Re: [Samba] Windows 8 Pro no domain logon possible
On Fri, Sep 21, 2012 at 11:10:56AM +0200, Roland Schwingel wrote: > Hi Andrew... > > Andrew Bartlett wrote on 20.09.2012 19:56:30: > > > > No, it is not possible to use another LDAP server instead of > > > > Samba 4's > > > > built-in LDAP implementation. At one point there was support for > > > > this, but as far as I understand it, it is not technically > > > > possible to > > > > make it work properly and the support was removed/deprecated. > > > This is bad. Is it really expected to migrate over all data which is > > > most likely present in companies current LDAP solutions to the samba > > > ldap? Can samba ldap fullfill all needs here (eg. rock solid life > > > replication and general purpose usage?). I would very much appreciate > > > the possibility of being able to not use the embedded ldap. This would > > > very much reduce the effort of moving from samba3 to 4 in > > > existing ldap environments. > > We spent considerable effort over a period of years in attempting to > > make this possible. It is not. Even if it was, it would not involve > > 'simply' reading the companies LDAP server, it would be a very intrusive > > change no more acceptable than using our own built-in LDAP server. > Hmmm... I see... > > This will very much complicate migration from samba 3 to 4 if you are > having an existing infrastructure. We use our LDAP for > users,groups,dns,dhcp,networks and a lot of other things. So you say > if one wants to use samba 4 (s)he has to move fully over to the ldap > of samba4 and abandon the current infrastructure? This is quite a > burden and will take many months. So it won't happen here in a > forseable time even samba 4 would be released today as a final > stable version. I believe I am not the only one having these > concerns. Don't get me wrong, I would love to get AD support but the > road from an at present well working (beside of windows 8 yet) > domain infrastructure for windows hosts and seamless integration of > linux and Mac OS hosts to samba 4 based AD appears to become very > long and hard. I hope you will maintain samba 3 for a longer time > (including windows 8 support). For what I understand, not making possible to merge 2 LDAPs (enterprise with smb4 internal) does not imply that it is not possible to integrate Samba 4 into a large environment. The problem IMHO simply shift from a merging into a sincronization problem... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Samba + Win7
On Tue, Sep 18, 2012 at 07:20:23PM +0200, Dominique wrote: > Hi list, > > I was successfully running samba 3 with windows 7 and ldap. Please, which version of Samba 3? -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Making Happy Users ... I need to understand...
On Mon, Aug 13, 2012 at 11:19:36AM -0300, Marcio Merlone wrote: > Em 07-08-2012 19:08, Marco Ciampa escreveu: > >Why I have to do this? If I have disabled browing profiles (am I > >right in disabling this option?) why I should exclude some dirs > >from the browsing profiles if they do not actually have any chance > >to be replicated? > > The profiles share is important to have romaing profiles, i.e. user > profiles get saved on the server when the user logoff the > workstation, so it can be loaded on another machine, if the user > changes workstation. This is the source of slow-down login/logoff: > the profile must be transfered from and to the server. Understood. > If you disable this, obviously you loose also the feature. This is _not_ so obvious. Since when you log on, if the user is not already present in the machine, the user data is created by copying the "Default user" as a template that _has_ these setting in the registry: http://www.samba.org/samba/docs/man/Samba-Guide/happy.html#proffold redirections inside the user registry. > Disable if you don't need it. > This share is not meant for the admin to fool > around user's files, but to provide a feature. Understood. > Folder redirection is a mean to off-load this data transit between > server x workstation, pointing potentially 'fat' folders outside the > user profile, so they don't get touched on login/logout. Meaningless > if you disable profiles share. Understood. You could be right (probably) since all the hints received here from this list _and_ the Samba manual examples tell me to _enable_ folder redirection to have this feature enabled. I was just wondering why. I thought that having the redirection already in the user registry that could be enought. I'll do some tests. I am almost shure that I have to leave it enabled to have the folder redirection working, I was only asking myself why I have to do it. Thanks to all. -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Making Happy Users ... I need to understand...
On Sat, Aug 11, 2012 at 11:02:51AM -0400, John Drescher wrote: > On Sat, Aug 11, 2012 at 5:16 AM, Marco Ciampa wrote: > > If OT someone could please point me to the right mailing list? > > This is the correct mailing list. It's just that people do not always > have time to offer free advice. Ok thanks. I am a little insecure. I am always afraid to have said something wrong (grammar apart). -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Making Happy Users ... I need to understand...
If OT someone could please point me to the right mailing list? TIA -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] Making Happy Users ... I need to understand...
Hello, I'm posting here because I'm in a need to understand. Sorry for my bad english. I know that I could figure out how to make it work with a "trial and error" method but I do want to know how it works and not to do "a là Windows"... I work in a high school. Debian GNU/Linux 5.0 Samba 3.2.5 + LDAP (I know I have to update ...) Browsing user profiles are useful but they are really slowing down our network and login times... so I disabled this option setting in smb.conf from: logon home = \\%N\profile logon path = \\%N\profile to: logon home = logon path = disabling browsing profiles at all. All works well creating the profiles on the fly from the Defaul User profile. But since the browsing profiles are useful, I followed this guide to use the profile data from the lan: http://www.samba.org/samba/docs/man/Samba-Guide/happy.html#id2581407 and I understand all but this: > Now follow the procedure given in “The Local Group Policy”. Make > sure that each folder you have redirected is in the exclusion list. Why I have to do this? If I have disabled browing profiles (am I right in disabling this option?) why I should exclude some dirs from the browsing profiles if they do not actually have any chance to be replicated? Many thanks to whom will be so kind to enlight me about this (obscure?) Samba feature... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Password expires every month even though 'Password Must Change' is set to 'never' (Samba+LDAP)
On Wed, Oct 12, 2011 at 11:16:42AM -0400, Aaron E. wrote: > Just cuirous are you using pam or ldap backend? > > On 10/12/2011 09:22 AM, Marco Ciampa wrote: [...] If the "you" is me, I'm using ldap. -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Password expires every month even though 'Password Must Change' is set to 'never' (Samba+LDAP)
On Wed, Oct 12, 2011 at 12:15:16PM +0800, Jeffrey Chan wrote: > Hi all, > > I've posted this a month ago but haven't gotten a reply. Can anyone please > help? > > - Jeff > > > > On Mon, Aug 29, 2011 at 5:14 PM, Jeffrey Chan wrote: > > > Hi all, > > > > Since a few months ago Samba ask each of our users to change password at > > log on every month and I have not been able to disable it. > > > > I found this page and follow the instructions: > > > > > > http://playingwithsid.blogspot.com/2010/12/change-samba-password-expiry-setting.html > > > > The default ‘Password Must Change’ policy was set to never and pdbedit > > shows ‘Password Must Change: never’ for each user, yet the passwords still > > get expire once a month. > > > > Can anyone please give me some pointers? > > > > - Jeff Just a hint (maybe wrong...) obey pam restrictions = No ... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] winXP client always requesting password change
On Thu, Sep 15, 2011 at 09:39:26PM +0200, Marco Ciampa wrote: > On Thu, Sep 15, 2011 at 11:06:14AM +0200, Marco Ciampa wrote: > > SAMBA 3.4.8 on Debian + ldap (Windows domain) > > > > Some users created via smbldaptools (in a school). > > > > After summer holidays found that some (last year) accounts force you to > > change the password at login. > > ... I'm so stupid. changing obey pam restrictions from yes to no resolved Sorry for the noise... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] winXP client always requesting password change
On Thu, Sep 15, 2011 at 11:06:14AM +0200, Marco Ciampa wrote: > SAMBA 3.4.8 on Debian + ldap (Windows domain) > > Some users created via smbldaptools (in a school). > > After summer holidays found that some (last year) accounts force you to > change the password at login. > > If you change the password the sistem lanconingly warning that to enter > you have to change your password (just done!) and refuses to let you > enter... > > If I delete and recreate the account, it works. Checking with smbldap or > pdbedit or net sam tools, all the tools says that the password change is > disabled and the password do not expire... > > I do not know where to look for the problem... > > Any hint? And... looking into the ldap data of 2 different users, I do not see any meaningful differeces... is it possible that a bad configured samba server could use (part of) info from any other source (tdb?) and part from ldap? PS: I do not use winbind...could be a problem? -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] winXP client always requesting password change
SAMBA 3.4.8 on Debian + ldap (Windows domain) Some users created via smbldaptools (in a school). After summer holidays found that some (last year) accounts force you to change the password at login. If you change the password the sistem lanconingly warning that to enter you have to change your password (just done!) and refuses to let you enter... If I delete and recreate the account, it works. Checking with smbldap or pdbedit or net sam tools, all the tools says that the password change is disabled and the password do not expire... I do not know where to look for the problem... Any hint? -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] rebuilt XP machine cannot see Samba server
On Fri, Apr 08, 2011 at 06:03:58PM -0700, rodneytoady wrote: > OK. Solution found. For some reason I had to add the linux box name to my > laptop's host file. Now it works. However, I'm sure that's not mentioned in > the sambe connection instructions I've read, so it's probably to do with how > I've configured my Windows network, not with Samba. Should I be using some > kind of Windows LMHOSTS or something to allow it to find the samba server > without editing my hosts file? Enable the SAMBA wins service and add the wins server config in Windows clients (statically or by dhcp). -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Unreliable connection to Samba PDC - Connections get lost, Roaming Profiles do not sync, Files can't be written, etc..
On Wed, Mar 30, 2011 at 11:21:13PM +0300, Tom H. Lautenbacher wrote: > Hello all! > > I am having severe problems with my Samba PDC. > > 1. My Roaming profile in 3 out of 10 times does not get synchronized ... > > 2. When I edit a document (e.g. word .docx) which is located on a ... > > 3. Sometimes the connection to the PDC get's lost in the middle of a ... > > What I have tried: > 1. Changed TP-Cable between client and server > 2. Changed Network Switch between client and server (and switched > from 100MBit to Gigabit) > 3. Upgraded Samba to the (then) newest version, which was 1 year > newer than the previous one > 4. Re-added the client to the domain and? What is missing here? 5. change (probably broken) network adapter and/or motherboard (interrupt or DMA controllers else run iperf or nuttcp apt-get install iperf or apt-get install nuttcp 6. an don't forget to try memtest86+ on both sides... > Nothing helped... ;-( > > What is going on here? > The client that connects to the PDC is Windows 7, 64bit > > ANY ideas, hints, approaches are HIGHLY APPRECIATED!! done :-) If problem found, remember to post here in anycase! -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Samba PDC adding new user, profile dir is not created
On Wed, Mar 16, 2011 at 11:09:59AM +0100, J. Echter wrote: > Hi, > > i have a Samba PDC (no LDAP) and added add user script to my config. > > I can create the user with no problems, login is possible but the > /home/samba/profile/user dir is not created. > > Any hints on that? IMHO you have to create it with a script. In that script you will create the user (with useradd) and then the profile dir... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Access to a share resource without password
On Mon, Feb 28, 2011 at 12:21:32AM -0300, J. L. Cabral wrote: > Chris, after following Marco guideline and fail I followed the > tutorial you recommend to me, please see below: [...] just to remember you to post even when successful. We are interested in knowing what went wrong... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Access to a share resource without password
On Mon, Feb 28, 2011 at 12:05:32AM -0300, J. L. Cabral wrote: > Marco, I followed your instructions and I couldn't connect, my config is: > > [global] > workgroup = CASA > netbios name = bangkok > security = user > passdb backend = tdbsam > map to guest = bad password > username map = /etc/samba/smbusers > > [grabar] > comment = file sharing > path = /var/share ^^^ why not: path = /home/pepe ??? is it a problem? > browseable = yes > public = yes > writeable = yes > create mode = 0644 > force user = pepe > force group = pepe > > I have: > > drwxrwxrwx root nobody /var/share > > and I add user pepe: > > # useradd -s /sbin/nologin pepe > > After that I restart samba: > > # /etc/init.d/smb restart > > and fro Windows XP machine I do: > > net use X: \\10.4.133.109\grabar > > and after that I see the resource in my Explorer OK! > but when I want to > enter into it with double click I get: > > ACCESS DENIED so it seems a problem of local permissions, not SAMBA ... > > The smb.log is: > > [2011/02/27 23:52:25, 0] lib/util_sock.c:get_peer_addr(1224) > getpeername failed. Error was the connection peer is not connected > [2011/02/27 23:52:25, 0] lib/util_sock.c:read_data(534) > read_data: read failure for 4 bytes to client 0.0.0.0. Error = > connectio reinitialized by remote machine > [2011/02/27 23:52:25, 1] smbd/service.c:make_connection_snum(1077) > kari (10.4.132.61) connect to service grabar initially as user pepe > (uid=500, gid=500) (pid 31657) > [2011/02/27 23:52:29, 1] smbd/fake_file.c:open_fake_file(116) > open_fake_file_shared: access_denied to service[grabar] > file[$Extend/$Quota:$Q:$INDEX_ALLOCATION] user[pepe] > [2011/02/27 23:52:29, 1] smbd/fake_file.c:open_fake_file(116) > open_fake_file_shared: access_denied to service[grabar] > file[$Extend/$Quota:$Q:$INDEX_ALLOCATION] user[pepe] > > Can you help me again ??? > > THANKS A LOT > > JeLo > if you do from root: #su -s /bin/bash pepe user pepe is able to write to /var/share -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Access to a share resource without password
On Fri, Feb 25, 2011 at 12:22:12PM -0300, J. L. Cabral wrote: > Dear, I have a Linux Samba server and a Windows XP SP2 client joined > to the "g-company.net" domain. > > I want to access a Linux share resource in /var/share without password > from WXP desktop FROM ANY USER. > > This is my scenario: > > - I don't create any Linux local user because I want total access from any > user > > - I use security = share Why? -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] error adding a user
On Mon, Jan 03, 2011 at 09:54:39AM +0100, Daniel Müller wrote: > First of all which kind of Windows are you using. Usermgr with XP is ok > with Windows Vista/7 no chance. ok I'm using XP... > To use usrmgr under xp and 2000 you must fit your ldap.conf and your > smb.conf and youse smbldap-tools or similar: > in your smb.conf there should be something like: > add user script = /usr/local/sbin/smbldap-useradd -A 1 -B 1 -m -k /dummy > "%u" if I use: add user script = smbldap-useradd -a -m "%u" it gives me the error reported above. If I use: add user script = smbldap-useradd -m "%u" it works. It seems that Samba creates the samba specific objects to the ldap server directly. If I am no wrong, the option -a to smbldap-useradd should be used only if the script is called from outside samba (as in a user populating script, for example...) Am I write or am I wrong? I understand that these basic concepts are important. I can't do forward without before clarifying this ... :-( > > to fit the right params for your linux OS you have to try. > > > or ldap.conf, ex : > basedc=your,dc=domain > nss_base_passwd ou=Users,dc=your,dc=domain?sub > nss_base_passwd ou=Computers,dc=your,dc=domain?sub > nss_base_shadow ou=Users,dc=your,dc=domain?sub > nss_base_group ou=Groups,dc=yourc,dc=domain?one > > In your slapd.conf , ex: > access to attrs=sambaLMPassword > by self write > by anonymous auth > by dn="cn=admin,dc=your,dc=domain" write > by * none > > access to attrs=sambaNTPassword > by self write > by anonymous auth > by dn="cn=admin,dc=your,dc=domain" write > by * none > > access to attrs=sambaPwdLastSet,sambaPwdMustChange > by self write > by anonymous auth > by dn="cn=admin,dc=your,dc=domain" write > by * none > My slapd.conf is this, for what I understand, it could be right... access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=lsgalilei,dc=org" write by anonymous auth by self write by * none Ok Next problem: User deleting through usermanager is not able to delete the home directory. Maybe it is this fault: ldap delete dn = yes if Samba delete the ldap object the smbldap-userdel script have no chance to delete an already deleted user... setting ldap delete dn = no seems to cure. Again: am I right or am I totally wrong? Next problem: I can't browse the groups during user creation step in the usermanager or, after creating the user, browse its groups... It seems (looking into samba logs) that it insists to search a group "Users" instead of "Domain Users"... mmm where could it be wrong? Ldap or Samba ... tomorrow I will investigate more deeply... Thank you _very much_ for your help and support. Very often happens to me that just the action of trying to expose a problem to someonelse help me a lot clarifying myself... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] error adding a user
On Sun, Jan 02, 2011 at 04:48:29PM -0500, John Drescher wrote: > I would just add the user in ldap directly. LAM is a good tool to do > that and pretty easy to use. > > http://www.ldap-account-manager.org Yes, I know, you are right but... ...but that question I mailed is because I want to understand what is going on. I do not want just to turn around the problem. I want to understand...I was asking if someone has encountered a similar problem just to have a hint on where start fiddling to understand & fix the problem. Sorry for the noise...(returning to study some Samba+LDAP howtos...) -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] error adding a user
On Fri, Dec 31, 2010 at 04:34:05AM +0100, Marco Ciampa wrote: > Sorry for (I'm shure) my stupid question (and my bad english)... > > If this is not the right place to post this kind of question forgive me > and please point me to the right mailinglist. > > I've a Samba 3 that works with an openldap server as a sole domain controller. > > I used to use the Microsoft usermanager. > After a general migration/upgrate I am not able to create new users anymore. > I can do it with the smbldap-tools, manually only from the root user but > if I do it through the usermanager it gives me an error. > A net user add command done with the same adminitrator user give me this > error: > > Failed to add user 'pippo' with: WERR_GENERAL_FAILURE. > > from the logs: > > [2010/12/31 04:30:44, 0] passdb/pdb_ldap.c:2197(ldapsam_add_sam_account) > ldapsam_add_sam_account: User 'pippo' already in the base, with samba > attributes > > Any hint? Need some other info? I've seen in the Internet many times asked this question so it seems a recurring problem but with generic answers (check all your conf data/permission/so on...) or no answer at all... Maybe it is a generic-catch-all error message a la Windows so it could be fired by a hundred reasons or what? Sorry I am not a Samba nor LDAP expert... you see... -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] error adding a user
Sorry for (I'm shure) my stupid question (and my bad english)... If this is not the right place to post this kind of question forgive me and please point me to the right mailinglist. I've a Samba 3 that works with an openldap server as a sole domain controller. I used to use the Microsoft usermanager. After a general migration/upgrate I am not able to create new users anymore. I can do it with the smbldap-tools, manually only from the root user but if I do it through the usermanager it gives me an error. A net user add command done with the same adminitrator user give me this error: Failed to add user 'pippo' with: WERR_GENERAL_FAILURE. from the logs: [2010/12/31 04:30:44, 0] passdb/pdb_ldap.c:2197(ldapsam_add_sam_account) ldapsam_add_sam_account: User 'pippo' already in the base, with samba attributes Any hint? -- Marco Ciampa ++ | Linux User #78271 | | FSFE fellow #364 | ++ -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
