On 14 oct. 09, at 22:57, Mariano Absatz wrote:
On Wed, Oct 14, 2009 at 13:36, Gaiseric Vandal
<gaiseric.van...@gmail.com> wrote:
I supposed it depends if Samba is configured to automatically
create the underlying unix accounts when you create samba
accounts. My setup doesn't. I created a "user" account in ldap
for my BDC. (the unix passwd shd be *LK* and the shell shd be /
bin/false) Running "net rpc join" will then add the appropriate
samba attributes.
(...)
Thanx Gaiseric,
it was more or less the way you said... only changing the order:
1) BDC# net join -S PDC -UAdministrator
(since I'm using ldapsam:editposix = yes, the posix account is created
automatically by samba)
2) BDC# net rpc getsid
(this automatically retrieves the domain SID from the PDC and stores
it into secrets.tdb)
According to "samba 3 by example" this is not necessary unless you
run winbind
(http://www.samba.org/samba/docs/man/Samba-Guide/happy.html#sbehap-
bldg1)
Now you must obtain the domain SID from the PDC and store it into the
secrets.tdb file also. This step is not necessary with an LDAP passdb
backend because Samba-3 obtains the domain SID from the sambaDomain
object
it automatically stores in the LDAP backend. It does not hurt to add
the SID
to the secrets.tdb, and if you wish to do so, this command can achieve
that:
root# net rpc getsid MEGANET2
Storing SID S-1-5-21-3504140859-1010554828-2431957765 \
for Domain MEGANET2 in secrets.tdb
When configuring a Samba-3 BDC that has an LDAP backend, there is no
need to
take any special action to join it to the domain. However, winbind
communicates with the domain controller that is running on the
localhost and
must be able to authenticate, thus requiring that the BDC should be
joined to
the domain. The process of joining the domain creates the necessary
authentication accounts.
The only thing that doesn't seem completely right is that after
this, if I run
BDC# net getdomainsid
I get: "Could not fetch local SID"
However, if I run
BDC# sudo net getlocalsid MYDOMAIN
I get the correct SID for the domain... maybe I must generate a local
SID for the BDC? or something went wrong?...
You can issue "net setlocalsid S-XXXX" on your BDC where S-XXXX is the
SID obtained
with "net getlocalsid MYDOMAIN"
Regards,
Thierry
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
