[Samba] Quick question... Is this a bad idea?

2003-10-17 Thread BWoodley 
This would give full root access through samba, but is this a dumb idea?

[root]
comment = ROOT
path = /
read only = yes
browsable = no
valid users = DATANAT.COM+BAW
force user = root

Thanks!


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

[Samba] Guest users when security=ads

2003-10-14 Thread BWoodley 
Is it possible to have the samba shares accessible to anyone when ADS
security is used? Currently all domain users are working great! Even if
your not joined to the domain, but your login in windows matches a domain
login, you will still pull up the root shares (although access is
restricted). If a pc pulls up samba with an unknown username/password, they
are prompted to enter one... how could I make the shares visible to all? as
there is a share that is public which is not a security problem...

Thanks allot for the input!

Brian Woodley


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

[Samba] ADS users on RedHat 9 Samba 3

2003-10-13 Thread BWoodley 
I'm having the toughest time getting this to work... I have a windows 2000
domain and i'm in the process of adding a Samba fileserver... All of the
setup guides i have seen point me in the right direction, but fail to
provide assistance for my single problem...

basically i've figured out that if i have security = share. I can run the
gentent passwd command and see the domain accounts in the list! thats
great!!! but if i have security = ads, then the users disappear when i run
the command. and i have to have a matching user account in linux to access
the shares at all, and thats just plain silly!!!

I do see one error in the log.winbindd but i am unable to get past it.


[2003/10/13 14:52:28, 1] nsswitch/winbindd.c:main(832)
  winbindd version 3.0.0 started.
  Copyright The Samba Team 2000-2003
[2003/10/13 14:52:29, 1] nsswitch/winbindd_util.c:add_trusted_domain(149)
  Added domain DATANAT DATANAT.COM
[2003/10/13 14:52:29, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/10/13 14:52:29, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list

I did kinit, net ads join, and can test via wbinfo  smbclient... all is
well!!! just no getent passwd or groups

I also dont see the kerberos error when winbindd starts in share mode...

Where can I look? HELP!!!

I've given my smb.conf, krb5.conf, and ldap.conf... The nsswitch.conf is
set and so are the PAM's

SMB.CONF

[global]
workgroup = DATANAT
realm = DATANAT.COM
server string = Linux File Server
security = ads
encrypt passwords = yes
password server = 140.100.10.150
domain logons = yes
log file = /var/log/samba/log.%m
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
dns proxy = No
netbios name = DCLINUX
guest account = nobody
winbind enum users = yes
winbind enum groups = yes
wins server = 140.100.10.150
winbind separator = +
winbind cache time = 15
template shell = /bin/bash
template homedir = /home/%D/%U
winbind uid = 1-2
winbind gid = 1-2
idmap uid = 500-65535
idmap gid = 100-65535

KRB5.CONF

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 ticket_lifetime = 24000
 default_realm = DATANAT.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true
 forwardable = true
 proxiable = true
 default_etypes = des-cbc-crc des-cbc-md5
 default_etypes_des = des-cbc-crc des-cbc-md5

[realms]
 DATANAT.COM = {
 kdc = dcpdc.datanat.com:88
 admin_server = 140.100.10.150:749
 default_domain = datanat.com
}

[domain_realm]
 .datanat.com = DATANAT.COM
 datanat.com = DATANAT.COM
[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

LDAP.CONF

host 140.100.10.150
base dc=datanat,dc=com
nss_map_objectclass posixAccount User
nss_map_attribute uid sAMAccountName
nss_map_attribute uniqueMember Member
nss_map_attribute homeDirectory msSFUHomeDirectory
nss_map_objectclass posixGroup Group
pam_login_attribute sAMAccountName
pam_filter objectclass=User
ssl no
pam_password ad
ldap_version 3
binddn cn=Administrator,cn=Users,dc=datanat,dc=com
bindpw dc030103
port 389

Thanks for the support!!!


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba