I consolidated group entries as described in the previous post.
By mistake, I initially set same SID for the "Domain Users" and "Domain
Guests." So "net rpc user info someuser" would display the wrong
output. I fixed this but had to my Samba 3.0.x BDC to get the update to
stick. I also zapped all the *cache*.tdb files on that machine, which
may have been a mistake.
Initially the Samba 3.0.x BDC would not start. smb.conf had the "guest
account = nobody" entry, which had worked in the past. However, the
error logs that "nobody" no longer existed. I had to create an
ldap/samba "smb_nobody" user and group and update smb.conf for "guest
account = smb_nobody." At that point samba would start, however, I
could not view or access either the samba server in network
neighborhood, or access any shares via "net use..." or "smbclient ..."
For the moment, I have reverted to the earlier smb.conf and disabled
samba 3.4.x. My guess is that samba choked on loading groups that did
not have a proper SID. I have about 230 unix/ldap groups and didn't
want to have to create an explicit group mapping (SID entry) for each group.
On 11/25/09 22:42, Gaiseric Vandal wrote:
I think I have found the problem:
Samba 3.0.x looks for group mappings in the "ldap group suffix" param. On
my systems this is "ldap group suffix = ou=smb_groups." Regular unix
groups are just in ou=groups. Initially we had used NIS (then LDAP) for
unix groups, and had used tdbsam for the samba account backend. Group
mappings were also in tdb. When we moved to ldap backend, group mappings
were imported into ou=smb_groups.
Samba 3.4.x reads thru the entire ldap tree. Since I have both
"cn=Domain Administrators,ou=smb_groups" and "cn=smb_domadmins,ou=group"
both with the same gidNumber, group membership processing fails.
Therefore I think the solution will be to consolidate entries. For
example,
Replace cn=smb_domadmins,ou=group" with "cn=Domain
Administrators,ou=group"
Copy the sambaSID from "cn=Domain Administrators,ou=smb_groups" to
"cn=Domain Administrators,ou=group"
Repeat for all the other mapped groups
Update smb.conf on the 3.0.x servers to use "ldap group suffix =
ou=group."
This is assuming of course that Solaris doesn't have problems with group
names with spaces.
-----Original Message-----
From: Gaiseric Vandal [mailto:[email protected]]
Sent: Wednesday, November 25, 2009 10:01 PM
To: [email protected]
Subject: RE: [Samba] samba 3.4.3 DC breaks Windows groups
I have done the following
- Added index for sambaSID and other attributes as per the following
http://wiki.samba.org/index.php/2.0:_Configuring_LDAP
- replaced the samba 3.0 schema file in my LDAP Server (Sun Directory
Server) with the 3.2 version
- installed samba 3.4.3 packages from sun freeware to replace those I
compiled from from source.
- Reindexed with "dsconf reindex -h ldapserver -t sambaSID
o=mydomain.com"
Unfortunately did not resolve the group membership problem (i.e. a user
account only appears to be in its primary group )
Querying the Samba 3.4.x BDC
# net rpc user info Administrator -U Administrator -S BDC2
Enter Administrator's password:
Domain Users
#
Querying the Samba 3.0.x PDC
# net rpc user info Administrator -U Administrator -S PDC
Enter Administrator's password:
Domain Admins
Domain Users
#
As far as I can tell from the comments at the top of each ldif file, the
only change was the addition of sambaTrustedDomainPassword objectClasses.
On 11/25/09 03:41, Jan Wenzel wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Gaiseric Vandal schrieb:
I assume an index is not an actual LDAP attribute or object like
sambaSID but is more like a database index for optimizing searches?
You're right :) But in some cases like substring search (samba searches
i.e. for sambaSID=S-1-5-32-* to get the local groups) they are needed to
get results. I don't know where to configure the indexes exactly in SDS,
but I'm sure it is possible.
I use Sun's Directory Server (LDAP server) as the backend. I use
Apache
Directory Studio for managing objects and attributes with in ldap. I
should be able to use Sun's web-based console for creating the indexes.
Is there something I need to specify in smb.conf to tell Samba to use
the index?
Samba does not know anything about the configuration details of the LDAP
server,
it only talks LDAP - so it should instantly show groups when the index
is present.
I also noticed that if I try to compile samba with Active Directory
support, configure fails with
configure: error: Active Directory support requires ldap_initialize
I would prefer to use the prebuilt linux packages from ftp.sernet.de (if
you have a linux system).
Since sun has ldap client support included in the OS I do not have
openldap installed. I don't need Active Directory but it makes me
suspect that there may be some other ldap compatibility issues when
using Sun ldap client vs Openldap client.
Thanks
HTH
Jan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAksM7Z0ACgkQzaoFHMzBsBplVwCcCCaCYgq87CWuGmjxvpS/ox/k
WdQAn19bryFfw+aWa7TMUZZCzU2UKHsN
=4Old
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
