[Samba] Winbind and local groups with nss

2012-09-04 Thread Eric
Hi all,

First of all, sorry for my english. I don't speak well english (of course I'm 
french! ;-) ) but I will try to do my best to explain you my problem.

I have a CentOS 6.3 system running with samba 3.5.10 against an AD 2008. My 
goal is to build a vsftpd server authenticating with users in my AD domain.

Everything is working quite fine but I have something strange :

When I put winbind in debug mode and when I do 'id -G root' I see these 
messages in winbindd.log : 

[2012/09/03 15:37:23.449662,  6] winbindd/winbindd.c:768(new_connection)
  accepted socket 21
[2012/09/03 15:37:23.449967,  3] 
winbindd/winbindd_misc.c:352(winbindd_interface_version)
  [ 4759]: request interface version
[2012/09/03 15:37:23.450112,  3] 
winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
  [ 4759]: request location of privileged pipe
[2012/09/03 15:37:23.450337,  6] winbindd/winbindd.c:768(new_connection)
  accepted socket 22
[2012/09/03 15:37:23.450421,  6] 
winbindd/winbindd.c:816(winbind_client_request_read)
  closing socket 21, client exited
[2012/09/03 15:37:23.450539,  3] 
winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send)
  getgroups root
[2012/09/03 15:37:23.450691,  5] 
winbindd/winbindd_getgroups.c:187(winbindd_getgroups_recv)
  Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED
[2012/09/03 15:37:23.451367,  6] 
winbindd/winbindd.c:816(winbind_client_request_read)
  closing socket 22, client exited


Winbind is asked by nss to resolve root secondary groups !!! I don't undestrand 
why : root is only local and all his groups are local.

The output is : 
# id -G root
0 1 2 3 4 6 10 494

My question is quite simple : why nss ask winbind to resolve theses groups name 
whereas they are all local !?!
Do you think the only thing I have to do is  ignore these messages ?

Here are my conf files : 

/etc/nsswitch.conf :
passwd: files winbind
shadow: files
group:  files winbind

/etc/samba/smb.conf : 

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
Press enter to see a dump of your service definitions

[global]
    workgroup = DOMAIN
    realm = DOMAIN.FQDN
    server string = Serveur ftp
    security = ADS
    allow trusted domains = No
    password server = 10.32.242.32 10.56.242.56
    ntlm auth = No
    kerberos method = secrets and keytab
    log level = 10
    log file = /var/log/samba/log.%m
    nt pipe support = No
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
    load printers = No
    domain master = No
    dns proxy = No
    idmap alloc backend = tdb
    idmap uid = 1-50
    idmap gid = 1-50
    template homedir = /usr/app/ftp/ftp/%U
    template shell = /sbin/nologin
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    winbind refresh tickets = Yes
    create krb5 conf = No
    invalid users = root
    cups options = raw

Thank you for your help !
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba upgrade problem with ADS

2012-09-04 Thread Andrew Bartlett
On Tue, 2012-09-04 at 22:10 -0400, Nitin Thakur wrote:
> hi gurus
> 
> My samba upgrade woes: -
> 
> I have to run 2 instances of samba one for dev and one for UAT. both the 
> instances are giving me hard time after the upgrade.
> 
> One instance keeps giving me following error: -
> 
>   connect_to_domain_password_server: unable to open the domain client session 
> to machine x.x.x.xxx.COM. Error was : 
> NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
> [2012/09/04 16:19:36.993000,  0] 
> auth/auth_domain.c:292(domain_client_validate)

that means it could not find the domain password in secrets.tdb.  When
you upgraded, did you either copy the secrets.tdb to the new prefix, or
use the same prefix?

This doesn't explain the re-join issues, unless you are mixing up a
'net' binary from one release (and prefix) with smbd/winbindd from the
other however.

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Samba upgrade problem with ADS

2012-09-04 Thread Nitin Thakur

hi gurus

My samba upgrade woes: -

I have to run 2 instances of samba one for dev and one for UAT. both the 
instances are giving me hard time after the upgrade.

One instance keeps giving me following error: -

  connect_to_domain_password_server: unable to open the domain client session 
to machine x.x.x.xxx.COM. Error was : 
NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2012/09/04 16:19:36.993000,  0] auth/auth_domain.c:292(domain_client_validate)

It returns this error for all the password servers. I deleted the server from 
ad and tried to rejoin the domain. it did join the domain but returned the 
error: -


# /opt/local/samba/bin/net -s /opt/local/samba/lib/smb.conf.dev ads join -U 
admin
Enter admin's password:
Using short domain name -- 
Joined '' to realm '...com'
DNS Update for x..xx.xxx.com failed: ERROR_DNS_UPDATE_FAILED
DNS update failed!

since then it keeps giving me error: -
[2012/09/04 21:43:10.299657,  0] smbd/server.c:1109(main)
  standard input is not a socket, assuming -D option
[2012/09/04 21:43:10.606915,  0] libads/kerberos_util.c:101(ads_kinit_password)
  kerberos_kinit_password X$@XXX.XX.XX.COM failed: Preauthentication 
failed
[2012/09/04 21:43:10.608476,  0] printing/nt_printing.c:102(nt_printing_init)
  nt_printing_init: error checking published printers: WERR_ACCESS_DENIED


moving on to other instance: -

[2012/09/04 15:51:47.207600,  5] rpc_client/cli_pipe.c:738(rpc_api_pipe_send)   
 
  rpc_api_pipe: host XX.X.X.XX.COM
[2012/09/04 15:51:47.209191,  5] rpc_client/cli_pipe.c:97(rpc_read_send)
  rpc_read_send: data_to_read: 52
[2012/09/04 15:51:47.209422,  5] rpc_client/cli_pipe.c:1521(check_bind_response)
  check_bind_response: accepted!
[2012/09/04 15:51:47.209687,  5] passdb/passdb.c:2365(get_trust_pw_clear)
  get_trust_pw_clear: could not fetch clear text trust account password for 
domain XX
[2012/09/04 15:51:47.209844,  5] 
passdb/machine_account_secrets.c:267(secrets_fetch_trust_account_password_legacy)
  secrets_fetch failed!
[2012/09/04 15:51:47.209998,  5] passdb/passdb.c:2403(get_trust_pw_hash)
  get_trust_pw_hash: could not fetch trust account password for domain XXX
[2012/09/04 15:51:47.210109,  0] 
rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common)
  get_schannel_session_key: could not fetch trust account password for domain 
'X'
[2012/09/04 15:51:47.211665,  0] 
rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel)
  cli_rpc_pipe_open_schannel: failed to get schannel session key from server 
XXX.X.XXX.XX.COM for domain XX.
[2012/09/04 15:51:47.211845,  0] 
auth/auth_domain.c:193(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session 
to machine ....COM. Error was : 
NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2012/09/04 15:51:47.213484,  0] auth/auth_domain.c:292(domain_client_validate)
  domain_client_validate: Domain password server not available.
[2012/09/04 15:51:47.213654,  5] auth/auth.c:271(check_ntlm_password)
  check_ntlm_password: winbind authentication for user [] FAILED with error 
NT_STATUS_CANT_ACCESS_DOMAIN_INFO
[2012/09/04 15:51:47.213779,  2] auth/auth.c:319(check_ntlm_password)
  check_ntlm_password:  Authentication for user [X] -> [XX] FAILED with 
error NT_STATUS_CANT_ACCESS_DOMAIN_INFO
[2012/09/04 15:51:47.213950,  3] smbd/error.c:81(error_packet_set)
  error packet at smbd/sesssetup.c(124) cmd=115 (SMBsesssetupX) 
NT_STATUS_CANT_ACCESS_DOMAIN_INFO

Here is the smbd.conf for 1st instance
#=== Global Settings =
[global]

socket options = TCP_NODELAY IPTOS_LOWDELAY
netbios name = X
workgroup = X
server string =  Samba Server ver %v
security = ADS
log file = /opt/local/samba/dev/logs/log.%m
max log size = 50
password server =  xx...xxx.com, ...xxx.com
encrypt passwords = yes
realm = XXX..X.COM
local master = no
domain master = no
domain logons = no
dns proxy = no
smb passwd file = /opt/local/samba/dev/private
private dir = /opt/local/samba/dev/private
username map = /opt/local/samba/dev/users.map
pid directory = /opt/local/samba/dev
bind interfaces only = yes
wins support = no
domain master = no
allow trusted domains = yes
locking = yes
lock directory = /opt/local/samba/var/dev/locks
preserve case = yes
short preserve case = yes
name resolve order = host bcast
load printers = no
printcap name = /dev/null
deadtime = 15
preferred master = no
guest account = nobody
guest ok = yes
syslog = 0
interfaces = xxx.xxx.xxx.xxx
socket address = xxx.xxx.xxx.xxx

[share]
   comment  =  share
   path = /share
   read only = No
   create mask = 0774
   browseable = yes
   preserve case = yes


and smb.conf.uat for second instance 
[global]

socket options = TCP_NODELAY IPTOS_LOWDELAY
netbios name = X-UAT
workgroup = XX

Re: [Samba] Hide empty Samba shares?

2012-09-04 Thread Stan Hoeppner
On 9/1/2012 2:52 PM, Sam Bulka wrote:
> When a partition mounted to a shared by Samba folder is dismounted,

Mount/unmount is performed on filesystems, not partitions.

> Samba keeps sharing that empty folder. It creates a security hazard,
> since files can still be saved to that empty folder, and overwritten
> next time (lost) when the original partition is auto mounted again to
> the same folder. Its also confusing for most users to browse empty
> shares - no normal person would understand why they are still there.

No "normal person" would dismount a filesystem from underneath a Samba
share.

> is there any
> reason or logic, why such basic functionality is not offered?

Samba is not MS Windows.  Just because a feature exists in MS Windows
does not make it "basic" translated "expected" in other platforms.  If
you were a long time Samba/*nix user and switched to MS Windows you'd
have the same complaint in reverse (though there are few such defections).

-- 
Stan

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Hide empty Samba shares?

2012-09-04 Thread Jeremy Allison
On Sat, Sep 01, 2012 at 03:52:38PM -0400, Sam Bulka wrote:
> When a partition mounted to a shared by Samba folder is dismounted,
> Samba keeps sharing that empty folder. It creates a security hazard,
> since files can still be saved to that empty folder, and overwritten
> next time (lost) when the original partition is auto mounted again
> to the same folder. Its also confusing for most users to browse
> empty shares - no normal person would understand why they are still
> there.
> 
> Is it possible to configure Samba to hide corresponding shares, once
> the attached drive is dismounted or switched off? If not, is there
> any reason or logic, why such basic functionality is not offered?

You'll need to script this yourself by issuing removing the share
entry from smb.conf and using smbcontrol to close client connections
to that share and reload the config file.

Samba doesn't have logic to hook into your specific UNIX's method
of notifying dismounts (if it even has one).

Also, it's not a security hazard, as the admin - don't do that :-).

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] samba 3.0.14a works with ldapsam backend but not 3.5.10-125.el6

2012-09-04 Thread Volker Lendecke
On Tue, Sep 04, 2012 at 03:59:25PM -0400, Qing Chang wrote:
> If I understand right, as a  STANDALONE server, Samba should only care about 
> finding and
> authenticating againt a matching uid to Windows username on the samba server 
> (which
> uses LDAP),  and then using the uid and gid(s) to provide shared resources, 
> which is the
> behavior observed with 3.0.14a, but not with 3.5.10-125.el6.
> 
> In fact, SID never matters with 3.0.14a, I have populated all users with the 
> same SIDs and
> 3.0.14a has been serving shares for years.

Well, Samba has moved on to put more emphasis on SIDs. If
that does not match your requirements, you should better
stick with 3.0.14a and find someone from
http://samba.org/samba/support to maintain it for you.

With best regards,

Volker Lendecke

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-37-0, fax: +49-551-37-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kont...@sernet.de
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] samba 3.0.14a works with ldapsam backend but not 3.5.10-125.el6

2012-09-04 Thread Qing Chang


On 22/08/2012 9:42 AM, Qing Chang wrote:



On 21/08/2012 11:59 AM, TAKAHASHI Motonobu wrote:

Have you explicitly set the RHEL box's SID same as Solaris box's?
You will do this with "get|set localsid" command.

they are different. net setlocalsid fails:
[root@smb3 samba]# net setlocalsid S-1-5-21-1197990898-71428884-4196996049
[2012/08/22 09:02:13.228237,  0] lib/interface.c:542(load_interfaces)
  WARNING: no network interfaces found

The point here is that  3.0.14a never bothered to check if a user'd SID belongs 
to
the domain. It just simply sees the user and report:

init_sam_from_ldap: Entry found for user: qchang


On the other hand, 3.5.10-125.el6 insist that what ever SID a user has does not
belong to its domain, although I only set it up as a STANDALONE server:

sid S-1-5-21-3516781642-1962875130-3438800523-41232 does not belong to our 
domain
Skipping entry uid=qchang,cn=users,cn=accounts,dc=sri,dc=utoronto,dc=ca

If I understand right, as a  STANDALONE server, Samba should only care about 
finding and
authenticating againt a matching uid to Windows username on the samba server 
(which
uses LDAP),  and then using the uid and gid(s) to provide shared resources, 
which is the
behavior observed with 3.0.14a, but not with 3.5.10-125.el6.

In fact, SID never matters with 3.0.14a, I have populated all users with the 
same SIDs and
3.0.14a has been serving shares for years.


From: Qing Chang
Date: Mon, 20 Aug 2012 13:23:17 -0400


we are migrating our standalone Samba sever (3.0.14a) on a Solaris
10 box to an RHEL 6.3 box.

Testing shows that on Solaris 3.0.14a works with both the OpenLDAP
server we are currently using and the IPA2.2 server as LDAP
backend. But 3.5.10-125.el6 on  a RHEL 6.3 box does not work with
either.

(snip)


pdbedit -L has different output:

= 3.0.14a =
Trying to load: ldapsam:ldap://ipa1.sri.utoronto.ca
Attempting to find an passdb backend to match 
ldapsam:ldap://ipa1.sri.utoronto.ca (ldapsam)
Found pdb backend ldapsam
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OCTANE))]
smbldap_open_connection: connection opened
ldap_connect_system: succesful connection to the LDAP server
ldap_connect_system: LDAP server does support paged results
pdb backend ldapsam:ldap://ipa1.sri.utoronto.ca has a valid init
Attempting to find an passdb backend to match guest (guest)
Found pdb backend guest
pdb backend guest has a valid init
ldapsam_setsampwent: 1507 entries in the base dc=sri,dc=utoronto,dc=ca
init_sam_from_ldap: Entry found for user: qchang
=

= 3.5.10-125.el6 =
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
pdb backend ldapsam:ldap://ipa1.sri.utoronto.ca has a valid init
smbldap_search_paged: base =>  [dc=sri,dc=utoronto,dc=ca], filter =>
[(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize =>  [1024]
smbldap_search_paged: search was successful
sid S-1-5-21-3516781642-1962875130-3438800523-41232 does not belong to our 
domain
Skipping entry uid=qchang,cn=users,cn=accounts,dc=sri,dc=utoronto,dc=ca
=

---
TAKAHASHI Motonobu

Qing

Is there any samba developer that can please clarify the following one way or 
the other?
=
If I understand right, as a  STANDALONE server, Samba should only care about 
finding and
authenticating againt a matching uid to Windows username on the samba server 
(which
uses LDAP),  and then using the uid and gid(s) to provide shared resources, 
which is the
behavior observed with 3.0.14a, but not with 3.5.10-125.el6.

In fact, SID never matters with 3.0.14a, I have populated all users with the 
same SIDs and
3.0.14a has been serving shares for years.

Thank you very much!

Qing
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread jax
Okay, someone else will need to answer on how WINS works, but something 
else might be going on here.  On a windows machine, if you do a ping -a, 
you'll get ping to resolve your name. I'd check both old and new IPs. 
Granted, the old won't reply, but you'll see the DNS query go through 
anyway.  What that means then is that the IT staff on the other side has 
manually loaded a DNS entry into Active Directory, and WINS is pulling 
from that because that's the information is has to work from.


Perform some DNS querys against the A/D dns servers, see if they have 
the old IP or new one or just plain none at all for your server...



On 2012-09-04 12:23, Paul Raines wrote:

It is definitely an issue with the WINS server which returns the old
IP address

# nmblookup -U 172.27.88.81 -R 'MRIRESEARCH#1b'
querying MRIRESEARCH on 172.27.88.81
132.183.202.95 MRIRESEARCH<1b>

SO it is not automatically picking up the IP change which happened 4 
days ago
and I have restarted samba on my PDC several times.  The old IP is 
definitely
not in /etc/hosts anymore or anywhere in smb.conf.  It only shows up 
in
gencache.tdb in the files /var/lib/samba even though I keep deleting 
that

file when I restart.

WINS is a total mystery to me.  How is this supposed to work?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 12:00pm, Paul Raines wrote:

I have no idea what the WINS server is except that I am sure it 
running on Windows since they are totally Windows-based organization.  
So the WINS server is definitely the problem?  When I talk to them and 
mention I am using Samba on Linux they may totally just say "we don't 
support it" and hang up.


It seems a strange design that a WINS server can take precedence 
over

my explicit "password server" setting in my smb.conf file.

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 11:21am, Robert Adkins II wrote:


More information is required.
What is the WINS server running OS wise? Can you work with the IT 
Staff in

charge of that WINS Server?
--
Regards,
Robert Adkins




-Original Message-
From: Paul Raines [mailto:rai...@nmr.mgh.harvard.edu]
Sent: Tuesday, September 04, 2012 11:16 AM
To: Robert Adkins II
Cc: samba@lists.samba.org
Subject: RE: [Samba] Changed PDC IP, all hell broke lose

I am not running winbindd on the server.  I am using the WINS
server of my hospital which I have no control over.
I have already tried deleting browse.dat (I do not see the
other two files anywhere) to no avail.
So my fear is that this is all happening because the WINS
server is refusing to recognize the change since I cannot do
anything about it. Is that the issue?  Is there anyway to
force a WINS server to change the IP it has a for domain
master browser?
-- Paul Raines (http://help.nmr.mgh.harvard.edu)


On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:


It's most likely that your server has the old IP Address

Cached in the

wins.dat, browse.dat, browse.tdb.
I recommend the following:
Shutdown the windbind, nmbd and smbd services.
Back up each of the above mentioned files.
Delete the original above named files.
Restart your services and then see if you can connect.
You may also need to edit your samba configuration file to point 
to
the new server IP Address as the PDC Master Browser. (Assuming 
you

didn't already do
that.)
The problem is that your server is telling clients to

attempt to find

it on a network that no longer exists.
--
Regards,
Robert Adkins II




-Original Message-
From: samba-boun...@lists.samba.org
[mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
Sent: Tuesday, September 04, 2012 10:41 AM
To: samba@lists.samba.org
Subject: [Samba] Changed PDC IP, all hell broke lose

I had to move my RedHat 5 box acting as a PDC to a new IP

address. It

is running samba 3.5.10.  After the move, none of my

windows or linux

samba clients worked anymore.  I tried rejoining some to

the domain,

but would get error
Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid

The old PDC IP address is 132.183.202.95 and nothing is at that 
IP

anymore (for 4 days now).  The new IP is 172.21.21.35
I ran 'net -d 10 join' and would see it was still trying

to connect
to the old IP address.  I tried 'net cache flush' to no avail.  
I

shut down samba, removed every file in /var/cache/samba

and still no

change.
It tries to go to the old IP address.
On the PDC box, I increase 'os level' from 60 to 70,

stopped the nmbd
and smbd processes, did a 'net flush cache' and restarted nmbd 
and

smbd. Still it fails and the nmbd log as the following.
==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
   nmbd version 3.5.10-0.110.el5_8 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH 
on

subnet 172.21.21.35
[2012/09/0

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Paul Raines


It is definitely an issue with the WINS server which returns the old IP 
address


# nmblookup -U 172.27.88.81 -R 'MRIRESEARCH#1b'
querying MRIRESEARCH on 172.27.88.81
132.183.202.95 MRIRESEARCH<1b>

SO it is not automatically picking up the IP change which happened 4 days ago
and I have restarted samba on my PDC several times.  The old IP is definitely
not in /etc/hosts anymore or anywhere in smb.conf.  It only shows up in
gencache.tdb in the files /var/lib/samba even though I keep deleting that
file when I restart.

WINS is a total mystery to me.  How is this supposed to work?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 12:00pm, Paul Raines wrote:

I have no idea what the WINS server is except that I am sure it running on 
Windows since they are totally Windows-based organization.  So the WINS 
server is definitely the problem?  When I talk to them and mention I am using 
Samba on Linux they may totally just say "we don't support it" and hang up.


It seems a strange design that a WINS server can take precedence over
my explicit "password server" setting in my smb.conf file.

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 11:21am, Robert Adkins II wrote:


More information is required.

What is the WINS server running OS wise? Can you work with the IT Staff in
charge of that WINS Server?

--

Regards,
Robert Adkins




-Original Message-
From: Paul Raines [mailto:rai...@nmr.mgh.harvard.edu]
Sent: Tuesday, September 04, 2012 11:16 AM
To: Robert Adkins II
Cc: samba@lists.samba.org
Subject: RE: [Samba] Changed PDC IP, all hell broke lose


I am not running winbindd on the server.  I am using the WINS
server of my hospital which I have no control over.

I have already tried deleting browse.dat (I do not see the
other two files anywhere) to no avail.

So my fear is that this is all happening because the WINS
server is refusing to recognize the change since I cannot do
anything about it. Is that the issue?  Is there anyway to
force a WINS server to change the IP it has a for domain
master browser?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:


It's most likely that your server has the old IP Address

Cached in the

wins.dat, browse.dat, browse.tdb.

I recommend the following:

Shutdown the windbind, nmbd and smbd services.

Back up each of the above mentioned files.

Delete the original above named files.

Restart your services and then see if you can connect.

You may also need to edit your samba configuration file to point to
the new server IP Address as the PDC Master Browser. (Assuming you
didn't already do
that.)

The problem is that your server is telling clients to

attempt to find

it on a network that no longer exists.

--

Regards,
Robert Adkins II




-Original Message-
From: samba-boun...@lists.samba.org
[mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
Sent: Tuesday, September 04, 2012 10:41 AM
To: samba@lists.samba.org
Subject: [Samba] Changed PDC IP, all hell broke lose


I had to move my RedHat 5 box acting as a PDC to a new IP

address. It

is running samba 3.5.10.  After the move, none of my

windows or linux

samba clients worked anymore.  I tried rejoining some to

the domain,

but would get error

Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid


The old PDC IP address is 132.183.202.95 and nothing is at that IP
anymore (for 4 days now).  The new IP is 172.21.21.35

I ran 'net -d 10 join' and would see it was still trying

to connect

to the old IP address.  I tried 'net cache flush' to no avail.  I
shut down samba, removed every file in /var/cache/samba

and still no

change.
It tries to go to the old IP address.

On the PDC box, I increase 'os level' from 60 to 70,

stopped the nmbd

and smbd processes, did a 'net flush cache' and restarted nmbd and
smbd. Still it fails and the nmbd log as the following.

==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
   nmbd version 3.5.10-0.110.el5_8 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 172.21.21.35
[2012/09/04 10:09:25.716599,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 192.168.0.150
[2012/09/04 10:09:25.716671,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet UNICAST_SUBNET
[2012/09/04 10:09:25.716768,  0]
nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
   become_domain_master_browser_wins:
   Attempting to become domain master browser on workgroup
MRIRESEARCH, subnet UNICAST_SUBNET.
[2012/09/04 10:09:25.716828,  0]
nmbd/nmbd_become_dmb.c:351(become_domai

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread jax
I'm in a similar situation, and have run into your issue once.  I work 
at a hospital, have several freebsd boxes running samba and joined to 
the Windows-based domain.  I am *not* using my samba servers for auth, 
rather just depending on Active Directory for that.


However, there are two things to check when it's acting like you have 
the wrong IP.


1st one is easy - on the samba box, please check the hosts file, I've 
made that mistake a couple times - change the IP but not the hosts file.
2nd one is if you login to a windows domain, you need to remove your 
node out of the directory - or have them do it.  See, the box will be 
registered in A/D and it will have some information associated with it 
in A/D.  I don't know the entirety of it, but removing the machine 
totally out of A/D has solved a number of problems for me - allowing me 
to re-join and proceed with the day.


Good Luck!
Jack

On 2012-09-04 10:00, Paul Raines wrote:

I have no idea what the WINS server is except that I am sure it
running on Windows since they are totally Windows-based organization.
So the WINS server is definitely the problem?  When I talk to them 
and

mention I am using Samba on Linux they may totally just say "we don't
support it" and hang up.

It seems a strange design that a WINS server can take precedence over
my explicit "password server" setting in my smb.conf file.

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 11:21am, Robert Adkins II wrote:


More information is required.

What is the WINS server running OS wise? Can you work with the IT 
Staff in

charge of that WINS Server?

--

Regards,
Robert Adkins




-Original Message-
From: Paul Raines [mailto:rai...@nmr.mgh.harvard.edu]
Sent: Tuesday, September 04, 2012 11:16 AM
To: Robert Adkins II
Cc: samba@lists.samba.org
Subject: RE: [Samba] Changed PDC IP, all hell broke lose


I am not running winbindd on the server.  I am using the WINS
server of my hospital which I have no control over.

I have already tried deleting browse.dat (I do not see the
other two files anywhere) to no avail.

So my fear is that this is all happening because the WINS
server is refusing to recognize the change since I cannot do
anything about it. Is that the issue?  Is there anyway to
force a WINS server to change the IP it has a for domain
master browser?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:


It's most likely that your server has the old IP Address

Cached in the

wins.dat, browse.dat, browse.tdb.

I recommend the following:

Shutdown the windbind, nmbd and smbd services.

Back up each of the above mentioned files.

Delete the original above named files.

Restart your services and then see if you can connect.

You may also need to edit your samba configuration file to point 
to

the new server IP Address as the PDC Master Browser. (Assuming you
didn't already do
that.)

The problem is that your server is telling clients to

attempt to find

it on a network that no longer exists.

--

Regards,
Robert Adkins II




-Original Message-
From: samba-boun...@lists.samba.org
[mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
Sent: Tuesday, September 04, 2012 10:41 AM
To: samba@lists.samba.org
Subject: [Samba] Changed PDC IP, all hell broke lose


I had to move my RedHat 5 box acting as a PDC to a new IP

address. It

is running samba 3.5.10.  After the move, none of my

windows or linux

samba clients worked anymore.  I tried rejoining some to

the domain,

but would get error

Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid


The old PDC IP address is 132.183.202.95 and nothing is at that 
IP

anymore (for 4 days now).  The new IP is 172.21.21.35

I ran 'net -d 10 join' and would see it was still trying

to connect

to the old IP address.  I tried 'net cache flush' to no avail.  I
shut down samba, removed every file in /var/cache/samba

and still no

change.
It tries to go to the old IP address.

On the PDC box, I increase 'os level' from 60 to 70,

stopped the nmbd
and smbd processes, did a 'net flush cache' and restarted nmbd 
and

smbd. Still it fails and the nmbd log as the following.

==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
   nmbd version 3.5.10-0.110.el5_8 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 172.21.21.35
[2012/09/04 10:09:25.716599,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 192.168.0.150
[2012/09/04 10:09:25.716671,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet UNICAST_SUBNET
[2012/09/04 10:09:25.716768,  0]
n

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Paul Raines
I have no idea what the WINS server is except that I am sure it running on 
Windows since they are totally Windows-based organization.  So the WINS server 
is definitely the problem?  When I talk to them and mention I am using Samba 
on Linux they may totally just say "we don't support it" and hang up.


It seems a strange design that a WINS server can take precedence over
my explicit "password server" setting in my smb.conf file.

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 11:21am, Robert Adkins II wrote:


More information is required.

What is the WINS server running OS wise? Can you work with the IT Staff in
charge of that WINS Server?

--

Regards,
Robert Adkins




-Original Message-
From: Paul Raines [mailto:rai...@nmr.mgh.harvard.edu]
Sent: Tuesday, September 04, 2012 11:16 AM
To: Robert Adkins II
Cc: samba@lists.samba.org
Subject: RE: [Samba] Changed PDC IP, all hell broke lose


I am not running winbindd on the server.  I am using the WINS
server of my hospital which I have no control over.

I have already tried deleting browse.dat (I do not see the
other two files anywhere) to no avail.

So my fear is that this is all happening because the WINS
server is refusing to recognize the change since I cannot do
anything about it. Is that the issue?  Is there anyway to
force a WINS server to change the IP it has a for domain
master browser?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:


It's most likely that your server has the old IP Address

Cached in the

wins.dat, browse.dat, browse.tdb.

I recommend the following:

Shutdown the windbind, nmbd and smbd services.

Back up each of the above mentioned files.

Delete the original above named files.

Restart your services and then see if you can connect.

You may also need to edit your samba configuration file to point to
the new server IP Address as the PDC Master Browser. (Assuming you
didn't already do
that.)

The problem is that your server is telling clients to

attempt to find

it on a network that no longer exists.

--

Regards,
Robert Adkins II




-Original Message-
From: samba-boun...@lists.samba.org
[mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
Sent: Tuesday, September 04, 2012 10:41 AM
To: samba@lists.samba.org
Subject: [Samba] Changed PDC IP, all hell broke lose


I had to move my RedHat 5 box acting as a PDC to a new IP

address. It

is running samba 3.5.10.  After the move, none of my

windows or linux

samba clients worked anymore.  I tried rejoining some to

the domain,

but would get error

Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid


The old PDC IP address is 132.183.202.95 and nothing is at that IP
anymore (for 4 days now).  The new IP is 172.21.21.35

I ran 'net -d 10 join' and would see it was still trying

to connect

to the old IP address.  I tried 'net cache flush' to no avail.  I
shut down samba, removed every file in /var/cache/samba

and still no

change.
It tries to go to the old IP address.

On the PDC box, I increase 'os level' from 60 to 70,

stopped the nmbd

and smbd processes, did a 'net flush cache' and restarted nmbd and
smbd. Still it fails and the nmbd log as the following.

==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
   nmbd version 3.5.10-0.110.el5_8 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 172.21.21.35
[2012/09/04 10:09:25.716599,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet 192.168.0.150
[2012/09/04 10:09:25.716671,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup MRIRESEARCH on
subnet UNICAST_SUBNET
[2012/09/04 10:09:25.716768,  0]
nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
   become_domain_master_browser_wins:
   Attempting to become domain master browser on workgroup
MRIRESEARCH, subnet UNICAST_SUBNET.
[2012/09/04 10:09:25.716828,  0]
nmbd/nmbd_become_dmb.c:351(become_domain_master_browser_wins)
   become_domain_master_browser_wins: querying WINS server from IP
0.0.0.0 for domain master browser name MRIRESEARCH<1b> on

workgroup

MRIRESEARCH
[2012/09/04 10:09:25.722744,  0]
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
   become_logon_server_success: Samba is now a logon server for
workgroup MRIRESEARCH on subnet UNICAST_SUBNET
[2012/09/04 10:09:25.722928,  0]
nmbd/nmbd_become_dmb.c:235(become_domain_master_query_success)
   become_domain_master_query_success:
   There is already a domain master browser at IP
132.183.202.95 for workgroup MRIRESEARCH registered on subnet
UNICAST_SUBNET.
[2012/09/04 10:09:29.096239,  0]
nmbd/nmbd_logonnames.

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Robert Adkins II
More information is required.

What is the WINS server running OS wise? Can you work with the IT Staff in
charge of that WINS Server?

--

Regards,
Robert Adkins 

 

> -Original Message-
> From: Paul Raines [mailto:rai...@nmr.mgh.harvard.edu] 
> Sent: Tuesday, September 04, 2012 11:16 AM
> To: Robert Adkins II
> Cc: samba@lists.samba.org
> Subject: RE: [Samba] Changed PDC IP, all hell broke lose
> 
> 
> I am not running winbindd on the server.  I am using the WINS 
> server of my hospital which I have no control over.
> 
> I have already tried deleting browse.dat (I do not see the 
> other two files anywhere) to no avail.
> 
> So my fear is that this is all happening because the WINS 
> server is refusing to recognize the change since I cannot do 
> anything about it. Is that the issue?  Is there anyway to 
> force a WINS server to change the IP it has a for domain 
> master browser?
> 
> -- Paul Raines (http://help.nmr.mgh.harvard.edu)
> 
> 
> 
> On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:
> 
> > It's most likely that your server has the old IP Address 
> Cached in the 
> > wins.dat, browse.dat, browse.tdb.
> >
> > I recommend the following:
> >
> > Shutdown the windbind, nmbd and smbd services.
> >
> > Back up each of the above mentioned files.
> >
> > Delete the original above named files.
> >
> > Restart your services and then see if you can connect.
> >
> > You may also need to edit your samba configuration file to point to 
> > the new server IP Address as the PDC Master Browser. (Assuming you 
> > didn't already do
> > that.)
> >
> > The problem is that your server is telling clients to 
> attempt to find 
> > it on a network that no longer exists.
> >
> > --
> >
> > Regards,
> > Robert Adkins II
> >
> >
> >
> >> -Original Message-
> >> From: samba-boun...@lists.samba.org
> >> [mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
> >> Sent: Tuesday, September 04, 2012 10:41 AM
> >> To: samba@lists.samba.org
> >> Subject: [Samba] Changed PDC IP, all hell broke lose
> >>
> >>
> >> I had to move my RedHat 5 box acting as a PDC to a new IP 
> address. It 
> >> is running samba 3.5.10.  After the move, none of my 
> windows or linux 
> >> samba clients worked anymore.  I tried rejoining some to 
> the domain, 
> >> but would get error
> >>
> >> Unable to find a suitable server
> >> Join to domain 'MRIRESEARCH' is not valid
> >>
> >>
> >> The old PDC IP address is 132.183.202.95 and nothing is at that IP 
> >> anymore (for 4 days now).  The new IP is 172.21.21.35
> >>
> >> I ran 'net -d 10 join' and would see it was still trying 
> to connect 
> >> to the old IP address.  I tried 'net cache flush' to no avail.  I 
> >> shut down samba, removed every file in /var/cache/samba 
> and still no 
> >> change.
> >> It tries to go to the old IP address.
> >>
> >> On the PDC box, I increase 'os level' from 60 to 70, 
> stopped the nmbd 
> >> and smbd processes, did a 'net flush cache' and restarted nmbd and 
> >> smbd. Still it fails and the nmbd log as the following.
> >>
> >> ==
> >> [2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
> >>nmbd version 3.5.10-0.110.el5_8 started.
> >>Copyright Andrew Tridgell and the Samba Team 1992-2010
> >> [2012/09/04 10:09:25.716397,  0]
> >> nmbd/nmbd_logonnames.c:160(add_logon_names)
> >>add_domain_logon_names:
> >>Attempting to become logon server for workgroup MRIRESEARCH on 
> >> subnet 172.21.21.35
> >> [2012/09/04 10:09:25.716599,  0]
> >> nmbd/nmbd_logonnames.c:160(add_logon_names)
> >>add_domain_logon_names:
> >>Attempting to become logon server for workgroup MRIRESEARCH on 
> >> subnet 192.168.0.150
> >> [2012/09/04 10:09:25.716671,  0]
> >> nmbd/nmbd_logonnames.c:160(add_logon_names)
> >>add_domain_logon_names:
> >>Attempting to become logon server for workgroup MRIRESEARCH on 
> >> subnet UNICAST_SUBNET
> >> [2012/09/04 10:09:25.716768,  0]
> >> nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
> >>become_domain_master_browser_wins:
> >>Attempting to become domain master browser on workgroup 
> >> MRIRESEARCH, subnet UNICAST_SUBNET.
> >> [2012/09/04 10:09:25.716828,  0]
> >> nmbd/nmbd_become_dmb.c:351(become_domain_master_browser_wins)
> >>become_domain_master_browser_wins: querying WINS server from IP 
> >> 0.0.0.0 for domain master browser name MRIRESEARCH<1b> on 
> workgroup 
> >> MRIRESEARCH
> >> [2012/09/04 10:09:25.722744,  0]
> >> nmbd/nmbd_logonnames.c:121(become_logon_server_success)
> >>become_logon_server_success: Samba is now a logon server for 
> >> workgroup MRIRESEARCH on subnet UNICAST_SUBNET
> >> [2012/09/04 10:09:25.722928,  0]
> >> nmbd/nmbd_become_dmb.c:235(become_domain_master_query_success)
> >>become_domain_master_query_success:
> >>There is already a domain master browser at IP
> >> 132.183.202.95 for workgroup MRIRESEARCH registered on subnet 
> >> UNICAST_SUBNET.
> >> [2012/09/04 10:09:29.096239,  0]
> >> nmbd/nmbd_logonnames.c:121(b

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Paul Raines


I am not running winbindd on the server.  I am using the WINS server of
my hospital which I have no control over.

I have already tried deleting browse.dat (I do not see the other two
files anywhere) to no avail.

So my fear is that this is all happening because the WINS server is refusing
to recognize the change since I cannot do anything about it. Is that
the issue?  Is there anyway to force a WINS server to change the IP
it has a for domain master browser?

-- Paul Raines (http://help.nmr.mgh.harvard.edu)



On Tue, 4 Sep 2012 10:59am, Robert Adkins II wrote:


It's most likely that your server has the old IP Address Cached in the
wins.dat, browse.dat, browse.tdb.

I recommend the following:

Shutdown the windbind, nmbd and smbd services.

Back up each of the above mentioned files.

Delete the original above named files.

Restart your services and then see if you can connect.

You may also need to edit your samba configuration file to point to the new
server IP Address as the PDC Master Browser. (Assuming you didn't already do
that.)

The problem is that your server is telling clients to attempt to find it on
a network that no longer exists.

--

Regards,
Robert Adkins II




-Original Message-
From: samba-boun...@lists.samba.org
[mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
Sent: Tuesday, September 04, 2012 10:41 AM
To: samba@lists.samba.org
Subject: [Samba] Changed PDC IP, all hell broke lose


I had to move my RedHat 5 box acting as a PDC to a new IP
address. It is running samba 3.5.10.  After the move, none of
my windows or linux samba clients worked anymore.  I tried
rejoining some to the domain, but would get error

Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid


The old PDC IP address is 132.183.202.95 and nothing is at
that IP anymore (for 4 days now).  The new IP is 172.21.21.35

I ran 'net -d 10 join' and would see it was still trying to
connect to the old IP address.  I tried 'net cache flush' to
no avail.  I shut down samba, removed every file in
/var/cache/samba and still no change.
It tries to go to the old IP address.

On the PDC box, I increase 'os level' from 60 to 70, stopped
the nmbd and smbd processes, did a 'net flush cache' and
restarted nmbd and smbd. Still it fails and the nmbd log as
the following.

==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
   nmbd version 3.5.10-0.110.el5_8 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup
MRIRESEARCH on subnet 172.21.21.35
[2012/09/04 10:09:25.716599,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup
MRIRESEARCH on subnet 192.168.0.150
[2012/09/04 10:09:25.716671,  0]
nmbd/nmbd_logonnames.c:160(add_logon_names)
   add_domain_logon_names:
   Attempting to become logon server for workgroup
MRIRESEARCH on subnet UNICAST_SUBNET
[2012/09/04 10:09:25.716768,  0]
nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
   become_domain_master_browser_wins:
   Attempting to become domain master browser on workgroup
MRIRESEARCH, subnet UNICAST_SUBNET.
[2012/09/04 10:09:25.716828,  0]
nmbd/nmbd_become_dmb.c:351(become_domain_master_browser_wins)
   become_domain_master_browser_wins: querying WINS server
from IP 0.0.0.0 for domain master browser name
MRIRESEARCH<1b> on workgroup MRIRESEARCH
[2012/09/04 10:09:25.722744,  0]
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
   become_logon_server_success: Samba is now a logon server
for workgroup MRIRESEARCH on subnet UNICAST_SUBNET
[2012/09/04 10:09:25.722928,  0]
nmbd/nmbd_become_dmb.c:235(become_domain_master_query_success)
   become_domain_master_query_success:
   There is already a domain master browser at IP
132.183.202.95 for workgroup MRIRESEARCH registered on subnet
UNICAST_SUBNET.
[2012/09/04 10:09:29.096239,  0]
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
   become_logon_server_success: Samba is now a logon server
for workgroup MRIRESEARCH on subnet 172.21.21.35
[2012/09/04 10:09:29.096382,  0]
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
   become_logon_server_success: Samba is now a logon server
for workgroup MRIRESEARCH on subnet 192.168.0.150
[2012/09/04 10:09:49.731244,  0]
nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
   *

   Samba name server PDC-NMR is now a local master browser
for workgroup MRIRESEARCH on subnet 172.21.21.35

   *
[2012/09/04 10:09:49.731468,  0]
nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
   *

   Samba name server PDC-NMR is now a local master browser
for workgroup MRIRESEARCH on subnet 192.168.0.150

   *
[2012/09/04 10:10:10.732440,  0]
nmbd/nmbd_browsesync.c:247(domain_master_node_status_fail)
   domain_master_node_status_fail:
   Doing a node status request to the domain master

Re: [Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Robert Adkins II
It's most likely that your server has the old IP Address Cached in the
wins.dat, browse.dat, browse.tdb.

I recommend the following:

Shutdown the windbind, nmbd and smbd services.

Back up each of the above mentioned files.

Delete the original above named files.

Restart your services and then see if you can connect.

You may also need to edit your samba configuration file to point to the new
server IP Address as the PDC Master Browser. (Assuming you didn't already do
that.)

The problem is that your server is telling clients to attempt to find it on
a network that no longer exists.

--

Regards,
Robert Adkins II

 

> -Original Message-
> From: samba-boun...@lists.samba.org 
> [mailto:samba-boun...@lists.samba.org] On Behalf Of Paul Raines
> Sent: Tuesday, September 04, 2012 10:41 AM
> To: samba@lists.samba.org
> Subject: [Samba] Changed PDC IP, all hell broke lose
> 
> 
> I had to move my RedHat 5 box acting as a PDC to a new IP 
> address. It is running samba 3.5.10.  After the move, none of 
> my windows or linux samba clients worked anymore.  I tried 
> rejoining some to the domain, but would get error
> 
> Unable to find a suitable server
> Join to domain 'MRIRESEARCH' is not valid
> 
> 
> The old PDC IP address is 132.183.202.95 and nothing is at 
> that IP anymore (for 4 days now).  The new IP is 172.21.21.35
> 
> I ran 'net -d 10 join' and would see it was still trying to 
> connect to the old IP address.  I tried 'net cache flush' to 
> no avail.  I shut down samba, removed every file in 
> /var/cache/samba and still no change.
> It tries to go to the old IP address.
> 
> On the PDC box, I increase 'os level' from 60 to 70, stopped 
> the nmbd and smbd processes, did a 'net flush cache' and 
> restarted nmbd and smbd. Still it fails and the nmbd log as 
> the following.
> 
> ==
> [2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
>nmbd version 3.5.10-0.110.el5_8 started.
>Copyright Andrew Tridgell and the Samba Team 1992-2010
> [2012/09/04 10:09:25.716397,  0] 
> nmbd/nmbd_logonnames.c:160(add_logon_names)
>add_domain_logon_names:
>Attempting to become logon server for workgroup 
> MRIRESEARCH on subnet 172.21.21.35
> [2012/09/04 10:09:25.716599,  0] 
> nmbd/nmbd_logonnames.c:160(add_logon_names)
>add_domain_logon_names:
>Attempting to become logon server for workgroup 
> MRIRESEARCH on subnet 192.168.0.150
> [2012/09/04 10:09:25.716671,  0] 
> nmbd/nmbd_logonnames.c:160(add_logon_names)
>add_domain_logon_names:
>Attempting to become logon server for workgroup 
> MRIRESEARCH on subnet UNICAST_SUBNET
> [2012/09/04 10:09:25.716768,  0] 
> nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
>become_domain_master_browser_wins:
>Attempting to become domain master browser on workgroup 
> MRIRESEARCH, subnet UNICAST_SUBNET.
> [2012/09/04 10:09:25.716828,  0] 
> nmbd/nmbd_become_dmb.c:351(become_domain_master_browser_wins)
>become_domain_master_browser_wins: querying WINS server 
> from IP 0.0.0.0 for domain master browser name 
> MRIRESEARCH<1b> on workgroup MRIRESEARCH
> [2012/09/04 10:09:25.722744,  0] 
> nmbd/nmbd_logonnames.c:121(become_logon_server_success)
>become_logon_server_success: Samba is now a logon server 
> for workgroup MRIRESEARCH on subnet UNICAST_SUBNET
> [2012/09/04 10:09:25.722928,  0] 
> nmbd/nmbd_become_dmb.c:235(become_domain_master_query_success)
>become_domain_master_query_success:
>There is already a domain master browser at IP 
> 132.183.202.95 for workgroup MRIRESEARCH registered on subnet 
> UNICAST_SUBNET.
> [2012/09/04 10:09:29.096239,  0] 
> nmbd/nmbd_logonnames.c:121(become_logon_server_success)
>become_logon_server_success: Samba is now a logon server 
> for workgroup MRIRESEARCH on subnet 172.21.21.35
> [2012/09/04 10:09:29.096382,  0] 
> nmbd/nmbd_logonnames.c:121(become_logon_server_success)
>become_logon_server_success: Samba is now a logon server 
> for workgroup MRIRESEARCH on subnet 192.168.0.150
> [2012/09/04 10:09:49.731244,  0] 
> nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
>*
> 
>Samba name server PDC-NMR is now a local master browser 
> for workgroup MRIRESEARCH on subnet 172.21.21.35
> 
>*
> [2012/09/04 10:09:49.731468,  0] 
> nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
>*
> 
>Samba name server PDC-NMR is now a local master browser 
> for workgroup MRIRESEARCH on subnet 192.168.0.150
> 
>*
> [2012/09/04 10:10:10.732440,  0] 
> nmbd/nmbd_browsesync.c:247(domain_master_node_status_fail)
>domain_master_node_status_fail:
>Doing a node status request to the domain master browser
>for workgroup MRIRESEARCH at IP 132.183.202.95 failed.
>Cannot sync browser lists.
> [2012/09/04 10:10:10.732636,  0] 
> nmbd/nmbd_browsesync.c:247(domain_master_node_status_fail)
>domain_master_node_status_fail:
>Doing a node status request to the domain master browser
>for workgroup MRIRESEARCH at IP 132.183

[Samba] Changed PDC IP, all hell broke lose

2012-09-04 Thread Paul Raines


I had to move my RedHat 5 box acting as a PDC to a new IP address. It is
running samba 3.5.10.  After the move, none of my windows or linux samba
clients worked anymore.  I tried rejoining some to the domain, but would
get error

Unable to find a suitable server
Join to domain 'MRIRESEARCH' is not valid


The old PDC IP address is 132.183.202.95 and nothing is at that IP anymore 
(for 4 days now).  The new IP is 172.21.21.35


I ran 'net -d 10 join' and would see it was still trying to connect to
the old IP address.  I tried 'net cache flush' to no avail.  I shut
down samba, removed every file in /var/cache/samba and still no change.
It tries to go to the old IP address.

On the PDC box, I increase 'os level' from 60 to 70, stopped the nmbd and smbd 
processes, did a 'net flush cache' and restarted nmbd and smbd. Still it 
fails and the nmbd log as the following.


==
[2012/09/04 10:09:25,  0] nmbd/nmbd.c:857(main)
  nmbd version 3.5.10-0.110.el5_8 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/09/04 10:09:25.716397,  0] nmbd/nmbd_logonnames.c:160(add_logon_names)
  add_domain_logon_names:
  Attempting to become logon server for workgroup MRIRESEARCH on subnet 
172.21.21.35
[2012/09/04 10:09:25.716599,  0] nmbd/nmbd_logonnames.c:160(add_logon_names)
  add_domain_logon_names:
  Attempting to become logon server for workgroup MRIRESEARCH on subnet 
192.168.0.150
[2012/09/04 10:09:25.716671,  0] nmbd/nmbd_logonnames.c:160(add_logon_names)
  add_domain_logon_names:
  Attempting to become logon server for workgroup MRIRESEARCH on subnet 
UNICAST_SUBNET
[2012/09/04 10:09:25.716768,  0] 
nmbd/nmbd_become_dmb.c:337(become_domain_master_browser_wins)
  become_domain_master_browser_wins:
  Attempting to become domain master browser on workgroup MRIRESEARCH, subnet 
UNICAST_SUBNET.
[2012/09/04 10:09:25.716828,  0] 
nmbd/nmbd_become_dmb.c:351(become_domain_master_browser_wins)
  become_domain_master_browser_wins: querying WINS server from IP 0.0.0.0 for domain 
master browser name MRIRESEARCH<1b> on workgroup MRIRESEARCH
[2012/09/04 10:09:25.722744,  0] 
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
  become_logon_server_success: Samba is now a logon server for workgroup 
MRIRESEARCH on subnet UNICAST_SUBNET
[2012/09/04 10:09:25.722928,  0] 
nmbd/nmbd_become_dmb.c:235(become_domain_master_query_success)
  become_domain_master_query_success:
  There is already a domain master browser at IP 132.183.202.95 for workgroup 
MRIRESEARCH registered on subnet UNICAST_SUBNET.
[2012/09/04 10:09:29.096239,  0] 
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
  become_logon_server_success: Samba is now a logon server for workgroup 
MRIRESEARCH on subnet 172.21.21.35
[2012/09/04 10:09:29.096382,  0] 
nmbd/nmbd_logonnames.c:121(become_logon_server_success)
  become_logon_server_success: Samba is now a logon server for workgroup 
MRIRESEARCH on subnet 192.168.0.150
[2012/09/04 10:09:49.731244,  0] 
nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
  *

  Samba name server PDC-NMR is now a local master browser for workgroup 
MRIRESEARCH on subnet 172.21.21.35

  *
[2012/09/04 10:09:49.731468,  0] 
nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
  *

  Samba name server PDC-NMR is now a local master browser for workgroup 
MRIRESEARCH on subnet 192.168.0.150

  *
[2012/09/04 10:10:10.732440,  0] 
nmbd/nmbd_browsesync.c:247(domain_master_node_status_fail)
  domain_master_node_status_fail:
  Doing a node status request to the domain master browser
  for workgroup MRIRESEARCH at IP 132.183.202.95 failed.
  Cannot sync browser lists.
[2012/09/04 10:10:10.732636,  0] 
nmbd/nmbd_browsesync.c:247(domain_master_node_status_fail)
  domain_master_node_status_fail:
  Doing a node status request to the domain master browser
  for workgroup MRIRESEARCH at IP 132.183.202.95 failed.
  Cannot sync browser lists.

=

Where is it still getting the old IP address?

The the clients are all set with

   remote announce = 172.27.88.81
   wins server = 172.27.88.81
   security = domain
   password server = pdc.nmr.mgh.harvard.edu
   workgroup = MRIRESEARCH

The WINS server is run by central IT group of the hospital and I have
no control over it.

DNS is properly changed:

# host pdc.nmr.mgh.harvard.edu
pdc.nmr.mgh.harvard.edu is an alias for raidsrv01.nmr.mgh.harvard.edu.
raidsrv01.nmr.mgh.harvard.edu has address 172.21.21.35

---
Paul Raines http://help.nmr.mgh.harvard.edu
MGH/MIT/HMS Athinoula A. Martinos Center for Biomedical Imaging
149 (2301) 13th Street Charlestown, MA 02129USA





The information in this e-mail is intended only for the person to whom it is
addressed. If you believe this e-mail was sent to you in error and the e-mail
contains patient information, please contact the Partners Compliance HelpLine at
http://www.partners.or

[Samba] Is it possible to add user to samba without a system account?

2012-09-04 Thread Li Wang
hi, all

I tested this in CentOS 6.4, with

samba-common-3.5.10-114.el6.x86_64
samba-winbind-clients-3.5.10-114.el6.x86_64
samba-3.5.10-114.el6.x86_64
samba-swat-3.5.10-114.el6.x86_64

   If foxban have a system account, invoking smbpasswd -a foxban works good.

   However, if foxban2 is not a system account, smbpasswd -a foxban2 gives
me the follows:

# smbpasswd -a foxban2
New SMB password:
Retype new SMB password:
Failed to add entry for user foxban2.

   Is it intended to?

   thanks

Wang Li

Regards.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] [samba4] How to use my ldap users in sam.ldb?

2012-09-04 Thread Ced T

Le 04/09/2012 14:36, Andrew Bartlett a écrit :

On Tue, 2012-09-04 at 14:16 +0200, Ced T wrote:

Yes with this command line

//usr/local/samba/bin/samba-tool domain classicupgrade
--dbdir=/home/user/samba3/ --use-xattrs=yes  --realm=LABO.FR
/home/user/user/smb.conf/

(where smb.conf is a copy of my old samba3 server that use my openldap
database and /home/user/samba3 contains a copy of samba3 databases)

I can see he connects successfully to my openldap database and he begins
to export accounts

/Reading smb.conf//
//Processing section "[homes]"//
//Processing section "[printers]"//
//Processing section "[print$]"//
//Provisioning//
//smbldap_search_domain_info: Searching
for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//
//smbldap_open_connection: connection opened//
//ldap_connect_system: successful connection to the LDAP server//
//Exporting account policy//
//Exporting groups//
//ldapsam_setsamgrent: 0 entries in the base!//
//Exporting users//
//smbldap_search_paged: base => [dc=labo,dc=fr], filter =>
[(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//
//smbldap_search_paged: search was successful//
//init_sam_from_ldap: Entry found for user: balezo//
//smbldap_search_domain_info: Searching
for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//
//smbldap_open_connection: connection opened//
//ldap_connect_system: successful connection to the LDAP server//
//ERROR: Got 0 entries for gid 100, expected one//
//Forcing Primary Group to 'Domain Users' for balezo//
//primary group of [balezo] not found//
//Ignoring group memberships of 'balezo'
S-1-5-21-3929439064-1197820248-2386129086-6000: Unable to enumerate
group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//
//init_sam_from_ldap: Entry found for user: calvigna//
//ERROR: Got 0 entries for gid 100, expected one//
//Forcing Primary Group to 'Domain Users' for calvigna//
//primary group of [calvigna] not found//
//Ignoring group memberships of 'calvigna'
S-1-5-21-3929439064-1197820248-2386129086-6002: Unable to enumerate
group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//
//init_sam_from_ldap: Entry found for user: currie//
//ERROR: Got 0 entries for gid 100, expected one//
/...
But suddenly he crashes with these errors:

/Failed to connect to ldap URL 'ldaps://ldap.intra.labo.fr/' - LDAP
client internal error: NT_STATUS_BAD_NETWORK_NAME//
//Failed to connect to 'ldaps://ldap.intra.labo.fr/' with backend
'ldaps': (null)//
//Could not open ldb connection to ldaps://ldap.intra.labo.fr/, the
error message is: (1, None)//
//Exporting posix attributes//
//smbldap_search_paged: base => [dc=labo,dc=fr], filter =>
[(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//
//smbldap_search_paged: search was successful//
//ERROR(): uncaught exception -
local variable 'ldb_object' referenced before assignment//
//  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 160, in _run//
//return self.run(*args, **kwargs)//
//  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py",
line 1013, in run//
//useeadb=eadb, dns_backend=dns_backend, use_ntvfs=use_ntvfs)//
//  File
"/usr/local/samba/lib/python2.7/site-packages/samba/upgrade.py", line
795, in upgrade_from_samba3//
//homes[username] = get_posix_attr_from_ldap_backend(logger,
ldb_object, base_dn, username, "homeDirectory")/

My guess is you didn't build Samba4 against the gnutls development
headers.

Andrew Bartlett


Hmm I tried with ldap (without "s") and i got the same error :-(

Ced T
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] [samba4] How to use my ldap users in sam.ldb?

2012-09-04 Thread Andrew Bartlett
On Tue, 2012-09-04 at 14:16 +0200, Ced T wrote:
> Yes with this command line
> 
> //usr/local/samba/bin/samba-tool domain classicupgrade 
> --dbdir=/home/user/samba3/ --use-xattrs=yes  --realm=LABO.FR 
> /home/user/user/smb.conf/
> 
> (where smb.conf is a copy of my old samba3 server that use my openldap 
> database and /home/user/samba3 contains a copy of samba3 databases)
> 
> I can see he connects successfully to my openldap database and he begins 
> to export accounts
> 
> /Reading smb.conf//
> //Processing section "[homes]"//
> //Processing section "[printers]"//
> //Processing section "[print$]"//
> //Provisioning//
> //smbldap_search_domain_info: Searching 
> for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//
> //smbldap_open_connection: connection opened//
> //ldap_connect_system: successful connection to the LDAP server//
> //Exporting account policy//
> //Exporting groups//
> //ldapsam_setsamgrent: 0 entries in the base!//
> //Exporting users//
> //smbldap_search_paged: base => [dc=labo,dc=fr], filter => 
> [(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//
> //smbldap_search_paged: search was successful//
> //init_sam_from_ldap: Entry found for user: balezo//
> //smbldap_search_domain_info: Searching 
> for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//
> //smbldap_open_connection: connection opened//
> //ldap_connect_system: successful connection to the LDAP server//
> //ERROR: Got 0 entries for gid 100, expected one//
> //Forcing Primary Group to 'Domain Users' for balezo//
> //primary group of [balezo] not found//
> //Ignoring group memberships of 'balezo' 
> S-1-5-21-3929439064-1197820248-2386129086-6000: Unable to enumerate 
> group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//
> //init_sam_from_ldap: Entry found for user: calvigna//
> //ERROR: Got 0 entries for gid 100, expected one//
> //Forcing Primary Group to 'Domain Users' for calvigna//
> //primary group of [calvigna] not found//
> //Ignoring group memberships of 'calvigna' 
> S-1-5-21-3929439064-1197820248-2386129086-6002: Unable to enumerate 
> group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//
> //init_sam_from_ldap: Entry found for user: currie//
> //ERROR: Got 0 entries for gid 100, expected one//
> /...
> But suddenly he crashes with these errors:
> 
> /Failed to connect to ldap URL 'ldaps://ldap.intra.labo.fr/' - LDAP 
> client internal error: NT_STATUS_BAD_NETWORK_NAME//
> //Failed to connect to 'ldaps://ldap.intra.labo.fr/' with backend 
> 'ldaps': (null)//
> //Could not open ldb connection to ldaps://ldap.intra.labo.fr/, the 
> error message is: (1, None)//
> //Exporting posix attributes//
> //smbldap_search_paged: base => [dc=labo,dc=fr], filter => 
> [(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//
> //smbldap_search_paged: search was successful//
> //ERROR(): uncaught exception - 
> local variable 'ldb_object' referenced before assignment//
> //  File 
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py", 
> line 160, in _run//
> //return self.run(*args, **kwargs)//
> //  File 
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", 
> line 1013, in run//
> //useeadb=eadb, dns_backend=dns_backend, use_ntvfs=use_ntvfs)//
> //  File 
> "/usr/local/samba/lib/python2.7/site-packages/samba/upgrade.py", line 
> 795, in upgrade_from_samba3//
> //homes[username] = get_posix_attr_from_ldap_backend(logger, 
> ldb_object, base_dn, username, "homeDirectory")/

My guess is you didn't build Samba4 against the gnutls development
headers.

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] [samba4] How to use my ldap users in sam.ldb?

2012-09-04 Thread Ced T

Yes with this command line

//usr/local/samba/bin/samba-tool domain classicupgrade 
--dbdir=/home/user/samba3/ --use-xattrs=yes  --realm=LABO.FR 
/home/user/user/smb.conf/


(where smb.conf is a copy of my old samba3 server that use my openldap 
database and /home/user/samba3 contains a copy of samba3 databases)


I can see he connects successfully to my openldap database and he begins 
to export accounts


/Reading smb.conf//
//Processing section "[homes]"//
//Processing section "[printers]"//
//Processing section "[print$]"//
//Provisioning//
//smbldap_search_domain_info: Searching 
for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//

//smbldap_open_connection: connection opened//
//ldap_connect_system: successful connection to the LDAP server//
//Exporting account policy//
//Exporting groups//
//ldapsam_setsamgrent: 0 entries in the base!//
//Exporting users//
//smbldap_search_paged: base => [dc=labo,dc=fr], filter => 
[(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//

//smbldap_search_paged: search was successful//
//init_sam_from_ldap: Entry found for user: balezo//
//smbldap_search_domain_info: Searching 
for:[(&(objectClass=sambaDomain)(sambaDomainName=LABO))]//

//smbldap_open_connection: connection opened//
//ldap_connect_system: successful connection to the LDAP server//
//ERROR: Got 0 entries for gid 100, expected one//
//Forcing Primary Group to 'Domain Users' for balezo//
//primary group of [balezo] not found//
//Ignoring group memberships of 'balezo' 
S-1-5-21-3929439064-1197820248-2386129086-6000: Unable to enumerate 
group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//

//init_sam_from_ldap: Entry found for user: calvigna//
//ERROR: Got 0 entries for gid 100, expected one//
//Forcing Primary Group to 'Domain Users' for calvigna//
//primary group of [calvigna] not found//
//Ignoring group memberships of 'calvigna' 
S-1-5-21-3929439064-1197820248-2386129086-6002: Unable to enumerate 
group memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)//

//init_sam_from_ldap: Entry found for user: currie//
//ERROR: Got 0 entries for gid 100, expected one//
/...
But suddenly he crashes with these errors:

/Failed to connect to ldap URL 'ldaps://ldap.intra.labo.fr/' - LDAP 
client internal error: NT_STATUS_BAD_NETWORK_NAME//
//Failed to connect to 'ldaps://ldap.intra.labo.fr/' with backend 
'ldaps': (null)//
//Could not open ldb connection to ldaps://ldap.intra.labo.fr/, the 
error message is: (1, None)//

//Exporting posix attributes//
//smbldap_search_paged: base => [dc=labo,dc=fr], filter => 
[(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]//

//smbldap_search_paged: search was successful//
//ERROR(): uncaught exception - 
local variable 'ldb_object' referenced before assignment//
//  File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py", 
line 160, in _run//

//return self.run(*args, **kwargs)//
//  File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", 
line 1013, in run//

//useeadb=eadb, dns_backend=dns_backend, use_ntvfs=use_ntvfs)//
//  File 
"/usr/local/samba/lib/python2.7/site-packages/samba/upgrade.py", line 
795, in upgrade_from_samba3//
//homes[username] = get_posix_attr_from_ldap_backend(logger, 
ldb_object, base_dn, username, "homeDirectory")/


Any Ideas ?

Ced T


Le 04/09/2012 11:10, Andrew Bartlett a écrit :

On Tue, 2012-09-04 at 10:17 +0200, Ced T wrote:

Hi
I successfully compiled samba4 on my ubuntu.
Actually, most our Linux servers are using en openldap base to authenticate.
All the samba 3 servers use this openldap base

/passdb backend = ldapsam:ldaps://ldap.intra.labo.fr// (in the smb.conf)

I tried to migrate the users account of my openldap database to internal
samba4 ldap database.
For this I used the myldap-pub.py script with this command line :

/./myldap-pub.py --ldap_uri=ldap://ldap-server.labo.fr \//
//--ldap_binddn="cn=admin,ou=administrateur,dc=labo,dc=fr"  \//
//--ldap_bindpwd="password" \//
//--output_basedn="dc=labo,dc=fr" \//
//--input_domain_name="DOMAIN"  \//
//--input_basedn="dc=labo,dc=fr" \//
//--import_accounts=Users \//
//--output_users_ou="ou=People" \//
//--remove_input_attributes="a lot of useless attributes"//

Use 'samba-tool domain classicupgrade' instead.

Andrew Bartlett



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] cifs question about home dir sharing.

2012-09-04 Thread L . P . H . van Belle
Hai, 
 
I have a question. 
 
i want to mount my users home dir with cifs 
 
met setup is like this. 
 
PDC 
/home/users/MYSMBUSERS 
 
now i want on my other server also mount these users. 
 
like this on BDC 
( in etc/fstab ) 
//192.168.249.226/users /home/users cifs 
credentials=/etc/samba/smbcredentials  0   0

Is it possible to preserve user rights like this. 
 
If i now look on the BDC all my users are root:root and not USERNAME:Domain 
Users 
 
of do i need to use NFS for this, i prefer cifs . 
 
Louis
 
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] [samba4] How to use my ldap users in sam.ldb?

2012-09-04 Thread Andrew Bartlett
On Tue, 2012-09-04 at 10:17 +0200, Ced T wrote:
> Hi
> I successfully compiled samba4 on my ubuntu.
> Actually, most our Linux servers are using en openldap base to authenticate.
> All the samba 3 servers use this openldap base
> 
> /passdb backend = ldapsam:ldaps://ldap.intra.labo.fr// (in the smb.conf)
> 
> I tried to migrate the users account of my openldap database to internal 
> samba4 ldap database.
> For this I used the myldap-pub.py script with this command line :
> 
> /./myldap-pub.py --ldap_uri=ldap://ldap-server.labo.fr \//
> //--ldap_binddn="cn=admin,ou=administrateur,dc=labo,dc=fr"  \//
> //--ldap_bindpwd="password" \//
> //--output_basedn="dc=labo,dc=fr" \//
> //--input_domain_name="DOMAIN"  \//
> //--input_basedn="dc=labo,dc=fr" \//
> //--import_accounts=Users \//
> //--output_users_ou="ou=People" \//
> //--remove_input_attributes="a lot of useless attributes"//

Use 'samba-tool domain classicupgrade' instead.

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] How to delete a domain controller from the active directory?

2012-09-04 Thread X-Dimension
After my migration tests, i have now three domain controllers in my active 
directory, but only one is online.
I've tried to remove the two other domain controllers with the active directory 
tool from MS RSAT, but it doesn't work. 

How can i delete the non used domain controllers completely?

Thx for help!  
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] [samba4] How to use my ldap users in sam.ldb?

2012-09-04 Thread Ced T

Hi
I successfully compiled samba4 on my ubuntu.
Actually, most our Linux servers are using en openldap base to authenticate.
All the samba 3 servers use this openldap base

/passdb backend = ldapsam:ldaps://ldap.intra.labo.fr// (in the smb.conf)

I tried to migrate the users account of my openldap database to internal 
samba4 ldap database.

For this I used the myldap-pub.py script with this command line :

/./myldap-pub.py --ldap_uri=ldap://ldap-server.labo.fr \//
//--ldap_binddn="cn=admin,ou=administrateur,dc=labo,dc=fr"  \//
//--ldap_bindpwd="password" \//
//--output_basedn="dc=labo,dc=fr" \//
//--input_domain_name="DOMAIN"  \//
//--input_basedn="dc=labo,dc=fr" \//
//--import_accounts=Users \//
//--output_users_ou="ou=People" \//
//--remove_input_attributes="a lot of useless attributes"//

/and it successfully worked/.

/This command line
/./ldbsearch -H /usr/local/samba/private/sam.ldb '(objectClass=user)'/
shows me the exported records of openldap database

But i'm unable to use these new records.
The command line :

/usr/local/samba/bin/wbinfo -u

returns :

Administrator
Guest
krbtgt
dns-ubvmware
onetestuser

Same problem with pdbedit:

usr/local/samba/bin/pdbedit -L
[sudo] password for tintanet:
UBVMWARE$:4294967295:
Administrator:4294967295:
dns-ubvmware:4294967295:
onetestuser:1000:
krbtgt:4294967295:
nobody:65534:nobody


How can i Configure samba4 to use the new exported records from my 
openldap database to authenticate ?


Here is my smb.conf

/# Global parameters//
//[global]//
//workgroup = DOMAIN//
//realm = LABO.FR//
//netbios name = UBVMWARE//
//server role = active directory domain controller//
//passdb backend = samba4//
//server services = +smb -s3fs//
//dcerpc endpoint servers = +winreg +srvsvc//
//
//
//[netlogon]//
//path = /usr/local/samba/var/locks/sysvol/labo.fr/scripts//
//read only = No//
//
//[sysvol]//
//path = /usr/local/samba/var/locks/sysvol//
//read only = No//
//[homes]//
//   comment = Home Directories//
//   browseable = no//
//   read only = no//
//   create mask = 0744//
//   create mode = 0744//
//   directory mask = 0755//
//   directory mode = 0755//
//
//[seeida]//
//   ntvfs handler = cifs//
//   cifs:server = 10.0.2.5//
//   cifs:share = see//
//   cifs:domain = DOMAIN//
//
//Thanks in advance for your help

Ced T
//
/

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Getting 8.3 samba short filenames in linux

2012-09-04 Thread Andrew Bartlett
On Sat, 2012-09-01 at 13:07 +0100, Dominic Raferd wrote:
> From a windows client it is easy and fast to obtain from a samba share 
> both the long filenames and the short 8.3 names by using DIR /x. Is 
> there a way for a Linux client to obtain this same information swiftly 
> for a large directory listing - or indeed for the samba server to show 
> this information? The only way I have found is using smbclient's altname 
> function but I seem to have to call this individually for each file, 
> which makes it very slow.
> 
> [In case you are wondering why anyone should want this info, it is to do 
> with an old DOS program which accesses a samba share.]

You can script smbclient using '-c'

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba