[Samba] Win7 Printing Issue

[Ray Manny]

I have a Fedora 17 Linux box and a HP Laser Jet Professional P1102 
attached via USB cable. I can send print job to this printer from the Linux box 
and it works fine. I use CUPS system for printing. I have another computer 
laptop that has Windows 7 as the operating system and I like to share 
files and printer that is attached to this Linux box. Therefore, I 
decided to install Samba version 3.6.12-1 and set the file and printer 
sharing as it is recommended by the following site:

https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/CUPS-printing.html

When I go to my PC I can see the hp laser jet printer Icon in the Network 
window. I set this hp laser jet as my default printer. I tried to print a file 
from Microsoft Words but nothing comes out of the server printer.

In the following I have the section of the Samba and smb.conf

 == Global Settings ===

 workgroup = workgroup
 server string = Samba Server Version %v
 hosts allow = 127. 192.168.1.
printcap name = cups
printing = cups

= Standalone Server Options
security = share

 Printing Options===
cups options = raw

===Share Definitions===

[homes]
    comment = Home Directories
    browseable = no
    writable = yes
    valid users = %S

[printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    writable = no
    use client driver = yes
    printable = yes

[allusers]
    comment = All Users
    path = /home/shares/allusers
    valid users = Rayman
    force group = users
    create mask = 0600
    directory mask = 0771
    writable = yes
;   browseable = yes


The result of testparm is:

Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
    server string = Samba Server Version %v
    security = SHARE
    log file = /var/log/samba/log.%m
    max log size = 50
    printcap name = cups
    idmap config * : backend = tdb
    hosts allow = 127., 192.168.1.
    cups options = raw

[homes]
    comment = Home Directories
    valid users = %S
    read only = No
    browseable = No

[printers]
    comment = All Printers
    path = /var/spool/samba
    guest ok = Yes
    printable = Yes
    print ok = Yes
    use client driver = Yes
    browseable = No

[allusers]
    comment = All Users
    path = /home/shares/allusers
    valid users = Rayman
    force group = users
    read only = No
    create mask = 0600
    directory mask = 0771




Please let me know what I am missing that nothing gets printed.

 
sincerely,
Ray
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba4/Windows DNS replication and administration issue

[Peter Storkey]

Hi all,

I am having trouble with DNS replication between a Linux/Samba 4.0.9 box and 
Windows Server 2012 domain controller, as well as administering the Linux DNS 
from the Windows DNS Manager snap-in.

First a little background. I am trying to integrate a Samba 4.0.9 server as a 
domain controller in an existing Windows Active Directory domain. The domain 
and forest are at Windows 2008R2 functional level with a single domain 
controller which was upgraded from Windows Server 2008 R2 to Windows Server 
2012.

I am running CentOS 6.4 x64, patched to current levels. I downloaded  and 
installed the Sernet binaries for Samba 4.0.9 but ran into problems joining the 
domain. It failed with the following error:

ERROR: no subClassOf 'top' for 'samDomain'
I found a bug report for this error at 
https://bugzilla.samba.org/show_bug.cgi?id=8680 and rebuilt the Sernet RPMs 
with the patches implemented. This time I was able to successfully join the 
domain. Replication seems to be working but I do get a warning from samba-tool 
drs showrepl:

 KCC CONNECTION OBJECTS 

Connection --
Connection name: 3c20a62a-ad94-40ef-b346-ba8b15f829f8
Enabled: TRUE
Server DNS name : server.example.com
Server DN name  : CN=NTDS 
Settings,CN=server,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
TransportType: RPC
options: 0x0001
Warning: No NC replicated for Connection!

The inbound and outbound neighbors all appear to be ok.

I started out with internal DNS but when I was unable to get it working 
correctly, I switched to bind (Centos package 
bind-9.8.2-0.17.rc1.el6_4.6.x86_64). 

The problem is that when I try to administer DNS through the Windows DNS 
Manager snap-in, my forward domain fails to load, with an error indicating zone 
data may be corrupt (it opens fine on the Windows DNS server). Additionally, my 
reverse zone does not appear to have replicated to the Linux server. 

When I click on the forward zone in DNS Manager, I see the following in 
/var/log/messages:

smbd[24043]: [2013/09/01 15:30:21.091035,  0] 
../source3/rpc_server/svcctl/srv_svcctl_nt.c:326(_svcctl_OpenServiceW)
smbd[24043]:   _svcctl_OpenServiceW: Failed to get a valid security 
descriptorfree_pipe_context: destroying talloc pool of size 275
samba[19596]: [2013/09/01 15:30:25.505483,  0] 
../source4/rpc_server/dnsserver/dcerpc_dnsserver.c:1068(dnsserver_query_zone)
samba[19596]:   dnsserver: Invalid zone operation IsSigneddnsserver: Invalid 
zone operation IsSigneddnsserver: Invalid zone operation IsSigneddnsserver: 
Found Unhandled DNS record type=49dnsserver: Found Unhandled DNS record 
type=49dnsserver: Found Unhandled DNS record type=49dnsserver: Found Unhandled 
DNS record type=49ndr_push_error(2): Bad switch value 49 at 
default/librpc/gen_ndr/ndr_dnsserver.c:544
samba[19596]: [2013/09/01 15:30:26.272723,  0] 
../source4/rpc_server/dnsserver/dnsdata.c:354(dnsp_to_dns_copy)
samba[19596]:   dnsserver: Found Unhandled DNS record type=49dnsserver: Found 
Unhandled DNS record type=49dnsserver: Found Unhandled DNS record 
type=49dnsserver: Found Unhandled DNS record type=49ndr_push_error(2): Bad 
switch value 49 at default/librpc/gen_ndr/ndr_dnsserver.c:544

Querying DNS via nslookup/dig/host works fine but querying through samba-tool 
gives an error:

# samba-tool dns query server.domain.com domain.com @ ALL
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'sasl-DIGEST-MD5' registered
GENSEC backend 'schannel' registered
GENSEC backend 'spnego' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Using binding ncacn_ip_tcp:server.example.com[,sign]
ERROR(runtime): uncaught exception - (-1073545204, 
'NT_STATUS_RPC_BAD_STUB_DATA')
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175, 
in _run
return self.run(*args, **kwargs)
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/dns.py", line 974, in 
run
None, record_type, select_flags, None, None)

and I see the following in /var/log/messages:

samba[19596]: [2013/09/01 15:31:55.207112,  0] 
../source4/rpc_server/dnsserver/dnsdata.c:354(dnsp_to_dns_copy)
samba[19596]:   dnsserver: Found Unhandled DNS record type=49dnsserver: Found 
Unhandled DNS record type=49dnsserver: Found Unhandled DNS record 
type=49dnsserver: Found Unhandled DNS record type=49ndr_push_error(2): Bad 
switch value 49 at default/librpc/gen_ndr/ndr_dnsserver.c:544

Any help would be much appreciated.

Thanks,

Pete
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Disable password complexity does not work?

[George]

Good to know that, in my case I don't have any Windows DC, but by setting
the GPO I was able to set up simple passwords when *creating* users. Not
really sure what happens when those users want to change their passwords
from Windows (which does not really happen often in my environment anyway).
There must be the catch.

Regards!


On Mon, Sep 2, 2013 at 5:12 PM, Andrew Bartlett  wrote:

> On Mon, 2013-09-02 at 11:15 -0700, Gregory Sloop wrote:
> > IIRC, GPO's can't be used to configure Password CR on an S4 server.
> > [Well you can do it, but it isn't enforced properly...]
> >
> > I'm not sure what would happen in a mixed S4 and Windows server AD
> > domain.
> >
> > Again, that's IIRC - but I think that's the case.
>
> That is correct on both counts, we do not honour it currently (GSoC
> project to do this is in progress), but if a windows DC changes the AD
> database to match the GPO, we will honour that.
>
> Andrew Bartlett
>
> --
> Andrew Bartlett
> http://samba.org/~abartlet/
> Authentication Developer, Samba Team   http://samba.org
> Samba Developer, Catalyst IT   http://catalyst.net.nz
>
>
>
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] smbd looking for non existent files

[steve]

On Mon, 2013-09-02 at 23:02 +0200, Michael Wood wrote:
> Is the load the same even if you turn down the logging?

Yes, but don't rely on the 0.7%. It's a constant load but not exact. I'm
getting the figures by running 'top'. e.g. 18 clients produce a constant
load of 16%. I can see where you're coming from. If I log to the file
rather than tail -f in real time it's a bit better, but you need a lot
of clients to be able to notice it.

I've started replacing LXDE with KDE. It's slower, but we'll be able to
have all the clients connected at once. I've also tried asking on my
distro list. Nada.


> > Hi
> >
> > The problem is that each Linux client adds 0.7% to smbd. That's a
> > constant load. I realise it's not a Samba issue. I'll have to either
> > switch to another DE or revert the Linux boxes to xp.
> >
> > Steve
> >
> >
> >
> 
> 


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] oplocks for Access DB

[sond]

Hi Folks

First time poster here..

I have a Samba 3.4.7 ( will upgrade soon ) in a workgroup enviroment,
This server has a share containing various Access DB backends..

Wondering about the .ldb lock files that the client front-ends produce.. 
and if the oplocks and veto options are still current ?

as various combinations i have tried don't seem to work..

Would be keen to hear how others handle Access back ends on Samba shares..

cheers


sond

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] smbd looking for non existent files

[Michael Wood]

Is the load the same even if you turn down the logging?

On 9/2/13, steve  wrote:
> On Sun, 2013-08-25 at 12:37 +0200, Michael Wood wrote:
>> On 24 August 2013 22:39, steve  wrote:
>> On Sat, 2013-08-24 at 20:57 +0200, Michael Wood wrote:
>> > Hi
>> >
>> > On 24 August 2013 19:05, steve  wrote:
>> > Hi
>> > 4.0.8 file server in a 4.0.8 domain
>> >
>> > After a user logs in on a Linux client which is
>> joined to the
>> > domain,
>> > smbd is constantly looking for files which don't
>> exist:
>> >
>> >
>> > smbd has no reason to look for those files unless the client
>> asks for
>> > them.
>> >
>> >
>> > I suspect you just need to turn down the debug level a bit.
>> >
>> > Here is the file server log after a user login to a
>> Linux
>> > client has
>> > settled down:
>> > [2013/08/24 18:43:24.748511,
>> > 3] ../source3/smbd/vfs.c:1140(check_reduced_name)
>> >   check_reduced_name [steve2/.icons/gnome]
>> [/home/users]
>> >  [...]
>>
>>
>> Hi
>> But if I turn the log level down, it's only at 3, that doesn't
>> stop it
>> looking. Does it?
>>
>>
>> No, of course not.
>>
>> As you say, steve2/.icons/gnome must be coming from the Linux
>> client.
>> Would it be correct to eliminate samba from this issue? My
>> fear is that
>> scaling this up by replacing windows boxes with Linux is going
>> to grind
>> the whole thing to a halt.
>>
>>
>> Since it's the client asking for those files, this will be no
>> different if you were running a Windows server.  Except that the
>> windows server will not log all the "file not found" messages.
>>
>> Watching tail -f log.smbd is scary.
>>
>>
>> Then turn down the log level! :)  Turn it up again if you're having
>> problems, of course, but this just looks like normal stuff that you
>> should not need to worry about.
>
> Hi
>
> The problem is that each Linux client adds 0.7% to smbd. That's a
> constant load. I realise it's not a Samba issue. I'll have to either
> switch to another DE or revert the Linux boxes to xp.
>
> Steve
>
>
>


-- 
Michael Wood 
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 consumes more CPU

[Andrew Bartlett]

On Mon, 2013-08-26 at 22:39 +0530, Prema wrote:
> Dear Andrew,
> 
> As per your suggestion , I have attached the gdb log of the samba and smbd
> process log running in the single server mode.
> Also when I noted in the perf top, libndr.so consumes the maximum cpu.
> I noticed that it happens soon after sometime the samba process is started
> and the CPU is filled up.
> Since the samba process occupies 100% atleast two or more CPUs out of 8 CPU
> , the clients are not able to get authenticate to the server.
> Kindly go through the logs and suggest what can be done to lessen the CPU
> consumption.

Digging into the libndr issue some more:

Sadly I can't use the perf.data without your full build tree, so I'm
going to need you to do some more digging on this side of things. 

Can you show me what exact code in libndr is spinning?  (That is, dig
into the perf screen)

Then, can you re-run it under 

'perf record -g -p '?

And then show me the output of perf report -g, expanding the first
function call stacks to find out what is the eventual high-level caller
of the spinning routine.  This may give us the critical clues we need.

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Disable password complexity does not work?

[Andrew Bartlett]

On Mon, 2013-09-02 at 11:15 -0700, Gregory Sloop wrote:
> IIRC, GPO's can't be used to configure Password CR on an S4 server.
> [Well you can do it, but it isn't enforced properly...]
> 
> I'm not sure what would happen in a mixed S4 and Windows server AD
> domain.
> 
> Again, that's IIRC - but I think that's the case.

That is correct on both counts, we do not honour it currently (GSoC
project to do this is in progress), but if a windows DC changes the AD
database to match the GPO, we will honour that.

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Disable password complexity does not work?

[Gregory Sloop]

IIRC, GPO's can't be used to configure Password CR on an S4 server.
[Well you can do it, but it isn't enforced properly...]

I'm not sure what would happen in a mixed S4 and Windows server AD
domain.

Again, that's IIRC - but I think that's the case.

-Greg


G> Hi,

G> I disabled the password complexity requirements in my domain via group
G> policy. "Computer Configuration", "Windows Settings", "Security Settings",
G> "Account Policies". There you can configure it exactly as you want.

G> Best regards.


G> On Sun, Sep 1, 2013 at 3:18 AM, Szymon Życiński wrote:

>> Hello
>>
>> I use Samba 4.0.9 and want to disable strong passwords. I've run:
>> ./samba-tool domain passwordsettings set --complexity=off
>>
>> But it seems to not work. If users try to change password via ctrl+alt+del
>> windows still require strong password. Restarting samba to commit change
>> did not solve problem.
>>
>> Is there something i forgot? On my old configuration with old (RIP) server
>> it worked flawessly.
>>
>> Szymon
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  
>> https://lists.samba.org/**mailman/options/samba
>>

-- 
Gregory Sloop, Principal: Sloop Network & Computer Consulting
Voice: 503.251.0452 x82
EMail: gr...@sloop.net
http://www.sloop.net
---

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Disable password complexity does not work?

[George]

Hi,

I disabled the password complexity requirements in my domain via group
policy. "Computer Configuration", "Windows Settings", "Security Settings",
"Account Policies". There you can configure it exactly as you want.

Best regards.


On Sun, Sep 1, 2013 at 3:18 AM, Szymon Życiński wrote:

> Hello
>
> I use Samba 4.0.9 and want to disable strong passwords. I've run:
> ./samba-tool domain passwordsettings set --complexity=off
>
> But it seems to not work. If users try to change password via ctrl+alt+del
> windows still require strong password. Restarting samba to commit change
> did not solve problem.
>
> Is there something i forgot? On my old configuration with old (RIP) server
> it worked flawessly.
>
> Szymon
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  
> https://lists.samba.org/**mailman/options/samba
>
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] samba Digest, Vol 129, Issue 2

[paulw]

I am Currently out of the office and will return on Monday 9th September.
My email will not be monitor , so if you require assistance please email 
supp...@swift-computing.co.uk.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] DNS forwading for host *within* AD

[George]

Hi, I am currently running Samba 4.0.9 as a DC.

My AD domain and Kerberos realm is "domain.com". Although this was not
considered when we set up the domain, now we need "foo.domain.com" to be
resolved externally by our ISP DNS server.

I tried to configure BIND as a backend and to manuallly add a zone "
foo.domain.com", type forward, but it does not work (Samba DLZ seems to be
taking precedence). Any suggestions??

A somewhat cheap hack would be to add an A record for "foo" and make a cron
script to update it with samba-tool on a regular basis. But first I would
like to get a more proper solution.

Thanks a lot.

George
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] How to allow users to be local admin

[Marc Muehlfeld]

Hello Götz,

Am 02.09.2013 14:43, schrieb Götz Reinicke - IT Koordinator:

it's some time that I had to touch our samba installation and may be
somewon can point me to the right direction.

We run a samba-3.6.9 PDC with ldap backend and windows 7 clients.
Everything for normal users is working fine (domain logon, roaming
profiles).

But now we'd like to enable our systemadministartors to login to any
workstation with there domain user and install software or do other
administrative things.

I'v read a bit about domian accounts and mappings. But I'm not sure
where to add or change what.

The admins affected are also in a special posix group.

There are also "Domain Admins" and "Administrators" posix groups and net
groupmap entries.

Would be great if some one can help me.


I'm not sure if this is possible with an NT4-style domain. With (Samba) 
AD it is, if you plan to migrate. Then you can use "restricted groups" 
for that 
(http://community.spiceworks.com/how_to/show/907-gpo-to-push-out-local-administrators-across-a-domain).


I don't know how many clients you have. If it's a manageable size, you 
can create a group in your domain, go to each workstation and add this 
domain group to the local administrators group once. Then everyone who 
is member of that domain group is automatically local admin on each of 
that machines (this is what you do with the "restricted group" in AD in 
2 mins, without leaving your desk). You only have to add this domain 
group on every PC you reinstall.


But if it's a possibility, migrate to Samba AD. AD brings you many great 
features, expecially GPO, multi master replication, etc.



Regards,
Marc
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Disable password complexity does not work?

[Bjoern Baumbach]

Hello Szymon,

On 09/01/2013 08:18 AM, Szymon Życiński wrote:
> I use Samba 4.0.9 and want to disable strong passwords. I've run:
> ./samba-tool domain passwordsettings set --complexity=off
> 
> But it seems to not work. If users try to change password via
> ctrl+alt+del windows still require strong password. Restarting samba to
> commit change did not solve problem.

do you still need a _complex_ passwords or just passwords with a minimum
length of 7 chars?
Disabling the complexity does not disable the minimum password length.

Björn

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-37-0, fax: +49-551-37-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kont...@sernet.de
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] How to allow users to be local admin

[Götz Reinicke - IT Koordinator]

Hi,

it's some time that I had to touch our samba installation and may be
somewon can point me to the right direction.

We run a samba-3.6.9 PDC with ldap backend and windows 7 clients.
Everything for normal users is working fine (domain logon, roaming
profiles).

But now we'd like to enable our systemadministartors to login to any
workstation with there domain user and install software or do other
administrative things.

I'v read a bit about domian accounts and mappings. But I'm not sure
where to add or change what.

The admins affected are also in a special posix group.

There are also "Domain Admins" and "Administrators" posix groups and net
groupmap entries.

Would be great if some one can help me.

Thanks and regards . Götz

-- 
Götz Reinicke
IT-Koordinator

Tel. +49 7141 969 82 420
Fax  +49 7141 969 55 420
E-Mail goetz.reini...@filmakademie.de

Filmakademie Baden-Württemberg GmbH
Akademiehof 10
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016

Vorsitzender des Aufsichtsrats: Jürgen Walter MdL
Staatssekretär im Ministerium für Wissenschaft,
Forschung und Kunst Baden-Württemberg

Geschäftsführer: Prof. Thomas Schadt

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] smbd looking for non existent files

[steve]

On Sun, 2013-08-25 at 12:37 +0200, Michael Wood wrote:
> On 24 August 2013 22:39, steve  wrote:
> On Sat, 2013-08-24 at 20:57 +0200, Michael Wood wrote:
> > Hi
> >
> > On 24 August 2013 19:05, steve  wrote:
> > Hi
> > 4.0.8 file server in a 4.0.8 domain
> >
> > After a user logs in on a Linux client which is
> joined to the
> > domain,
> > smbd is constantly looking for files which don't
> exist:
> >
> >
> > smbd has no reason to look for those files unless the client
> asks for
> > them.
> >
> >
> > I suspect you just need to turn down the debug level a bit.
> >
> > Here is the file server log after a user login to a
> Linux
> > client has
> > settled down:
> > [2013/08/24 18:43:24.748511,
> > 3] ../source3/smbd/vfs.c:1140(check_reduced_name)
> >   check_reduced_name [steve2/.icons/gnome]
> [/home/users]
> >  [...]
> 
> 
> Hi
> But if I turn the log level down, it's only at 3, that doesn't
> stop it
> looking. Does it?
> 
> 
> No, of course not.
>  
> As you say, steve2/.icons/gnome must be coming from the Linux
> client.
> Would it be correct to eliminate samba from this issue? My
> fear is that
> scaling this up by replacing windows boxes with Linux is going
> to grind
> the whole thing to a halt.
> 
> 
> Since it's the client asking for those files, this will be no
> different if you were running a Windows server.  Except that the
> windows server will not log all the "file not found" messages.
>  
> Watching tail -f log.smbd is scary.
> 
> 
> Then turn down the log level! :)  Turn it up again if you're having
> problems, of course, but this just looks like normal stuff that you
> should not need to worry about.

Hi

The problem is that each Linux client adds 0.7% to smbd. That's a
constant load. I realise it's not a Samba issue. I'll have to either
switch to another DE or revert the Linux boxes to xp.

Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba