no you don't need winbind, i'm using LDAP + samba + NSS_LDAP.
paste your net command and the error(s) its giving.
Daniel L. Miller wrote:
I've almost got it. I swear I've almost got it (and I've been doing a
lot of swearing lately).
I re-built my PDC, starting from scratch. I'm not using the editposix
extensions anymore - I'm using the smbldap tools as shown (I think) in
the Samba by Example.
I really really thought I did everything right. Obviously I was wrong.
What works - all my workstations and logins. Add/create users, join
workstations to domain. Just about everything.
The last little item - winbind.
I suppose I need to give some vitals:
Samba 3.0.28a.
Samba PDC - no Windows servers, no BDC's, no member servers.
Linux and Windows XP workstations.
OpenLDAP backend with combined Unix and Windows users (using
LDAP-Account Manager).
First question: under this configuration, do I need winbind at all?
If the answer is yes, second question:
wbinfo -t yields checking the trust secret via RPC calls succeeded
wbinfo -u yields Error looking up domain users
The logfile log.wb-AMFESLAN.LOCAL has
[2008/05/27 12:17:40, 1]
rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625)
cli_pipe_validate_current_pdu: RPC fault code
DCERPC_FAULT_OP_RNG_ERROR received from remote machine BUBBA pipe
\lsarpc fnum 0x7169!
logfile log.winbindd-idmap has
[2008/05/27 12:17:40, 1] nsswitch/idmap.c:idmap_init(377)
Initializing idmap domains
[2008/05/27 12:17:40, 0] nsswitch/idmap.c:idmap_init(388)
idmap_init: Ignoring domain AMFESLAN.LOCAL
I should also mention that I can't add the built-in or local groups
using net.
partial output of testparm:
Processing section "[printers]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions
[global]
workgroup = AMFESLAN.LOCAL
realm = AMFESLAN.LOCAL
server string = %h server (Samba, Ubuntu)
map to guest = Bad User
obey pam restrictions = Yes
passdb backend = ldapsam:ldap://localhost
pam password change = Yes
passwd program = /usr/sbin/smbldap-passwd -u %u
passwd chat = *Enter\snew\s*\spassword:* %n\n
*Retype\snew\s*\spassword:* %n\n *all*authentication*tokens*updated*
username map = /etc/samba/smbusers
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
time server = Yes
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=20480
SO_SNDBUF=20480
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
logon script = logon.cmd
logon path = \\%L\profiles\%U\%a
logon drive = U:
logon home =
domain logons = Yes
os level = 64
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = "cn=admin,dc=amfeslan,dc=local"
ldap delete dn = Yes
ldap group suffix = ou=groups
ldap idmap suffix = ou=idmap
ldap machine suffix = ou=machines,ou=users
ldap passwd sync = Yes
ldap suffix = dc=amfeslan,dc=local
ldap ssl = no
ldap user suffix = ou=users
panic action = /usr/share/samba/panic-action %d
idmap backend = ldap:ldap://127.0.0.1
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = Yes
winbind enum groups = Yes
ea support = Yes
profile acls = Yes
veto oplock files = /*.QBW/*.qbw/*.MDB/*.mdb/
dos filemode = Yes
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
guest ok = Yes
printable = Yes
browseable = No
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
