Computers
ldap passwd sync = no
ldap replication sleep = 1000
ldap suffix = dc=foobar,dc=tld
ldap ssl = no
ldap ssl ads = No
ldap timeout = 15
ldap connection timeout = 2
ldap page size = 1024
ldap user suffix = ou=Users
ldap debug level = 0
ldap debug threshold = 10
eventlog list =
add share command =
change share command =
delete share command =
preload =
lock directory = /var/lib/samba
state directory = /var/lib/samba
cache directory = /var/lib/samba
pid directory = /var/run/samba
utmp directory =
wtmp directory =
utmp = No
default service =
message command =
get quota command =
set quota command =
remote announce =
remote browse sync =
socket address = 0.0.0.0
homedir map = auto.home
afs username map =
afs token lifetime = 604800
log nt token command =
time offset = 0
NIS homedir = No
registry shares = No
usershare allow guests = No
usershare max shares = 0
usershare owner only = Yes
usershare path = /var/lib/samba/usershares
usershare prefix allow list =
usershare prefix deny list =
usershare template share =
panic action =
perfcount module =
host msdfs = Yes
passdb expand explicit = No
idmap backend = ldap:ldap://bar.foobar.tld
idmap alloc backend =
idmap cache time = 604800
idmap negative cache time = 120
idmap uid = 10000-20000
idmap gid = 10000-20000
template homedir = /home/%D/%U
template shell = /bin/false
winbind separator = \
winbind cache time = 300
winbind reconnect delay = 30
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = No
winbind trusted domains only = No
winbind nested groups = Yes
winbind expand groups = 1
winbind nss info = template
winbind refresh tickets = No
winbind offline logon = No
winbind normalize names = No
winbind rpc only = No
comment =
path =
username =
invalid users =
valid users =
admin users =
read list =
write list =
printer admin =
force user =
force group =
read only = Yes
acl check permissions = Yes
acl group control = Yes
acl map full control = Yes
create mask = 0744
force create mode = 00
security mask = 0777
force security mode = 00
directory mask = 0755
force directory mode = 00
directory security mask = 0777
force directory security mode = 00
force unknown acl user = No
inherit permissions = No
inherit acls = No
inherit owner = No
guest only = No
administrative share = No
guest ok = No
only user = No
hosts allow =
hosts deny =
allocation roundup size = 1048576
aio read size = 0
aio write size = 0
aio write behind =
ea support = No
nt acl support = Yes
profile acls = No
map acl inherit = Yes
afs share = No
smb encrypt = auto
block size = 1024
change notify = Yes
directory name cache size = 100
kernel change notify = Yes
max connections = 0
min print space = 0
strict allocate = No
strict sync = No
sync always = No
use sendfile = No
write cache size = 0
max reported print jobs = 0
max print jobs = 1000
printable = No
printing = cups
cups options =
print command =
lpq command = %p
lprm command =
lppause command =
lpresume command =
queuepause command =
queueresume command =
printer name =
use client driver = No
default devmode = Yes
force printername = No
printjob username = %U
default case = lower
case sensitive = Auto
preserve case = Yes
short preserve case = Yes
mangling char = ~
hide dot files = Yes
hide special files = No
hide unreadable = Yes
hide unwriteable files = No
delete veto files = No
veto files =
hide files =
veto oplock files =
map archive = Yes
map hidden = No
map system = No
map readonly = yes
mangled names = Yes
store dos attributes = No
dmapi support = No
browseable = Yes
access based share enum = No
browsable = Yes
blocking locks = Yes
csc policy = manual
fake oplocks = No
locking = Yes
oplocks = Yes
level2 oplocks = Yes
oplock contention limit = 2
posix locking = Yes
strict locking = Auto
share modes = Yes
dfree cache time = 0
dfree command =
copy =
preexec =
preexec close = No
postexec =
root preexec =
root preexec close = No
root postexec =
available = Yes
volume =
fstype = NTFS
set directory = No
wide links = Yes
follow symlinks = Yes
dont descend =
magic script =
magic output =
delete readonly = No
dos filemode = No
dos filetimes = Yes
dos filetime resolution = No
fake directory create times = No
vfs objects =
msdfs root = No
msdfs proxy =
[homes]
comment = Home Directories
valid users = %S, %D%w%S
read only = No
create mask = 0600
directory mask = 0700
inherit acls = Yes
browseable = No
browsable = No
[printers]
comment = SMB Print Spool
path = /var/spool/samba
guest ok = Yes
printable = Yes
browseable = No
browsable = No
[sysvol]
path = /data/samba/sysvol
read only = No
[netlogon]
comment = Network Logon Service
path = /data/samba/sysvol/foobar.tld/scripts
read only = No
guest ok = Yes
browseable = No
browsable = No
locking = No
[profiles]
path = /data/samba/profiles
read only = No
create mask = 0777
directory mask = 0777
guest ok = Yes
profile acls = Yes
browseable = No
browsable = No
csc policy = disable
[Documents]
comment = share to test samba
path = /data/documents
valid users = @grupo3
read only = No
[sys]
path = /data/sys
read only = No
inherit permissions = Yes
guest ok = Yes
dos filemode = Yes
[RegLPZ]
path = /data/RegLPZ
read only = No
inherit permissions = Yes
guest ok = Yes
dos filemode = Yes
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = root, chrisr
_________________________________________________________________
Windows Live Hotmail: Your friends can get your Facebook updates, right from
Hotmail®.
http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_4:092009
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
