date:20091005

[Samba] Sambauser can't use his homeshare but other shares - smb.conf

2009-10-05 Thread Mario Constanti

Ok, here is my smb.conf-File.

 

If i use the [homes]-Section,
I can mount my home-share only if
I first connected to an other share.

 

If I use the [Mario]-Section,
I can mount it on the first run.

 

 

[global]

 

   workgroup = example

   netbios name = mounteverest

   password server = 192.168.2.200

   security = ads

   realm = EXAMPLE.LOCAL

   encrypt passwords = yes

 

   local master =no

   os level = 20

   domain master = no

   preferred master = no

 

   time server = Yes

   keepalive = 30

   create mask = 0740

   directory mask = 0750

   log file = /var/log/samba/log.%m

   log level = 3 passdb:5 auth:10 winbind:2

   nt acl support = yes

 

   winbind separator = +

   idmap backend = idmap_rid:example=1-1

   idmap gid = 1-1

   idmap uid = 1-1

   template shell = /bin/bash

   winbind use default domain = yes

   winbind enum users = yes

   winbind enum groups = yes

# von mario hinzugefuegt um 18:42 am 19.09.09

   winbind nested groups = yes

   wins server = 192.168.2.200

 

# von mario hinzugefuegt um 18:42 am 19.09.09

   template homedir = /data/shares/home/%U

   template shell = /bin/bash

 

#[homes]

#comment = Home Directories

# path = /data/shares/home/%U

# force group = @EXAMPLE+dir_home

#read only = No

#create mask = 0600

#directory mask = 0700

#browseable = No

 

[mario]

path = /data/shares/home/mario

valid users = EXAMPLE+mario

force group = @EXAMPLE+dir_home

read only = No

create mask = 0600

force create mode = 0700

 

 

[nobackup]

path = /data/shares/nobackup

valid users = @EXAMPLE+dir_nobackup

  force group = @EXAMPLE+dir_nobackup

read only = No

create mask = 0750

force create mode = 0770

force directory mode = 0770

 

[public]

path = /data/shares/public

valid users = @EXAMPLE+dir_public

force group = @EXAMPLE+dir_public

read only = No

create mask = 0750

force create mode = 0770

force directory mode = 0770

 

[security]

path = /data/shares/security

valid users = @EXAMPLE+dir_security

force group = @EXAMPLE+dir_security

read only = No

create mask = 0750

force create mode = 0770

force directory mode = 0770

 

 

 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Source Download broken for 3.0.36

2009-10-05 Thread ITPFS oota

On Mon, Oct 05, 2009 at 02:48:28PM +0200, Jens Nissen wrote:
> The source file
> http://download.samba.org/samba/ftp/stable/samba-3.0.36.tar.gz
> is invalid (checksum error).
> Could you please reinstall this file?
> 
> Kind regards,

I download that file,but no error found.

--
--- Oota Toshiya ---  t-oota at dh.jp.nec.com
NEC Systems Software Operations Unit  Shiba,Minato,Tokyo
IT Platform Solutions DivisionJapan,Earth,Solar system
(samba-jp/ldap-jp Staff,mutt-j/samba-jp postmaster)
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] How to bulk add machine accounts during PDC hardware refresh?

2009-10-05 Thread Michael Lueck


Harry Jede wrote:

You need passwd AND shadow for the users, but normaly NOT the hole file.
The system accounts may be different on your new system, so identify the 
min and max uidnumber for regular users and copy only these users. Do 
the same with the shadow file. AND make backups.


Same thing with groups. Identify your min and max gidnumber and copy 
only these groups.


Maybe you need to transform some uid/gid-numbers :-) .


Thanks for speaking up, Harry! :-)

For Samba users (real actual users) there is an entry in passwd and group. I 
would think I can use adduser to set those up, and edit the uid/gid # to match.

For Samba machine users, there seems to be only an entry in passwd, and shadow of course. The password hash appears to be the same hash as other ID's which no one ever logs into. So I would think I 
would be safe hand editing both passwd and shadow to add the machine accounts, and simply copy/paste the password hash that is appropriate for the new server.


Do you see any problems with this course of action?

Sincerely,

--
Michael Lueck
Lueck Data Systems
http://www.lueckdatasystems.com/

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba query for aix 6.1 OS

2009-10-05 Thread William Jojo


Farhan Rafiq wrote:

 Dear All

Could you please let me know if (samba-3.3.6.tar)  samba version is 
compatible for aix version 6.1 ?


  


Where did you get that binary from?


And also if you have doco for configuring it on aix .

Im going to read thru the readme and doco on internet, I presume it is all 
about configuring /etc/smb.conf file :)


  


Well, it depends on how the developer configured it.


Cheers,
Bill



Many Thanks

 Farhan
  


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba as fileserver on Active Directory domain

2009-10-05 Thread Robert LeBlanc

wbinfo needs to work all the time or you will have problems, getent does not
need to (we have enum users and groups to no because we have so many objects
in our AD). I would look at the winbind logs to get an idea of what is wrong
Debian has this at /var/log/samba/log.winbindd. I usually get several
connection reset by peer lines, and some Could not receive trustdoms, but it
seems to recover and retty and things work. What you are looking for is
failure to connect to a server, or trying to connect to a bad server ro
something. It sounds like you are getting close, the last mile is always the
hardest.

Robert LeBlanc
Life Sciences & Undergraduate Education Computer Support
Brigham Young University


On Mon, Oct 5, 2009 at 5:49 PM, Ivan Ordonez  wrote:

>  I was able to set ACL with local username but can't do it on domain
> username or groups.
>
> hostname ~ # getfacl /shared/drive
> getfacl: Removing leading '/' from absolute path names
> # file: shared/drive
> # owner: mylocalusername
> # group: root
> user::rwx
> group::r-x
> other::r-x
> default:user::rwx
> default:group::rwx
> default:other::r-x
>
> When I tried to set ACLs for domain account or groups, it was invalid
> option.
>
> hostname ~ #setfacl -m g:"DOMAIN+Domain Admins":rwx /shared/drive
> setfacl: Option -m: Invalid argument near character 3
>
> hostname ~ #setfacl -m g:"DOMAIN+myusername":rwx /shared/drive
> setfacl: Option -m: Invalid argument near character 3
>
> I believe the drive is mounted and ACL is enable.
>
> hostname ~ # mount
> /dev/hda3 on / type ext3 (rw,noatime,acl)
>
> Here is my /etc/fstab
> /dev/hda3/ext3noatime,acl0 1
>
> What I find odd is running wbinfo and getent command to be very
> inconsistent.  I would sometimes get result and sometimes not.
> hostname ~ # wbinfo -u
> Error looking up domain users
>
> Any other suggestions?
>
> Thanks.
>
>
>
>
>
>
>
>
>
>
> Robert LeBlanc wrote:
>
> Sorry, my bad, 3.3.8 was the security release. It sounds like it is working
> however. As far as ACLs, make sure that ACLs are turned on on your file
> system (mount -o acl for most filesystems) and the make sure you have the
> ACL packages for your distro installed (Debian apt-get install acl). Then
> it's a matter of using the setfacl command like `setfacl -m
> d:u::rwx,u::rwx,d:g::rx,g::rx
> /my/shared/dir.
>
> You can add as many ACLs as you want, remember that the linux default rwx
> perms sets the max for ACL users and groups. If the linux user (owner) ACL
> is rx, then even though an ACL specifies another user with rwx, they will
> only have rx. The second thing to remember is that the default ACL is not
> needed, but if specified will set those ACLs on all new files and
> directories and act much like Windows. If you set the permissions using
> Windows, the default ACL will be set. Thidly, only Linux user and group have
> the file counted against their quota, permissions assigned in ACLs do not
> affect thoes user and groups quotas. Fourtly, some applications are not ACL
> aware, Apache for instance does not look at ACLs on Linux. To check your set
> ACLs, use getfacl /this/is/my/file.
>
> Hope that helps.
>
> Robert LeBlanc
> Life Sciences & Undergraduate Education Computer Support
> Brigham Young University
>
>
> On Mon, Oct 5, 2009 at 2:34 PM, Ivan Ordonez wrote:
>
>> I was able to install 3.3.8 version of Samba.  I am running it now.  I can
>> see shares, but could not write at all.
>>
>> ACL seems simple but I can't get it to work.  Any help or advise would be
>> greatly appreciated.
>>
>> Robert LeBlanc wrote:
>>
>> The changes have not made it into a 3.3.x release yet, 3.3.7 was a
>> security release, ideally 3.3.8 should have the fix. There were quiet a
>> number of configuration changes from 3.0.x to 3.3.x in regards to Active
>> Directory, you may not be able to use you old config without updating some
>> things.
>>
>> Robert LeBlanc
>> Life Sciences & Undergraduate Education Computer Support
>> Brigham Young University
>>
>>
>> On Mon, Oct 5, 2009 at 10:02 AM, Ivan Ordonez wrote:
>>
>>>
>>> I am using Samba version 3.0.36.  When I upgraded to 3.3.7, I got some
>>> "realm" complaints when I run testparm and some "ADS"  related error.  The
>>> 3.3.7 version is masked by Gentoo portage and not sure if it will be
>>> available soon.
>>>
>>> Thanks,
>>> -Ivan
>>>
>>> Robert LeBlanc wrote:
>>>
>>> What version of samba are you using? I submitted a patch to Samba that is
>>> in 3.4.1 and slated for the next version of 3.3.x that fixes the
>>> workgroup/realm thing. It falls back to SPEGO without the patch, but it
>>> takes a little while, the patch speeds things up.
>>>
>>> Robert LeBlanc
>>> Life Sciences & Undergraduate Education Computer Support
>>> Brigham Young University
>>>
>>>
>>> On Fri, Oct 2, 2009 at 11:09 AM, Jonathan Petersson <
>>> jpeters...@garnser.se> wrote:
>>>
 How did you solve the kerberos portion how things, when winbind tries
 to connect to my server the kerberos sessi

Re: [Samba] Samba as fileserver on Active Directory domain

2009-10-05 Thread Ivan Ordonez

I was able to set ACL with local username but can't do it on domain 
username or groups.

hostname ~ # getfacl /shared/drive
getfacl: Removing leading '/' from absolute path names
# file: shared/drive
# owner: mylocalusername
# group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x

When I tried to set ACLs for domain account or groups, it was invalid 
option.

hostname ~ #setfacl -m g:"DOMAIN+Domain Admins":rwx /shared/drive
setfacl: Option -m: Invalid argument near character 3

hostname ~ #setfacl -m g:"DOMAIN+myusername":rwx /shared/drive
setfacl: Option -m: Invalid argument near character 3

I believe the drive is mounted and ACL is enable.

hostname ~ # mount
/dev/hda3 on / type ext3 (rw,noatime,acl)

Here is my /etc/fstab
/dev/hda3/ext3noatime,acl0 1

What I find odd is running wbinfo and getent command to be very 
inconsistent.  I would sometimes get result and sometimes not. 
hostname ~ # wbinfo -u

Error looking up domain users

Any other suggestions?

Thanks.

Robert LeBlanc wrote:
Sorry, my bad, 3.3.8 was the security release. It sounds like it is 
working however. As far as ACLs, make sure that ACLs are turned on on 
your file system (mount -o acl for most filesystems) and the make sure 
you have the ACL packages for your distro installed (Debian apt-get 
install acl). Then it's a matter of using the setfacl command like 
`setfacl -m 
d:u::rwx,u::rwx,d:g::rx,g::rx 
/my/shared/dir.

You can add as many ACLs as you want, remember that the linux default 
rwx perms sets the max for ACL users and groups. If the linux user 
(owner) ACL is rx, then even though an ACL specifies another user with 
rwx, they will only have rx. The second thing to remember is that the 
default ACL is not needed, but if specified will set those ACLs on all 
new files and directories and act much like Windows. If you set the 
permissions using Windows, the default ACL will be set. Thidly, only 
Linux user and group have the file counted against their quota, 
permissions assigned in ACLs do not affect thoes user and groups 
quotas. Fourtly, some applications are not ACL aware, Apache for 
instance does not look at ACLs on Linux. To check your set ACLs, use 
getfacl /this/is/my/file.

Hope that helps.

Robert LeBlanc
Life Sciences & Undergraduate Education Computer Support
Brigham Young University

On Mon, Oct 5, 2009 at 2:34 PM, Ivan Ordonez > wrote:

I was able to install 3.3.8 version of Samba.  I am running it
now.  I can see shares, but could not write at all. 

ACL seems simple but I can't get it to work.  Any help or advise
would be greatly appreciated.

Robert LeBlanc wrote:

The changes have not made it into a 3.3.x release yet, 3.3.7 was
a security release, ideally 3.3.8 should have the fix. There were
quiet a number of configuration changes from 3.0.x to 3.3.x in
regards to Active Directory, you may not be able to use you old
config without updating some things.

Robert LeBlanc
Life Sciences & Undergraduate Education Computer Support
Brigham Young University

On Mon, Oct 5, 2009 at 10:02 AM, Ivan Ordonez
mailto:iordo...@berkeley.edu>> wrote:

I am using Samba version 3.0.36.  When I upgraded to 3.3.7, I
got some "realm" complaints when I run testparm and some
"ADS"  related error.  The 3.3.7 version is masked by Gentoo
portage and not sure if it will be available soon.

Thanks,
-Ivan

Robert LeBlanc wrote:

What version of samba are you using? I submitted a patch to
Samba that is in 3.4.1 and slated for the next version of
3.3.x that fixes the workgroup/realm thing. It falls back to
SPEGO without the patch, but it takes a little while, the
patch speeds things up.

Robert LeBlanc
Life Sciences & Undergraduate Education Computer Support
Brigham Young University

On Fri, Oct 2, 2009 at 11:09 AM, Jonathan Petersson
mailto:jpeters...@garnser.se>> wrote:

How did you solve the kerberos portion how things, when
winbind tries
to connect to my server the kerberos sessions fails as
it tries to
connect with the workgroup instead of the realm.

Thanks

/Jonathan

On Fri, Oct 2, 2009 at 9:36 AM, Ivan Ordonez
mailto:iordo...@berkeley.edu>>
wrote:
>
>
> Jonathan Petersson wrote:
>>
>> Hi Ivan,
>>
>> I'm working on a similar thing but is having some
issues with the
>> kerberos sessions between samba and AD. Is your Samba
server a member
>> of a Win2k8R2 or a Win2k3 domain?
>>
>> Thanks
>>
>> /Jonathan
>>

Re: [Samba] using svn on a samba share

2009-10-05 Thread Jeremy Allison

On Tue, Sep 22, 2009 at 08:19:22AM +0200, Rupert wrote:
> Hello,
> 
> we are trying to mount our webroot folders to a local machine, so that
> developers can programm in a local folder but the site is served on the
> server.
> When we now try to checkout(via svn) the project into this remote share we
> always get a "permission denied".
> My searches on google didnt bring a solution, but some people where saying
> that svn does create and deletes
> some files to fast for samba to keep track.
> We also played with the mount options and the smb.conf, but didnt get it to
> work.
> Does someone have a solutuon for this problem?

Log a bug @ bugzilla.samba.org and add a debug level 10 log
so we can see what is going wrong. Remember to test first
with the latest version of Samba (3.4.2).

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba as fileserver on Active Directory domain

2009-10-05 Thread Robert LeBlanc

Sorry, my bad, 3.3.8 was the security release. It sounds like it is working
however. As far as ACLs, make sure that ACLs are turned on on your file
system (mount -o acl for most filesystems) and the make sure you have the
ACL packages for your distro installed (Debian apt-get install acl). Then
it's a matter of using the setfacl command like `setfacl -m
d:u::rwx,u::rwx,d:g::rx,g::rx
/my/shared/dir.

You can add as many ACLs as you want, remember that the linux default rwx
perms sets the max for ACL users and groups. If the linux user (owner) ACL
is rx, then even though an ACL specifies another user with rwx, they will
only have rx. The second thing to remember is that the default ACL is not
needed, but if specified will set those ACLs on all new files and
directories and act much like Windows. If you set the permissions using
Windows, the default ACL will be set. Thidly, only Linux user and group have
the file counted against their quota, permissions assigned in ACLs do not
affect thoes user and groups quotas. Fourtly, some applications are not ACL
aware, Apache for instance does not look at ACLs on Linux. To check your set
ACLs, use getfacl /this/is/my/file.

Hope that helps.

Robert LeBlanc
Life Sciences & Undergraduate Education Computer Support
Brigham Young University


On Mon, Oct 5, 2009 at 2:34 PM, Ivan Ordonez  wrote:

>  I was able to install 3.3.8 version of Samba.  I am running it now.  I can
> see shares, but could not write at all.
>
> ACL seems simple but I can't get it to work.  Any help or advise would be
> greatly appreciated.
>
>
> Robert LeBlanc wrote:
>
> The changes have not made it into a 3.3.x release yet, 3.3.7 was a security
> release, ideally 3.3.8 should have the fix. There were quiet a number of
> configuration changes from 3.0.x to 3.3.x in regards to Active Directory,
> you may not be able to use you old config without updating some things.
>
> Robert LeBlanc
> Life Sciences & Undergraduate Education Computer Support
> Brigham Young University
>
>
> On Mon, Oct 5, 2009 at 10:02 AM, Ivan Ordonez wrote:
>
>>
>> I am using Samba version 3.0.36.  When I upgraded to 3.3.7, I got some
>> "realm" complaints when I run testparm and some "ADS"  related error.  The
>> 3.3.7 version is masked by Gentoo portage and not sure if it will be
>> available soon.
>>
>> Thanks,
>> -Ivan
>>
>> Robert LeBlanc wrote:
>>
>> What version of samba are you using? I submitted a patch to Samba that is
>> in 3.4.1 and slated for the next version of 3.3.x that fixes the
>> workgroup/realm thing. It falls back to SPEGO without the patch, but it
>> takes a little while, the patch speeds things up.
>>
>> Robert LeBlanc
>> Life Sciences & Undergraduate Education Computer Support
>> Brigham Young University
>>
>>
>> On Fri, Oct 2, 2009 at 11:09 AM, Jonathan Petersson <
>> jpeters...@garnser.se> wrote:
>>
>>> How did you solve the kerberos portion how things, when winbind tries
>>> to connect to my server the kerberos sessions fails as it tries to
>>> connect with the workgroup instead of the realm.
>>>
>>> Thanks
>>>
>>> /Jonathan
>>>
>>> On Fri, Oct 2, 2009 at 9:36 AM, Ivan Ordonez 
>>> wrote:
>>> >
>>> >
>>> > Jonathan Petersson wrote:
>>> >>
>>> >> Hi Ivan,
>>> >>
>>> >> I'm working on a similar thing but is having some issues with the
>>> >> kerberos sessions between samba and AD. Is your Samba server a member
>>> >> of a Win2k8R2 or a Win2k3 domain?
>>> >>
>>> >> Thanks
>>> >>
>>> >> /Jonathan
>>> >>
>>> >> On Fri, Oct 2, 2009 at 9:00 AM, Ivan Ordonez 
>>> >> wrote:
>>> >>
>>> >>>
>>> >>> Robert LeBlanc wrote:
>>> >>>
>>> 
>>>  What are the permissions on /shared/drive? We use ACLs to control
>>> access
>>>  rather than smb.conf. This gives us great flexability and you can
>>> kind
>>>  of
>>>  manage it using a Windows machine. If you have Kerberos keytab
>>>  generated,
>>>  you can smbmount on Linux using the -o sec=krb5 and no passwords are
>>>  needed,
>>>  it also obeys ACL. The only catch is that you need to use RID or
>>> LDAP
>>>  for
>>>  uid/gid mapping or else your permissions won't line up.
>>> 
>>>  Robert LeBlanc
>>>  Life Sciences & Undergraduate Education Computer Support
>>>  Brigham Young University
>>> 
>>> 
>>>  On Thu, Oct 1, 2009 at 10:14 AM, Ivan Ordonez <
>>> iordo...@berkeley.edu
>>>  > wrote:
>>> 
>>>    Hello,
>>> 
>>>    We have a Gentoo box running Samba and is a member of the Active
>>>    Directory domain. This Gentoo box will be a fileserver when
>>>    everything is completed and setup as it should.  I want our users
>>>    to login to their computer (Computers are all members of the same
>>>    Active Directory domain) using Active Directory accounts/domain
>>>    for authentication. I am using Winbind for Active Directory
>>>    authentication/integration. I'm almost done except file permission
>>>    issue.  All is working

[Samba] Samba Authentication with a windows password server

2009-10-05 Thread wispa

Hi all,

I'm trying to set up Samba on a client's computer so that it authenticates
the users which are accessing it via a windows domain controller and
kerberos. I've been following various tutorials and it all seems to go
through correctly but when the client tries to access the shares, it doesn't
accept his credentials and won't get past the login window.

The only failure seems to be within the nmbd log which says this (I've
changed the domain name / IPs):

[2009/10/05 16:27:43, 0]
nmbd/nmbd_nameregister.c:register_name_response(129)
register_name_response: server at IP 192.168.1.122 rejected our name
registration of DOMAIN<00> IP 192.168.1.120 with error code 6.
[2009/10/05 16:27:43, 0] nmbd/nmbd_mynames.c:my_name_register_failed(35)
my_name_register_failed: Failed to register my name DOMAIN<00> on subnet
192.168.1.120.

Now the odd thing is that 192.168.1.120 is the samba machine but
192.168.1.120 is a proxy server and doesn't seem to be referenced anywhere.
Could this be a result of the windows machines not being set up correctly or
would this be something incorrectly set up on the linux machine?

I can't seem to figure it out.

Many thanks.

Oliver
--
View this message in context:
http://www.nabble.com/Samba-Authentication-with-a-windows-password-server-tp25752970p25752970.html
Sent from the Samba - General mailing list archive at Nabble.com.

71 matches

Mail list logo