I appreciate the assistance. I am running SuSE 9.3 with the samba and
winbind packages (latest releases). I have configured the krb5.conf to
correspond including the enc types. Here is that output:
[libdefaults]
default_realm = DOMAIN.COM
clockskew = 300
default_tgs_enctypes = rc4-hmac des-cbc-md5
default_tkt_enctypes = rc4-hmac des-cbc-md5
permitted_enctypes = rc4-hmac des-cbc-md5
[realms]
UTAH.EDU = {
kdc = 192.168.0.2
default_domain = domain.com
admin_server = 192.168.0.2
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
}
Really, I have been able to join the machine to the domain as a member
server with the 'security = ads' argument without problem. During that
initial setup process I mapped the server to a specific OU
ex. net ads join -U [EMAIL PROTECTED] "additional_users"
I have attempted to remove the computer object from the AD directory in
an attempt to reset the join to the default OU but this has not worked.
Any help or insight is appreciated.
Brian Moran wrote:
Jason, I missed your previous mails on this, however let me see if I
have this right.
You have a Microsoft Windows Server Domain Controller, running AD; You
want servers to be members of the domain.
Do you want to authenticate DOMAIN users, or linux-local names, against
the AD?
What's the OS that you're using on the linux servers? Unfortunately,
that matters, since some require config of /etc/krb5.conf, some don't.
And it depends on version :-(.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Jason Gerfen
Sent: Wednesday, October 19, 2005 12:28 PM
To: samba-technical@lists.samba.org
Subject: Changing OU to default?
I have posted a few questions in the normal samba lists and have not
recieved an answer, other then to remove the AD object and try again.
Here is what I am trying to accomplish; Using samba as a file server
for users authenticating through kerberos and active directory.
I have followed the samba-howto on samba.org, and here is my smb.conf
[global]
#
# Network configuration
#
server string = doc-odin.domain.com
workgroup = DOMAIN
netbios name = DOC-ODIN
realm = DOMAIN
security = ADS
password server = server.domain.com server2.domain.com
#
# Domain configuation options
#
prefered master = no
local master = no
domain master = no
prefered master = no
domain logons = no
#
# Security options
#
encrypt passwords = yes
update encrypted = yes
password level = 20
#
# Winbind options
#
#
winbind use default domain = no
winbind cache time = 5
winbind separator = /
winbind enum users = no
winbind enum groups = no
winbind nested groups = yes
#
# User/Group mapping options
#
idmap uid = 500-500000
idmap gid = 500-500000
add user script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s
/bin/false -M %u
add machine script = /usr/sbin/useradd -c Machine -d
/var/lib/nobody -s /bin/false %m$
#
# LDAP/AD configuration options
#
passdb backend = ldapsam:LDAP://server2.domain.com
ldap admin dn = "cn=readonly,cn=users,dc=domain,dc=com
ldap user suffix = cn=users
ldap group suffix = ou=groups
ldap suffix = dc=domain,dc=com
ldap delete dn = no
use spnego = yes
#
# Networking options
#
hide unreadable = no
wins support = no
dns proxy = no
interfaces = eth* lo
bind interfaces only = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
hosts deny = 0.0.0.0/0
#
# Miscellaneous options
#
os level = 20
template shell = /bin/false
template homedir = /odin/%D/%U
load printers = no
#
# Logging options
#
log level = 1 ads:5 auth:5 sam:5 rpc:5
I am able to join the domain, I am able to view users, just not the
correct users. I mapped a OU=users when I needed to map the CN=users
(which is the default) and I am not able to run the net ads join -U
[EMAIL PROTECTED] "container/users" without getting an error that
CN=users is not a valid OU. I have already attempted to delete the
server name from active directory and re-joining.
A co-worker and I were talking about everything we could do, and the
only thing that has not been done is using another AD Administrative
user to join the domain with. Any help is appreciated.
--
Jason Gerfen
Student Computing Labs, University Of Utah
[EMAIL PROTECTED]
J. Willard Marriott Library
295 S 1500 E, Salt Lake City, UT 84112-0860
801-585-9810
"My girlfriend threated to
leave me if I went boarding...
I will miss her."
~ DIATRIBE aka FBITKK
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
