Re: [Samba] Samba 4.1.0pre1 and problem from creating home users dir from command line

2013-01-04 Thread Andrew Bartlett
rom0 udf,iso9660 user,noauto 0 0 > /dev/fd0/media/floppy0 autorw,user,noauto 0 0 > > Can I use for this mkdir command and next samba-tool ntacl subcommand ? Yes, the samba-tool command only modifies the AD directory, not the filesystem. You certainly could c

Re: [Samba] Samba 3 classicupgrade to Samba AD

2013-01-04 Thread Andrew Bartlett
int. The script is just python however, and so it isn't hard to improve if someone wants to provide a patch to improve it. Max, Your issue might be that what we fill in as CN is a duplicate, rather than the username. Andrew Bartlett -- Andrew Bartletthttp:

[Samba] [PATCH] Re: samba-tool domain classicupgrade with LDAP backend

2013-01-04 Thread Andrew Bartlett
On Fri, 2013-01-04 at 10:18 +0100, Juan Asensio Sánchez wrote: > Hi > > > 2013/1/4 Andrew Bartlett > On Fri, 2013-01-04 at 08:57 +0100, Juan Asensio Sánchez wrote: > > Hi > > > > > > > I forgot t

Re: [Samba] samba-tool domain classicupgrade with LDAP backend

2013-01-04 Thread Andrew Bartlett
subdomain, nor the trust relationships needed between those domains. This remains a future development task. A small amount of support exists for inter-realm trusts, trusts with Samba classic domains and kerberos trusts, but what little support exists here is experimental and undocumented, existi

Re: [Samba] AIX: TypeError: unsupported operand type(s) for +: '_hashlib.HASH' and 'str'

2013-01-03 Thread Andrew Bartlett
I'll try that next if I can't get the waf system to > work. > Anyone have any insight as to what we might be hanging up on? > > Many many thanks in advance!! I think the next step is to change your python install to something as close to the upstream python as possible. We s

Re: [Samba] [PATCH] Re: Changing administrator password after Samba4 classic upgrade

2013-01-03 Thread Andrew Bartlett
r configuration: - What was working - What was not working - What you changed - What is now working For your attempt to apply this to your production domain: - What is working - What is not working - What was working but is now not working - What you have attempted to do to fix it Th

Re: [Samba] samba-tool domain classicupgrade with LDAP backend

2013-01-03 Thread Andrew Bartlett
server. We do this in the hope of migrating some extra information that isn't available via passdb. ldb and the idlap driver does not read ldap.conf, nslcd.conf or PAM as Mario suggests, but I'm pretty sure it does use the 'name resolve order' from smb.conf, so perhaps restore th

Re: [Samba] Samba ADDS DC krb5 and samba_nsupdate

2013-01-02 Thread Andrew Bartlett
en your errors, you should check that bind can access the database and dns.keytab correctly. Are you running 9.8 or 9.9? Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscr

Re: [Samba] Samba AD replication on new installation of Samba 4.0

2012-12-31 Thread Andrew Bartlett
s? You might want to try current master, if you are in an experimental mood, as we have some DRS improvements, but otherwise I'm sorry I can't help more. Sorry, Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Sam

Re: [Samba] Core dump trying to join domain on FreeBSD

2012-12-30 Thread Andrew Bartlett
he error certainly does seem to be coming from Heimdal - that error string only exists in Heimdal, not in Samba. If you can run it under valgrind, we might get more of a hint as to why there is invalid memory (I can't think of any other reason why this might fail - a checksum doesn't rea

Re: [Samba] Samba 4 technical documentation

2012-12-29 Thread Andrew Bartlett
the original german translated into english: http://www.samba.org/~metze/presentations/2007/thesis/StefanMetzmacher_Bachelorthesis_ENG_Draft-9811557.pdf I hope these links help, Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Develope

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

2012-12-29 Thread Andrew Bartlett
ing DNS records, but never remove the old ones. What you have done seems reasonable, if you have renamed the site, removing the remaining DNS references seems entirely reasonable. Please file a bug about the left-behind DNS stuff, we really should clean that up. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-29 Thread Andrew Bartlett
On Sat, 2012-12-29 at 19:31 +1300, Pieter De Wit wrote: > On 28/12/2012 10:45, Andrew Bartlett wrote: > > On Fri, 2012-12-28 at 10:30 +1300, Pieter De Wit wrote: > >> On 22/12/2012 14:56, Andrew Bartlett wrote: > >>> On Sat, 2012-12-22 at 14:28 +1300, Pieter De Wit w

Re: [Samba] samba4 dc to adc failover

2012-12-28 Thread Andrew Bartlett
"pass the hat" for anything like this. There are a small number of "FSMO" roles (for things that have to be done on one server) but these should not be needed for simple changes you would be doing during your tests. You will need to start getting some logs and network capt

Re: [Samba] Samba - Kerberos delegation support

2012-12-28 Thread Andrew Bartlett
server. You would also need to find a way to initiate the NFS mount from Samba, and pass it the credentials in the form of a krb5 ccache. In short, it would be a development project, but the code in Samba 4.0 would do it much better than the old code. Andrew Bartlett -- Andrew Bartlett

Re: [Samba] Samba4: ldapcmp incorrectly reporting some attributes as missing on secondary controller

2012-12-28 Thread Andrew Bartlett
On Fri, 2012-12-28 at 12:24 +0100, Dominic Evans wrote: > On 28 December 2012 05:43, Andrew Bartlett wrote: > >> $ sudo samba-tool ldapcmp ldap://windowsdc.exampledn.com > >> ldap://samba4dc.exampledn.com domain --base='CN=ExampleFirstName > >> ExampleS

Re: [Samba] Samba4: ldapcmp incorrectly reporting some attributes as missing on secondary controller

2012-12-27 Thread Andrew Bartlett
s applied incorrectly for non-administrator users, and I need to understand why that is. You can set 'acl:read=false' in your smb.conf to disable this, while we sort out what is going on. This will remove any restriction on any user reading any non-confidential attribute (by the schema flag or being in the list of password attributes). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba AD DC migration and official packages

2012-12-27 Thread Andrew Bartlett
tory of your eventual debian install. I agree that the situation around official packages in all the distributions is frustrating, and I hope we can get a cleaner solution soon. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Develope

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-27 Thread Andrew Bartlett
On Fri, 2012-12-28 at 10:30 +1300, Pieter De Wit wrote: > On 22/12/2012 14:56, Andrew Bartlett wrote: > > On Sat, 2012-12-22 at 14:28 +1300, Pieter De Wit wrote: > >> I stand corrected re the MS comment then. How do I get the > >> userAccountControl? > > userAc

Re: [Samba] Cannot Join Existing Windows 2003 Domain

2012-12-26 Thread Andrew Bartlett
On Tue, 2012-12-25 at 20:42 -0500, Larry Aaronson wrote: > On 12/25/2012 4:28 PM, Andrew Bartlett wrote: > > On Tue, 2012-12-25 at 14:06 -0500, Larry Aaronson wrote: > >> Trying to add a new samba 4 domain controller to an existing Windows > >> 2003 domain. Th

Re: [Samba] Samba, LDAP and replica

2012-12-26 Thread Andrew Bartlett
ome support for the concept of Sites, but it isn't totally complete. So, you may wish to investigate closely to ensure it does enough to avoid swamping your VPN links. I wish you the very best with your upgrade. Feel free to come back with any issues you may have. Thanks, Andrew B

Re: [Samba] New version Samba matrix

2012-12-26 Thread Andrew Bartlett
here is no need and little good reason to share a host, particularly such an old host, between a Samba DC and other services. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubs

Re: [Samba] [PATCH] Re: Samba 4, Winbind & RFC2307

2012-12-26 Thread Andrew Bartlett
On Wed, 2012-12-26 at 21:18 +0100, "Dr. Hansjörg Maurer" wrote: > Hi Andrew > > > Am 26.12.2012 10:54, schrieb Andrew Bartlett: > > > > Attached is an interim patch. Before we get this into master, I need to > > write a series of tests, because having t

Re: [Samba] New version Samba matrix

2012-12-26 Thread Andrew Bartlett
eeds a newer Samba? What version are you currently running and having trouble with? Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the followin

Re: [Samba] samba4 in a Windows workgroup

2012-12-26 Thread Andrew Bartlett
s. I do wish setting up a simple file server was as simple and guided as the provision process is for a Samba 4.0 AD DC, but the link I gave in the other reply is a very good starting point. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authenti

Re: [Samba] Update A Compiled Version

2012-12-26 Thread Andrew Bartlett
n bin and sbin) and the re-install. We handle reading and using the sam.ldb and other files in private/ (and elsewhere) from older versions as a natural part of running the updated version. The WHATSNEW suggests a dbcheck command that can be very helpful. Andrew Bartle

Re: [Samba] Update A Compiled Version

2012-12-26 Thread Andrew Bartlett
re. (There are major issues for all distributions in integrating the whole of Samba 4.0, if the distribution either has an objection to our Heimdal Kerberos bundle or is packaging Samba 3.6 alongside) This will change, but using 'samba4' packages from the repositorie

Re: [Samba] New version Samba matrix

2012-12-26 Thread Andrew Bartlett
thon.sh script, or try the autoconf build in source3/. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions

Re: [Samba] Remote Desktop Assistance / Take over session w/ Samba 4

2012-12-26 Thread Andrew Bartlett
ggest what we could change in Samba 4.0 AD DC to support that. > Additionally, would I have to have a Windows workstation to manage the > user workstations in this way, or could I use the RDP client e.g., in > Fedora to do it? Until the mechanism is identified, I couldn't really c

[Samba] [PATCH] Re: Samba 4, Winbind & RFC2307

2012-12-26 Thread Andrew Bartlett
master, I need to write a series of tests, because having this code untested is just causing us trouble. However, the attached should work, and so I would appreciate some testing if you have time. Thanks, Andrew Bartlett -- Andrew Bartletthttp://samba.org/~aba

Re: [Samba] Cannot Join Existing Windows 2003 Domain

2012-12-25 Thread Andrew Bartlett
forget to look into DNS partition replication some more. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Problem with Samba4 installation - trouble at kinit

2012-12-24 Thread Andrew Bartlett
t Samba packages at this stage are incomplete in one way or another, as distributions catch up with the full and official Samba 4.0 release). Are there any errors in the logs? Is it bound to the other ports? Thanks, Andrew Bartlett -- Andrew Bartletthttp://samba.or

Re: [Samba] Samba 4, Winbind & RFC2307

2012-12-23 Thread Andrew Bartlett
On Sun, 2012-12-23 at 14:40 +0100, "Dr. Hansjörg Maurer" wrote: > Hi > > Am 16.12.2012 23:06, schrieb Andrew Bartlett: > > On Sun, 2012-12-16 at 16:51 -0500, Thomas Simmons wrote: > >> Hello Andrew, > >> > >> > >> If functionality is

Re: [Samba] (S4) Neither AXFR nor authoritative nameserving available?

2012-12-23 Thread Andrew Bartlett
On Sun, 2012-12-23 at 14:20 -0500, Michael B. Trausch wrote: > On 12/22/2012 05:44 AM, Andrew Bartlett wrote: > > On Tue, 2012-12-18 at 11:58 -0500, Michael B. Trausch wrote: > >> Hello all, > >> > >> I'd like to have redundant DNS in our setup. But it see

Re: [Samba] (S4) Neither AXFR nor authoritative nameserving available?

2012-12-22 Thread Andrew Bartlett
ase file a bug, so Kai can look into it. > Is this a known issue, a configuration error on my part, or something > entirely different altogether? You could run another Samba DC to get the redundant DNS. Another option is to run the bind9 server and the dlz plugin. Andrew Bartlett -- And

Re: [Samba] [PATCH] Re: Changing administrator password after Samba4 classic upgrade

2012-12-22 Thread Andrew Bartlett
On Sat, 2012-12-22 at 12:55 +1100, Andrew Bartlett wrote: > On Thu, 2012-12-20 at 22:55 +1300, Mario Codeniera wrote: > > I used to upgrade samba3 to samba4 with almost successful with one problem, > > administrator can't access. As administrator, by default it is the only >

Re: [Samba] samba 4 join error to MS Server 2003 - WERR_GENERAL_FAILURE

2012-12-22 Thread Andrew Bartlett
P,CN=Protocols,CN=GIS-SERVER-2,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=CODomain,DC=local" msExchOWATranscodingFileTypes should give us more clues

Re: [Samba] Windows 8 printing to CUPS+Samba - will CreatePrinterIC RPC call stub be implemented?

2012-12-22 Thread Andrew Bartlett
ide, but is there a plan to > implement some stub for CreatePrinterIC call, so that Win8 (and > probably win2k8r2) clients could receive a harmless answer and proceed > with printer connection? File a bug, and hopefully the developers who work on Spoolss will get a chance to look into what

Re: [Samba] Eliminating Samba4 (as a name)

2012-12-21 Thread Andrew Bartlett
On Sat, 2012-12-22 at 02:22 -0500, Felix Miata wrote: > On 2012-12-22 02:00 (GMT-0500) Andrew Bartlett composed: > > > https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO > > That page seems to assume every potential reader, including Google, knows > that AD DC means. I had

[Samba] Eliminating Samba4 (as a name)

2012-12-21 Thread Andrew Bartlett
ring to Samba, and not using these terms. By doing to, we acknowledge that while the big new feature in the Samba 4.0 release is the AD DC, there is much more in Samba 4.0 besides, and we can't do that if we confuse fellow users who might equate Samba4 with Samba 4.0.

Re: [Samba] generate keytab

2012-12-21 Thread Andrew Bartlett
roxy.nisled.org At this point some idea of the errors you got where it 'does not work' would be helpful, as would the output of ktlist on the generated keytab: ktutil rkt /etc/proxy.keytab list Thanks, Andrew Bartlett -- Andrew Bartletthttp://samba.org

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-21 Thread Andrew Bartlett
rew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

[Samba] [PATCH] Re: Changing administrator password after Samba4 classic upgrade

2012-12-21 Thread Andrew Bartlett
min password of user root/administrator'. So, try the old password, but if neither the old password nor the generated one works, you can reset it using 'samba-tool user setpassword administrator' > Thank you, hope someone can give insights on it. Thanks for your patience with this.

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-21 Thread Andrew Bartlett
On Sat, 2012-12-22 at 12:01 +1300, Pieter De Wit wrote: > On 22/12/2012 11:47, Andrew Bartlett wrote: > > On Sat, 2012-12-22 at 11:36 +1300, Pieter De Wit wrote: > >> On 18/12/2012 10:47, Andrew Bartlett wrote: > >>> On Mon, 2012-12-17 at 17:00 +1300, Piete

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-21 Thread Andrew Bartlett
On Sat, 2012-12-22 at 11:36 +1300, Pieter De Wit wrote: > On 18/12/2012 10:47, Andrew Bartlett wrote: > > On Mon, 2012-12-17 at 17:00 +1300, Pieter De Wit wrote: > >> Hi list, > >> > >> I have tried with all my might to get a samba3 server (Ubuntu 12.04.1 LTS)

Re: [Samba] samba4 in a Windows workgroup

2012-12-21 Thread Andrew Bartlett
but the parts for setting up a simple server should still be correct, except where it references security=share (which has been removed from 4.0): https://www.samba.org/samba/docs/man/Samba-Guide/ Andrew Bartlett -- Andrew Bartletthttp:

Re: [Samba] Problem compiling Samba4, Python installed in nonstandard location

2012-12-21 Thread Andrew Bartlett
r if this is something > completely unrelated. I do know there's something that's always happened with > this system where the LDFLAGS doesn't include "-ldl" so those "dl" errors > might be related to that, but executing "LDFLAGS=-ldl make"

Re: [Samba] Migrate samba3.5 classic domain to Windows2008R2

2012-12-21 Thread Andrew Bartlett
accounts, I assume. This is pretty much what I would have suggested. I agree that inter-domain trusts will almost certainly need to be re-established. I would hope the original poster would be able to show the Samba 4.0 domain working very nicely, but I understand that manag

Re: [Samba] Samba 4 DRS replication

2012-12-20 Thread Andrew Bartlett
I am aware. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Limitations in packages of Samba 4.0 (particularly pre-releases)

2012-12-20 Thread Andrew Bartlett
g this package for Debian, I can't really comment on what exactly works or doesn't when backporting. I would probably just build from source at this stage. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Tea

[Samba] Samba 3.4 and Windows 2008R2 Interdomain trusts

2012-12-20 Thread Andrew Bartlett
ldn't upgrade into the AD server mode quite yet. It can be trusted by another forest however. I hope this helps, Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscri

Re: [Samba] config.h is not showing flags

2012-12-20 Thread Andrew Bartlett
or a modern Heimdal Kerberos. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

[Samba] Limitations in packages of Samba 4.0 (particularly pre-releases)

2012-12-19 Thread Andrew Bartlett
ackages (like the lack of AD DC support) need to be addressed to Fedora, as we don't provide the packages. The same applies to Debian/Ubuntu, which has for the same reason packaged pre-releases of Samba 4.0 to support OpenChange. These packages are also not full packages of the final Samba

Re: [Samba] difference between version 3.x and version 4

2012-12-19 Thread Andrew Bartlett
rted 'classic' domains, and they continue to be supported by smbd/nmbd. Likewise, the domain membership code is handled in the same way, and remains fully supported. Samba 4.0 is our new production release. Andrew Bartlett -- Andrew Bartletthttp

Re: [Samba] Samba4: wins hook & wins support ???

2012-12-17 Thread Andrew Bartlett
in, but I suspect that "wins hook" isn't currently tested. A test would be the best way to keep this working. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To un

Re: [Samba] Samba3 joining W2k3 as member server

2012-12-17 Thread Andrew Bartlett
ain PC to shares on my Linux box. > > Any pointers please or is this intended as the server does single sign? If you can list exactly the steps you took, we might be able to help. But to answer your question: Yes, Samba will happily join Windows 2003 as a domain member. The key command is '

Re: [Samba] S4 AD Domain Up; but no DNS auto-registration

2012-12-17 Thread Andrew Bartlett
On Mon, 2012-12-17 at 16:37 -0500, Adam Tauno Williams wrote: > On Tue, 2012-12-18 at 08:27 +1100, Andrew Bartlett wrote: > > On Mon, 2012-12-17 at 09:36 -0500, Adam Tauno Williams wrote: > > > samba-4.0.0 x86_64, CentOS6.3 > > > My Samba4 / AD is up and running a

Re: [Samba] Samba 4 GA upgrade - auth failing

2012-12-17 Thread Andrew Bartlett
e two versions? Otherwise and additionally, can you try setting 'acl:search=false' and see if that helps (this disables ACL enforcement for reads, which was the major change we made between these versions). Thanks, Andrew Bartlett -- Andrew Bartlettht

Re: [Samba] Checking data migration from samba3 to samba4

2012-12-17 Thread Andrew Bartlett
quot;/usr/local/samba/lib64/python2.6/site-packages/samba/upgrade.py", > line 264, in add_group_from_mapping_entry > str(groupmap.sid), groupmap.nt_name, msg[0]['sAMAccountName'][0]) > For some reason, we do not have a sAMAccountName attribute on this record. We need to wor

Re: [Samba] S4 AD Domain Up; but no DNS auto-registration

2012-12-17 Thread Andrew Bartlett
KBONE > Joined 'CREW' to realm 'micore.us' > DNS update failed! When using the BIND server, but not the internal DNS server, this happens for Samba clients only. We have modified the Samba client in 4.0 to also work with BIND, and we need to get back to th

Re: [Samba] S4 AD Domain Up; but lots of NTLMSSP NTLM2 errors

2012-12-17 Thread Andrew Bartlett
es, but they need much more work before we can fix that. It happens when the client is trying to change only the case of the servicePrincipalName over DRS. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team

Re: [Samba] Samba4 -> Windows 200x DNS Migration

2012-12-17 Thread Andrew Bartlett
work perfectly, so just keep an eye out for dragons. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] using samba4 as an authentication source

2012-12-17 Thread Andrew Bartlett
ou get back) and winbind (which will perform the authentication across the secure channel). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the fo

Re: [Samba] Samba 4, Winbind & RFC2307

2012-12-16 Thread Andrew Bartlett
rms of using nss_ldap on the DC, the only concern I have is that the [homes] share might not work if you do that. Our DC code mostly avoids calling into nss, but that particular area does do it, and really does expect that nss_winbind is being used. For that reason, we generally suggest separati

Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-16 Thread Andrew Bartlett
they are passwords or marked confidential in the schema. We are sorry for this regression, and hope to sort it out soon (but I think soon means after Christmas at this point, as many of us are taking a bit of time to recover after the massive effort to get 4.0 out the door). Sorry, Andrew Ba

Re: [Samba] Samba 4, Winbind & RFC2307

2012-12-16 Thread Andrew Bartlett
t; TESTDOM\tuser2:*:326:100:Test User2:/home/tuser2:/bin/sh > TESTDOM\tuser3:*:327:100:Test User3:/home/tuser3:/bin/sh On the DC, set: idmap_ldb:use rfc2307=yes We realise that having the different behaviour between the DC and the member server is very annoying, but

Re: [Samba] DNS Replication

2012-12-14 Thread Andrew Bartlett
getting this partition registered correctly for replication seems to be more difficult than for the main partitions. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from

Re: [Samba] Migrate to samba 4 in ( relatively ) complex openLDAP environment

2012-12-14 Thread Andrew Bartlett
re your experiences so that others in a similarly complex situation can get some guideance. I'm sorry this isn't as simple as we would prefer, but I'm sure we can work something out. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Auth

Re: [Samba] Proper way to upgrade from rc1?

2012-12-13 Thread Andrew Bartlett
profiles and logon scripts works ok. > > Hope that DNS will work now without problem (dynamic updates) and will > not have to restart samba every night becouse internal DNS gets stuck > after few days of heavy load. Do let us know if you have any remaining issues. Andrew Bartlett

Re: [Samba] Problem samba3 to samba4

2012-12-11 Thread Andrew Bartlett
ation name > which can't connect is "admin-pc" > Any idea ? The password for admin-pc has not been correctly migrated for some reason. You will need to re-join it to the domain, because clearly what the DC thinks the password on admin-pc$ is doesn't match what admin-pc t

Re: [Samba] Joining a linux server as a domain member with samba4

2012-12-11 Thread Andrew Bartlett
r as a domain member with samba4? You should compile with ADS support and you use 'net ads join'. I've tried to make 'samba-tool domain join member' also do reasonable things, but without ADS support the end result won't work (and it isn't yet the

Re: [Samba] Samba 4 LDAP NTLM password nightly injection

2012-12-11 Thread Andrew Bartlett
API. One approach you could code from is how we set the administrator password during the 'classicupgrade' script in source4/scripting/python/samba/upgrade.py. Give that a go, but if you need more clues I'm very happy to help out. Andrew Bartlett -- Andrew Bartlett

Re: [Samba] Samba 4 / DNS

2012-12-11 Thread Andrew Bartlett
ir DNS server. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 and permissions of SYSVOL and NETLOGON

2012-12-11 Thread Andrew Bartlett
he past, which is why we provide the tool. I'm surprised the files were that broadly writeable, but this is the correct fix. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team

Re: [Samba] Proper way to upgrade from rc1?

2012-12-11 Thread Andrew Bartlett
false' to return to rc5 behaviour here, until we provide an upgrade script. (This seems to hit joining windows DCs to the domain in particular). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http

Re: [Samba] Samba 4.0 released - The First Free Software Active Directory Compatible Server is now available !

2012-12-11 Thread Andrew Bartlett
veloped for the purpose of fixing exactly this kind of issue, and a bug has been raised to remind us that we need to add this fix and provide instructions for our users. When that is done, we will mention it on the lists, and then include it in a future release. Andrew Bartlett -- Andrew Bartlet

Re: [Samba] Remove dead server from domain.

2012-12-10 Thread Andrew Bartlett
are a lot of steps that should be done to ensure the DC being demoted has no FSMO roles left and knows it is demoted. Andrew Bartlett On Mon, 2012-12-10 at 15:06 +0100, x-dimens...@gmx.net wrote: > I have the same problem here. > Would be nice to see a solution for it. > > -

Re: [Samba] phpldapadmin and samba4

2012-12-07 Thread Andrew Bartlett
We recently removed the pre-generated configuration for phpldapadmin because nobody was testing the combination. I don't know what the issue is, but it is not a combination we actively support any more (nobody noticed for ages that the config file we generated was not compatibl

Re: [Samba] Samba4 Classicupgrade Failed

2012-12-07 Thread Andrew Bartlett
ated to an AD DC"? Do i need to create another Samba4 to the > replication server ? or what do the command 'samba-tool domain promote'? If you have another DC in the domain, you must indeed install Samba4 and then run 'samba-tool domain promote' to make it a DC. Andrew

Re: [Samba] MMC crashes with rc6

2012-12-05 Thread Andrew Bartlett
the globals section help? Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] MMC crashes with rc6

2012-12-05 Thread Andrew Bartlett
lue what the last (and presumably fatal) reply was. Otherwise we ill need to work with Microsoft to get this under a debugger. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To uns

Re: [Samba] classicupgrade fails on rc6, worked on rc5

2012-12-04 Thread Andrew Bartlett
_backend > return msg[0][attr][0] > The connection to the LDAP server was closed Sorry for the inconvenience, please try this patch. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://sa

Re: [Samba] winbind - samba4

2012-12-04 Thread Andrew Bartlett
t correct path in smb.conf. If the package is expecting a different path, then it is almost certainly also expecting a different version of the winbind pipe protocol, so this would not help. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authenticatio

Re: [Samba] So no conversion from group_mapping.ldb to group_mapping.tdb?

2012-12-03 Thread Andrew Bartlett
ing file. > > Just wanted to confirm that there is no conversion utility that I missed > and that I am on my own to migrate that information. It should auto-convert on upgrade. A minimal ldb parser is included to do that. Andrew Bartlett -- Andrew Bartlett

Re: [Samba] samba 4 & preexisting openldap servers

2012-12-03 Thread Andrew Bartlett
ot work, you will need to follow up on this list with those who have found the existing solutions to for DHCP and AD. (I'm rather keen to see this gap closed, but I don't expect to do that very soon). Andrew Bartlett -- Andrew Bartletthttp://samba.org

Re: [Samba] Samba file server using ldap backend without AD or PDC?

2012-12-03 Thread Andrew Bartlett
our file servers DCs, even if you don't ever join clients to the domain. That way, they have the same SID, which is stored in LDAP (normally the domain SID is per-machine). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Develope

Re: [Samba] problems with windows 2000 terminal server in AD with samba4rc5 (on Ubuntu 12.04.1 64bit) DC

2012-11-21 Thread Andrew Bartlett
sure you know), and it's not something we test often, and while we fix bugs when we have them supported, it is very much a reactionary support modal. For both of these, a manual update would probably be the best - manually set the SPNs to whatever it wants them set to, and manually set the DNS

Re: [Samba] MS Sharepoint 2010 configuration fails with Samba/Openldap PDC

2012-11-21 Thread Andrew Bartlett
for you. We put a lot of effort into making it 'just work' with tools like provision and the HOWTO, so it's really nice to hear such positive feedback. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Te

Re: [Samba] DC with external LDAP

2012-11-21 Thread Andrew Bartlett
cket is expired? Either bind using a simple bind or kinit to refresh your ticket cache. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the

Re: [Samba] MS Sharepoint 2010 configuration fails with Samba/Openldap PDC

2012-11-20 Thread Andrew Bartlett
AD DC. See our wiki at https://wiki.samba.org/index.php/Samba4/samba3upgrade/HOWTO for an explanation of the process of upgrading to Samba 4.0 as an AD DC. An OpenLDAP server simply won't have the right structure that sharepoint is looking for. Andrew Bartlett -- Andrew Bartlett

Re: [Samba] rename samba4 domain

2012-11-19 Thread Andrew Bartlett
e moment we have no tool to do that. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this list go to the following URL and read the instructions: https:/

Re: [Samba] Samba 4 logging

2012-11-18 Thread Andrew Bartlett
> Are you aware of any plans to add this type of logging in the future? It's a worthy feature, but no, I'm not aware of any specific plans. It needs someone to volunteer and implement it, including hooks in Heimdal. Andrew Bartlett -- Andrew Bartlett

Re: [Samba] Samba4 in FreeBSD 9 i386 for Domain controller not working. Samba version 4.1.0 pre1-GIT cf15406

2012-11-18 Thread Andrew Bartlett
cho 'domain xyz.pccom.ca' >> /etc/resolv.conf > the dns server keep the same as before. > 9, /usr/local/samba/bin/samba -i -M single > > I found > > "Failed to bind to 192.168.1.248 UDP_NT_ADDRESS_ALREADY_ASSOCIATED" Our KDC cannot start because you

Re: [Samba] Is it possible to change the root/Administrator user to another username?

2012-11-16 Thread Andrew Bartlett
to reduce the demands on your backend to a level where it doesn't break down. I hope this helps, Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this

Re: [Samba] Samba4 - Wins error running samba-tool classicupgrade

2012-11-16 Thread Andrew Bartlett
ns > > "address": ips}) > > > > > > Regards > > > > Federico > I have read the samba 3 docs, and this page[1] says that there is not > need to preserve winds.dat because this file is regenerated when Samba > is restarted. I deleted the

Re: [Samba] config a share named "Global", not "global"

2012-11-16 Thread Andrew Bartlett
for whoever has the job of supporting the result, so make sure you *document* it very clearly for whoever comes after you, or has to provide emergency support. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team

Re: [Samba] Samba domain member losing membership

2012-11-16 Thread Andrew Bartlett
updated (YUM) these systems between the joining and dropping from > the domains. > > What might cause this? What causes this is that when we change our domain membership password, and the connection to the DC we change against times out. There is a patch in later releases for this (give

Re: [Samba] Samba 4 logging

2012-11-16 Thread Andrew Bartlett
re, = > similar to how Windows AD servers log it to the security event log? Not at this point, sorry. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org -- To unsubscribe from this lis

Re: [Samba] Is it possible to change the root/Administrator user to another username?

2012-11-15 Thread Andrew Bartlett
han how you think you might fix it. Then we can probably give you some sensible advise. "root" isn't hard-coded anywhere in Samba, but uid 0 is special in unix and in Samba. Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Authenticatio

Re: [Samba] dns-backend BIND9_FLATFILE

2012-11-15 Thread Andrew Bartlett
On Thu, 2012-11-15 at 14:38 +, Bruno Fernandes wrote: > Hi, > > > > I'm still running samba4 beta5 with dns-backend=BIND9_FLATFILE > > > > I want to upgrade to samba4 rc5. Can I still use BIND9_FLATFILE ? Yes. Andrew Bartlett -- Andrew Bartlett

<    1   2   3   4   5   6   7   8   9   10   >