Re: [Samba] dfs problems addressed in 3.0.25b?

2007-07-03 Thread Jeremy Allison
On Wed, Jul 04, 2007 at 05:31:20AM +, [EMAIL PROTECTED] wrote:
> Is the issue below addressed in 3.0.25b?  (no freebsd port available yet 
> so I'm still at 3.0.25a)
> I can't see anything specifically about this in the release notes.
> 
> I just want to add that I've also seen this behaviour on a windows xp 
> x64 client.
> It's a pretty serious problem..  so I'm also thinking I may have to 
> revert to an earlier version if it doesn't look like a fix is in the works..

This has not been reproducible as far as I know.

Can you create a reproducible test case ?

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] dfs problems addressed in 3.0.25b?

2007-07-03 Thread [EMAIL PROTECTED]
Is the issue below addressed in 3.0.25b?  (no freebsd port available yet 
so I'm still at 3.0.25a)

I can't see anything specifically about this in the release notes.

I just want to add that I've also seen this behaviour on a windows xp 
x64 client.
It's a pretty serious problem..  so I'm also thinking I may have to 
revert to an earlier version if it doesn't look like a fix is in the works..


Cheers,
Julian

- Original Message - 
From: "Volker Kindermann" <[EMAIL PROTECTED]>

To: 
Sent: Monday, June 11, 2007 8:21 AM
Subject: [Samba] dfs problems in 3.0.25a after client reboot and remapping




We restored to 3.0.23d after update to 3.0.25a because of strange dfs

behavior.


the detailed situation:

on msdfs root server 'samba' ls -lR

dfsroot/:
drwxr-xr-x appl1

dfsroot/appl1
lrwxrwxrwx share1 -> msdfs:server1\share1

[dfs]
comment = "SaMBa DFS root"
path = /path.../dfsroot
#   next line does not work prior 3.0.25 !!!
#   hide unreadable = Yes
msdfs root = Yes

on 'server1' ls -lR

share1:
drwxrws---  folder1
drwxrws---  folder2

[share1]
path = /path.../share1
valid users = +opr
force group = opr
printable = no
writeable = yes
inherit permissions = Yes

The failing clients are Windows Server 2003 SP1 with Citrix MetaFrame

Presentation Server 4.0

rebooted after update to 3.0.25a.

The first view (windows explorer) after the update is ok

\\samba\dfs\appl1\share1\folder1

But after a while (maybe other citrix users mapping \\samba\dfs in the

meantime ...)


the view from the same connection looked like

\\samba\dfs\appl1\share1\folder1\folder1

causing applications to fail

Standard WinXP clients had the same strange folder duplication, but seemed

to behave ok after remapping and reboot.


The Problem looks simular like the one reported by Josh Kelley (Jun 4)

'msdfs root problems even after a reboot?'



Any help appreciated

Volker Kindermann


I can't help - but I can confirm I seem to be seeing the same problem with a
FreeBSD 6.2 dfs server and win2k client.

It's not just a duplication of folder1 it's a more confusing rearrangement
that breaks access to paths under the original folder1
It's as if share1 is duplicated under itself using the name folder1.

taking the example above:
\\samba\dfs\appl1\share1\folder1\folder1

the first folder1 actually has the same listing as share1..
the files that were originally at
\\samba\dfs\appl1\share1\folder1
are now down at
\\samba\dfs\appl1\share1\folder1\folder1

the folder1 in my situation has siblings that don't exhibit this problem..
but perhaps the difference is that folder1 happens to be the one I use most.


Julian







--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] workgroup to domain migration question

2007-07-03 Thread Edmundo Valle Neto

De Leeuw Guy escreveu:

Hi all
  


Hi


I try to transform our old workgroup to a domain.
I read a lot of doc about that and smb-ldap tools.
I cannot use smb-ldap tools because I have a running ldap database with
our unix accounts.
  


Well, I think that you can continue to have it the way it is and use 
smbldap-tools with higher ids.



I build my own script to update our database.

Questions :
- For the admin account I modify the uid=admin, uidNumber=1033 and
gid=512 to secure the server root account. (no homeDirectory and
loginShell).
It is correct ?
  


I don't understood very well what you have done, but yes, a user without 
a valid loginShell cannot log in the system.



- For the accounts : Administrators, Account Operators, Print
Operators, Backup Operators et Replicators which are the correct SID ?
S-1-5-32-544 or a form like S-1-5-21-374813769-5580279-1681509432-544 ?
  


smbldap-tools creates them in the S-1-5-32-XXX form. But really only a 
few accounts are expected to be seen by domain clients in a samba domain 
with the right RID making any difference.


See:
http://samba.org/samba/docs/man/Samba-HOWTO-Collection/groupmapping.html#WKURIDS


- For the sambaSID users I use the localSID + uidNumber it is ok ?
- For the sambaSid groups unix (each user have this own group)
I use localsid + uidNumber + 1000 The primaryGroupSID are needed ? if
yes which ?

- For hosts I use localsid + uidNumber + 2000 ok ?

Could you help me to clarify that ?
  


Smbldap-tools used to create RIDs in a odd/even algorithmic fashion, 
never clashing. Posix accounts have separate allocation spaces but in 
Windows accounts share the same RID space and users/groups cannot clash.
Your accounts will probably start to clash after 1000 created user 
accounts (as uids/gids are not reused).

primaryGroupSID is normally "Domain Users".


Thanks in advance
Guy
  


Regards.

Edmundo Valle Neto
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] 3.0.25b - A. OK on Standalone system

2007-07-03 Thread Jeremy Allison
On Fri, Jun 29, 2007 at 09:00:22AM -0500, david rankin wrote:
> Jerry, Jeremy, all:
> 
>   Just FYI: 3.0.25b is working great in standalone with XP just like 25a! 
> Thanks team!

Thanks for letting us know - hopefully in the future it won't be
news when we don't regress :-).

Thanks,

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] ADS Join on Windows 2008 domain not working in 3.0.25b?

2007-07-03 Thread Eddie Tse

Hi,

Using samba 3.0.25b, testing to join to a Windows 2008 domain using ADS 
security with kerberos and it doesn't seem to work.  Anybody else tried this 
combination?


Same configuration worked joining to a Windows 2003 R2 domain.


I'm not a samba expert but looking at the log it looks like the 
[EMAIL PROTECTED] have something to do with it?



Output from "net ads join"

[2007/07/04 08:02:12, 3] libads/ldap.c:ads_connect(394)
 Connected to LDAP server 192.168.x.x
[2007/07/04 08:02:12, 4] libads/ldap.c:ads_current_time(2414)
 time offset is 0 seconds
[2007/07/04 08:02:12, 4] libads/sasl.c:ads_sasl_bind(521)
 Found SASL mechanism GSS-SPNEGO
[2007/07/04 08:02:12, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 48018 1 2 2
[2007/07/04 08:02:12, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2
[2007/07/04 08:02:12, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2 3
[2007/07/04 08:02:12, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 3 6 1 4 1 311 2 2 10
[2007/07/04 08:02:12, 3] libads/sasl.c:ads_sasl_spnego_bind(222)
 ads_sasl_spnego_bind: got server principal name = 
[EMAIL PROTECTED]

[2007/07/04 08:02:12, 3] libsmb/clikrb5.c:ads_krb5_mk_req(593)
 ads_krb5_mk_req: krb5_cc_get_principal failed (No credentials cache found)
[2007/07/04 08:02:13, 1] libsmb/clikrb5.c:ads_krb5_mk_req(602)
 ads_krb5_mk_req: krb5_get_credentials failed for 
[EMAIL PROTECTED] (Server not found in Kerberos database)

[2007/07/04 08:02:13, 1] utils/net_ads.c:net_ads_join(1470)
 error on ads_startup: Server not found in Kerberos database
Failed to join domain: Improperly formed account name



Output from "net ads testjoin"

[2007/07/04 07:57:00, 3] libads/ldap.c:ads_connect(394)
 Connected to LDAP server 192.168.x.x
[2007/07/04 07:57:00, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 48018 1 2 2
[2007/07/04 07:57:00, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2
[2007/07/04 07:57:00, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2 3
[2007/07/04 07:57:00, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 3 6 1 4 1 311 2 2 10
[2007/07/04 07:57:00, 3] libads/sasl.c:ads_sasl_spnego_bind(222)
 ads_sasl_spnego_bind: got server principal name = 
[EMAIL PROTECTED]

[2007/07/04 07:57:00, 3] libsmb/clikrb5.c:ads_krb5_mk_req(593)
 ads_krb5_mk_req: krb5_cc_get_principal failed (No credentials cache found)
[2007/07/04 07:57:04, 1] libsmb/clikrb5.c:ads_krb5_mk_req(602)
 ads_krb5_mk_req: krb5_get_credentials failed for 
[EMAIL PROTECTED] (Server not found in Kerberos database)

[2007/07/04 07:57:04, 3] libsmb/namequery.c:get_dc_list(1489)
 get_dc_list: preferred server list: "192.168.x.x, xxx.xxx.xxx"
[2007/07/04 07:57:04, 3] libads/ldap.c:ads_connect(394)
 Connected to LDAP server 192.168.x.x
[2007/07/04 07:57:04, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 48018 1 2 2
[2007/07/04 07:57:04, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2
[2007/07/04 07:57:04, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2 3
[2007/07/04 07:57:04, 3] libads/sasl.c:ads_sasl_spnego_bind(213)
 ads_sasl_spnego_bind: got OID=1 3 6 1 4 1 311 2 2 10
[2007/07/04 07:57:04, 3] libads/sasl.c:ads_sasl_spnego_bind(222)
 ads_sasl_spnego_bind: got server principal name = 
[EMAIL PROTECTED]

[2007/07/04 07:57:07, 1] libsmb/clikrb5.c:ads_krb5_mk_req(602)
 ads_krb5_mk_req: krb5_get_credentials failed for 
[EMAIL PROTECTED] (Server not found in Kerberos database)

[2007/07/04 07:57:11, 1] libsmb/clikrb5.c:ads_krb5_mk_req(602)
 ads_krb5_mk_req: krb5_get_credentials failed for 
[EMAIL PROTECTED] (Server not found in Kerberos database)

Join to domain is not valid: Improperly formed account name
[2007/07/04 07:57:11, 2] utils/net.c:main(1032)
 return code = -1





--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] "Open Extend >> " doesn't work anymore... !

2007-07-03 Thread Jeremy Allison
On Tue, Jul 03, 2007 at 06:48:18PM +0200, Mariotto Francesco wrote:
> On Windows XP and 2003 !!!
> Linux Server CentOS has CUPS and Samba 3.0.25 with all printers privileges.
> 
> I've problems with a program.
> Printing system does:
> 
> type test.txt  >>  \\lnxsrv\printer
> 
> and it return:
> "the parameter is incorrect"
> 
> but if i try:
> type test.txt  >  \\lnxsrv\printer
> 
> it works
> 
> but with early samba, before 3.0.21 release "open extend >> " it works !
> with last samba release 3.0.25 doesn't works and it returns me error ! Only 
> simple > works now !

I can't reproduce this with 3.0.25b.

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] "Open Extend >> " doesn't work anymore... !

2007-07-03 Thread Jeremy Allison
On Tue, Jul 03, 2007 at 06:48:18PM +0200, Mariotto Francesco wrote:
> On Windows XP and 2003 !!!
> Linux Server CentOS has CUPS and Samba 3.0.25 with all printers privileges.
> 
> I've problems with a program.
> Printing system does:
> 
> type test.txt  >>  \\lnxsrv\printer
> 
> and it return:
> "the parameter is incorrect"
> 
> but if i try:
> type test.txt  >  \\lnxsrv\printer
> 
> it works
> 
> but with early samba, before 3.0.21 release "open extend >> " it works !
> with last samba release 3.0.25 doesn't works and it returns me error ! Only 
> simple > works now !
> 
> Please help me !!!

Can you log this as a bug please so I can track it.

Thanks,

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] workgroup to domain migration question

2007-07-03 Thread Adam Tauno Williams
> - For the accounts : Administrators, Account Operators, Print
> Operators, Backup Operators et Replicators which are the correct SID ?
> S-1-5-32-544 or a form like S-1-5-21-374813769-5580279-1681509432-544 ?
> - For the sambaSID users I use the localSID + uidNumber it is ok ?
> - For the sambaSid groups unix (each user have this own group)
> I use localsid + uidNumber + 1000 The primaryGroupSID are needed ? if
> yes which ?
> - For hosts I use localsid + uidNumber + 2000 ok ?

I don't see how that will guarantee a unique number.

> Could you help me to clarify that ?

Why not just let Samba generate the SID?  Just invoke smbpasswd for each
account in LDAP and Samba will add all the attributes it needs.


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] "Open Extend >> " doesn't work anymore... !

2007-07-03 Thread Mariotto Francesco

On Windows XP and 2003 !!!
Linux Server CentOS has CUPS and Samba 3.0.25 with all printers privileges.

I've problems with a program.
Printing system does:

type test.txt  >>  \\lnxsrv\printer

and it return:
"the parameter is incorrect"

but if i try:
type test.txt  >  \\lnxsrv\printer

it works

but with early samba, before 3.0.21 release "open extend >> " it works !
with last samba release 3.0.25 doesn't works and it returns me error ! Only  
simple > works now !

Please help me !!!
Francesco

--
Francesco Mariotto
System Administrator
[EMAIL PROTECTED]

VULCANIA SYSTEM S.R.L.
Linux System Integrator

Strada Dell'Alpo, 27
37136 Verona (VR)
Italy
Tel. +39 045506015
Fax +39 045584937
[EMAIL PROTECTED]
www.vulcaniasystem.it

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] "Open Extend >> " doesn't work anymore... !

2007-07-03 Thread Mariotto Francesco

I've a problem with a program.
Printing system does:

type test.txt *>>* \\lnxsrv\printer

and it return:
"the parameter is incorrect"


but if i try:
type test.txt *> *\\lnxsrv\printer

it works

but if i try with early samba before 3.0.21 release "open extend >> " 
works !
with last samba release 3.0.25 not work and it tell me error ! Only 
simple > works now !


Please help me !!!
Francesco


--
Francesco Mariotto
System Administrator
[EMAIL PROTECTED]

VULCANIA SYSTEM S.R.L.
Linux System Integrator

Strada Dell'Alpo, 27
37136 Verona (VR)
Italy
Tel. +39 045506015
Fax +39 045584937
[EMAIL PROTECTED]
www.vulcaniasystem.it

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] Re: Roaming profile - Folder redirection - Erase file on server

2007-07-03 Thread Dragan Krnic

I'm in a testing environement with a Samba server setup as a PDC with some
share (netlogon, profiles) to support roaming profile. My "smb.conf" file
contain the good configuration parameters for "logon path" and "logon home"
etc ..

For my roaming profile, I setup a Folder redirection using the
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User
Shell Folders" registery key. I modify the value of AppData, Cookies,
Desktop, Favorites, My Pictures, Personal. Every folder are redirect to the
network share with %LOGONSERVER% and %USERNAME% variable. There is no
problem with the redirection, when I connect every thing are correctly
redirect.


why did you do that?
If you don't redefine default locations of user's shell folders they
will normally
be part of your profile and would be stored on the server
if roaming profiles are not disabled.

It is generally not a very good idea to manipulate registries.
But if you have a compelling reason to relocate user's shell folders to a
network drive, then use your home directory for that instead of profile.


For example, if I create a file named "textfile.txt" on my desktop, I see it
on the shared folder. (I do a "ls" command with ssh directly on the server
to be sure). I can add, remove, edit file on the desktop and every thing are
OK.

The problem come when I logout The window client do some sort of
synchronization of a local folder with the shared folder. For example,
C:\Documents and Seetings\admin\Desktop\ with
\\MyServer\profiles\admin\Desktop. I fact, it's not a synchronization, it's
just delete the shared folder and replace it by the content of the local
folder. The result is that every modification done on the desktop (that are
redirected) are lost at the logout.


I believe that's how it's supposed to work.
Purge the old profile and store the current one in its place.

If you don't want it to be overwritten relocate it somewhere else.
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] workgroup to domain migration question

2007-07-03 Thread De Leeuw Guy
Hi all

I try to transform our old workgroup to a domain.
I read a lot of doc about that and smb-ldap tools.
I cannot use smb-ldap tools because I have a running ldap database with
our unix accounts.
I build my own script to update our database.

Questions :
- For the admin account I modify the uid=admin, uidNumber=1033 and
gid=512 to secure the server root account. (no homeDirectory and
loginShell).
It is correct ?

- For the accounts : Administrators, Account Operators, Print
Operators, Backup Operators et Replicators which are the correct SID ?
S-1-5-32-544 or a form like S-1-5-21-374813769-5580279-1681509432-544 ?

- For the sambaSID users I use the localSID + uidNumber it is ok ?
- For the sambaSid groups unix (each user have this own group)
I use localsid + uidNumber + 1000 The primaryGroupSID are needed ? if
yes which ?

- For hosts I use localsid + uidNumber + 2000 ok ?

Could you help me to clarify that ?

Thanks in advance
Guy
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] i18n problems connecting Samba 3.0.22 with Snap! Server 4100 (samba 2.2.x I think)

2007-07-03 Thread Stefano Bartaletti
Hello,

I have an old SNAP! Server 4100 appliance that has a built-in samba, I think 
it's a 2.2.x samba
The only commands I can issue for smb are (taken from debug console):

Usage: 
      smb add [w{hex#ofbytes} {AtHexOffset} | e{AtHexOffset}]
      smb domain [{name} [{user} [{pwd}]]]
      smb encrypted-password [enable|disable]
      smb info [connections]
      smb pdc disconnect [enable|disable]
      smb securitydomain {name} [{user} [{pwd}]]
      smb workgroup {name}

This server has a documents share for all Windows users, and it is set to
use codepage 850 from server config panel.

I have recently put up a mail server with Ubuntu and samba 3.0.22, and I
would like to connect the documents share of the Snap! server, to
rsync/copy/whatever to a local directory and make backups.

The problem is that I could not find a correct combination of Samba
parameters on the Ubuntu box to handle filenames correctly; either I see a
question mark or strange readings. 

Moreover, if I try copy/rsync from the mail server, machine hangs and I have 
to power off/on

The strange thing is that if I connect through smbclient to this machine 
and 'ls', the filenames are correct!

How can I fix this? The SNAP! server can not be updated to a new samba
version and I was lost googling for some solution

Thanks for any tip
-- 
Cordialmente

Stefano Bartaletti
Responsabile Software

G.Tosi Spa Tintoria

Skype account: stefano.bartaletti
ICQ contact  : 1271960

Viale dell'Industria 61
21052 Busto Arsizio (VA)

Tel. +39 0331 34 48 11
Fax  +39 0331 35 21 23 
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


[Samba] continued problem starting samba

2007-07-03 Thread James Craig


I haven't been able to resolve this issue yet.  I started seeing this
on my server when trying to migrate to LDAP with 3.0.24.  I have
since grabbed 3.0.25b and built that as well, but smbd will not
start.  When I run it  with -i I get this:

[..]
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
Got nobody from pwnam_cache
Got nobody from pwnam_cache
sys_getgrouplist: user [nobody]
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
NT user token: (NULL)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
===
INTERNAL ERROR: Signal 11 in pid 19224 (3.0.25b)
Please read the Trouble-Shooting section of the Samba3-HOWTO

From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
===
PANIC (pid 19224): internal error
unable to produce a stack trace on this platform
dumping core in /local/samba/var/cores/smbd
Abort



I am using openldap on a Solaris 9 server.
It looks like I am talking to the server at first,
so I am not sure where the issue is..

jim craig


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Re: [Samba] [Docs] Alternative LDAP Database Initialization Script Error

2007-07-03 Thread John H Terpstra
On Tuesday 03 July 2007 04:48, Gavin Henry wrote:
> Dear all,
>
> Should be cat <>EOL at:
>
> http://us1.samba.org/samba/docs/man/Samba-Guide/appendix.html#sbehap-ldapre
>confc
>
> Thanks,
>
> Gavin.

Yes indeed. Thanks. Fixed.

- John T.


pgp2N1dVbFtR0.pgp
Description: PGP signature
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba

[Samba] No access to share

2007-07-03 Thread Chris Boyd
Running Debian Etch with Samba-3.0.24 and ldap...
I've set up a few users as part of the admin group and one in the users
group. When I log onto the XP machine they can see their home drives but I
get a command prompt asking for username and password for the server
(usit-file). Not even admin can login though. Even if I log onto the XP
machine as the domain admin I can't access the share.
The relevant bits:
 
smb.conf:
 
workgroup = usit

server string = %h server

wins support = yes

wins server = 10.133.1.21

dns proxy = yes

name resolve order = lmhosts host wins bcast

interfaces = 127.0.0.0/8 10.133.0.0/16 eth0

log file = /var/log/samba/log.%m

max log size = 1000

syslog = 10

panic action = /usr/share/samba/panic-action %d

security = user

encrypt passwords = true

passdb backend = ldapsam:ldap://10.133.1.21

ldap suffix = dc=usit,dc=ie

ldap machine suffix = ou=machines

ldap user suffix = ou=users

ldap group suffix = ou=groups

ldap admin dn = cn=admin,dc=usit,dc=ie

ldap delete dn = no

obey pam restrictions = yes

ldap password sync = yes 

invalid users = root

ldap passwd sync = Yes

passwd program = /usr/sbin/smbldap-passwd %u

passwd chat = *New*password* %n\n *Retype*new*password* %n\n
*all*authentication*tokens*updated*

domain logons = yes

enable privileges = yes

logon path =   \\%N\profiles\%U

logon path = \\%N\%U\profile

logon drive = H:

logon home =   \\%N\%U

logon script = logon.bat

add machine script = /usr/sbin/smbldap-useradd -w "%u" 

add user script = /usr/sbin/smbldap-useradd -m "%u"

ldap delete dn = Yes

delete user script = /usr/sbin/smbldap-userdel "%u"

add machine script = /usr/sbin/smbldap-useradd -w "%u"

add group script = /usr/sbin/smbldap-groupadd -p "%g"

delete group script = /usr/sbin/smbldap-groupdel "%g"

add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"

delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"

set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

domain master = yes

preferred master = yes

[homes]

comment = Home Directories

browseable = no

writable = yes

create mask = 0700

directory mask = 0700

valid users = %S

inherit acls = Yes

[netlogon]

comment = Network Logon Service

path = /home/samba/netlogon

guest ok = yes

writable = no

share modes = no

write list = "@admins"

[profiles]

comment = Users profiles

path = /home/samba/profiles

path = %H

guest ok = no

# browseable = no

store dos attributes = Yes

create mask = 0600

directory mask = 0700

[shared]

comment = Shared folder

path = /data/Shared

# force group = users

read only = no

create mask = 0770

directory mask = 0770

valid users = @admin,@users

Permissions:

usit-file:~#  ls -la /data/
total 16
drwxr-xr-x  4 root root  4096 2007-06-07 16:33 .
drwxr-xr-x 25 root root  4096 2007-06-08 14:52 ..
drwxr-xr-x  3 root root  4096 2007-06-07 16:33 AQ
drwxrwx--- 15 root users 4096 2007-06-08 11:51 Shared


Users: 

admin:*:0:2:admin :/home/users/admins/in:
gal_script$:*:3:515:Computer:/dev/null:/bin/false
ie-aqd-w089$:*:30001:515:Computer:/dev/null:/bin/false
aqd-christian$:*:30002:515:Computer:/dev/null:/bin/false
chris.boyd:*:1000:2:Chris Boyd:/home/chris.boyd:/bin/bash
emmett.sutton:*:1001:2:Emmett Sutton:/home/emmett.sutton:/bin/bash
bob.bobson:*:1002:20001:Bob Bobson:/home/bob.bobson:/bin/bash


Logon.bat:

net time \\usit-file /set /yes
net use s: \\usit-file\Shared


 


-
This email message is intended only for the addressee(s) 
and contains information that may be confidential and/or 
copyrighted.  If you are not the intended recipient please 
notify the sender by reply email and immediately delete 
this email. Use, disclosure or reproduction of this email 
by anyone other than the intended recipient(s) is strictly 
prohibited. USIT has scanned this email for viruses and 
dangerous content and believes it to be clean. However, 
virus scanning is ultimately the responsibility of the recipient.
-
USIT Ireland Ltd. Company No. 377526. Registered Office 19/21 Aston Quay Dublin 
2.-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba

[Samba] AD with MS-DFS

2007-07-03 Thread Andrea Lindner-Lorenz

Hello,

we have installed three samba servers(3.0.25a). All are members in the 
same active directory domain (TESTAD). Now I try to set up a new samba 
server (Version 3.0.10-1.4E.12.2 , newest version for Sientific Linux 
4.4) in front of them which use ms-dfs to forward the request to the 
right samba server. This server is an AD member,too.


I find out, that I have to run winbind on the new samba server, because 
for every compute node inside the AD I have to create a unix user account.


Everything works if I try to connect to the new samba server from
a) a domain member
b) a member of a trusted domain. But I have to create a unix account for 
this member. Winbind does not create this account. Is it possible, that 
winbind create this account, too?

c) a compute node outside the domain with a account from a trusted domain

But it does not work from a compute node outside the domain with a 
account from the first AD Domain (TESTAD). I get the following error message

inside the smbd logs.

[2007/07/03 10:56:24, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
  Failed to verify incoming ticket!

How can I solve this problem?

Thanks,
Andrea



smime.p7s
Description: S/MIME Cryptographic Signature
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba

[Samba] [Docs] Alternative LDAP Database Initialization Script Error

2007-07-03 Thread Gavin Henry

Dear all,

Should be cat <>EOL at:

http://us1.samba.org/samba/docs/man/Samba-Guide/appendix.html#sbehap-ldapreconfc

Thanks,

Gavin.
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba