MaTT wrote:
daniel, increase the log level and check if the information provided give any helpthis is what i get from the log level, i have even mapped my domain admin group to a posixGroup called root with gidNumber=0, also set the user gidnumber to 0 and also added them to domain admin group, the only way it works is if i set the uidNumber =0 which isnt acceptable inour environment. This is loglevel =2
MRB http://www.lionix.com Linux Daniel Wilson wrote:
MaTT wrote:
ive tried to set GID to 0 to an account, but i get unkwon username or password error when i try to add it, if i use administrtor adding is successful! ????Hi Daniel... this is from the Samba Docs... will help
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him root access. How can we do this?
Users who are members of the Domain Admins group can add machines to the Domain. This group is mapped to the UNIX group account called root (or equivalent on wheel on some UNIX systems) that has a GID of 0. This must be the primary GID of the account of the user who is a member of the Windows Domain Admins account.
MRB http://www.lionix.com Linux
Daniel Wilson wrote:
hi list,
im using samba 3.0.8 with LDAP,
To add a machine to the domain i currently use the administrator account (which has uidNumber=0), which means this account has automatic root on all of the shares (my shares arnt using samba, im using NetApps Filers, which have been configured to authenticate via samba), when we roll this project out accross the university (approx 50,000 users) we want the technicians in each school to be able to add machines to the domain but not get root/admin access to all the shares.
So my question is, Can you create an account that can add machines to the domain but doesnt get root/admin priveldges on all the shares/domain (as the would conflict with human rights issues etc...)
Regards
quigon1:/opt/smbldap-tools-0.8.5 # tail -n 0 -f /usr/local/var/log.smbd | more
[2004/11/18 11:43:07, 2] lib/smbldap.c:smbldap_search_domain_info(1374)
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=UNI-STAFF))]
[2004/11/18 11:43:07, 2] lib/smbldap.c:smbldap_open_connection(693)
smbldap_open_connection: connection opened
[2004/11/18 11:43:07, 2] smbd/sesssetup.c:setup_new_vc_session(608)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2004/11/18 11:43:07, 2] smbd/sesssetup.c:setup_new_vc_session(608)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2004/11/18 11:43:07, 2] passdb/pdb_ldap.c:init_sam_from_ldap(511)
init_sam_from_ldap: Entry found for user: ws0dwi
[2004/11/18 11:43:07, 2] passdb/pdb_ldap.c:init_group_from_ldap(2011)
init_group_from_ldap: Entry found for group: 0
[2004/11/18 11:43:07, 2] passdb/pdb_ldap.c:init_group_from_ldap(2011)
init_group_from_ldap: Entry found for group: 901
[2004/11/18 11:43:07, 2] auth/auth.c:check_ntlm_password(305)
check_ntlm_password: authentication for user [ws0dwi] -> [ws0dwi] -> [ws0dwi]
succeeded
[2004/11/18 11:43:08, 2] rpc_server/srv_samr_nt.c:_samr_lookup_domain(2487)
Returning domain sid for domain UNI-STAFF -> S-1-5-21-82148923-2461359520-1342
846908
[2004/11/18 11:43:08, 2] rpc_server/srv_samr_nt.c:access_check_samr_object(93)
_samr_open_domain: ACCESS DENIED (requested: 0x00000211)
[2004/11/18 11:43:08, 2] rpc_server/srv_samr_nt.c:_samr_lookup_domain(2487)
Returning domain sid for domain UNI-STAFF -> S-1-5-21-82148923-2461359520-1342
846908
[2004/11/18 11:43:08, 2] rpc_server/srv_samr_nt.c:access_check_samr_function(115
)
_samr_create_user: ACCESS DENIED (granted: 0x00000201; required: 0x00000010)
[2004/11/18 11:43:08, 2] smbd/server.c:exit_server(571)
Closing connections
[2004/11/18 11:43:09, 2] lib/smbldap.c:smbldap_search_domain_info(1374)
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=UNI-STAFF))]
[2004/11/18 11:43:09, 2] lib/smbldap.c:smbldap_search_domain_info(1374)
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=UNI-STAFF))]
[2004/11/18 11:43:09, 2] lib/smbldap.c:smbldap_open_connection(693)
smbldap_open_connection: connection opened
[2004/11/18 11:43:09, 2] lib/smbldap.c:smbldap_open_connection(693)
smbldap_open_connection: connection opened
[2004/11/18 11:43:09, 2] smbd/sesssetup.c:setup_new_vc_session(608)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2004/11/18 11:43:09, 2] smbd/reply.c:reply_special(235)
netbios connect: name1=QUIGON1 name2=D-CONWAY-LAP
[2004/11/18 11:43:09, 2] smbd/reply.c:reply_special(242)
netbios connect: local=quigon1 remote=d-conway-lap, name type = 0
[2004/11/18 11:43:09, 2] smbd/sesssetup.c:setup_new_vc_session(608)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2004/11/18 11:43:09, 2] smbd/server.c:exit_server(571)
Closing connections
[2004/11/18 11:43:09, 2] passdb/pdb_ldap.c:init_sam_from_ldap(511)
init_sam_from_ldap: Entry found for user: ws0dwi
[2004/11/18 11:43:09, 2] passdb/pdb_ldap.c:init_group_from_ldap(2011)
init_group_from_ldap: Entry found for group: 0
[2004/11/18 11:43:09, 2] passdb/pdb_ldap.c:init_group_from_ldap(2011)
init_group_from_ldap: Entry found for group: 901
[2004/11/18 11:43:09, 2] auth/auth.c:check_ntlm_password(305)
check_ntlm_password: authentication for user [ws0dwi] -> [ws0dwi] -> [ws0dwi]
succeeded
[2004/11/18 11:43:11, 2] smbd/server.c:exit_server(571)
Closing connections
-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Daniel Wilson Systems Administrator
IT & Communications Service University of Sunderland Unit1 Technology Park Chester Road Sunderland SR2 7PT
Tel: 0191 515 2695
This e-mail contains information which is confidential and may be privileged and is for the exclusive use of the recipient. It is the responsibility of the recipient to ensure that this message and its attachments are virus free. Any views or opinions presented are solely those of the author and do not necessarily represent those of the University, unless otherwise specifically
stated.
-- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
