Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Natxo Asenjo wrote: On 3/4/06, John H Terpstra <[EMAIL PROTECTED]> wrote: I'd be delighted if someone steps forward with an offer to take over responsibility for maintenance and improvement of the documentation. Its about time for a more capable and more enthusiastic person to have a go. Please allow me rush to step aside. :-) for what it's worth: THANKS!!! for all your efforts with this documentation. I bought the book, I know of lots of people who have working samba domains thanks to your work. Will you write such a piece for the new samba version? I truly hope so, although if you do not I will certainly understand and respect your decision. And again: thanks a lot for your work. Agreed, I can't say thanks enough. I've purchased both editions of the How-To and By-Example to support your efforts. Both books match up with Samba for quality, and I'll continue to point people at both volumes for any Samba questions that come up. Eric -- Eric Feldhusen System Administrator http://www.remc1.org [EMAIL PROTECTED] PO Box 270 (906) 482-4520 x239 809 Hecla St(906) 482-5031 fax Hancock, MI 49930 (906) 370 6202 mobile -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On 3/4/06, John H Terpstra <[EMAIL PROTECTED]> wrote: > > > I'd be delighted if someone steps forward with an offer to take over > responsibility for maintenance and improvement of the documentation. Its > about time for a more capable and more enthusiastic person to have a go. > Please allow me rush to step aside. :-) > for what it's worth: THANKS!!! for all your efforts with this documentation. I bought the book, I know of lots of people who have working samba domains thanks to your work. Will you write such a piece for the new samba version? I truly hope so, although if you do not I will certainly understand and respect your decision. And again: thanks a lot for your work. -- Groeten, J.Asenjo -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On Thursday 02 March 2006 23:15, Craig White wrote: > On Thu, 2006-03-02 at 22:38 -0600, John H Terpstra wrote: > > > I think you should follow Craig's advice, get your hands on a copy of > > > "LDAP System Administration", and go through it carefully. LDAP is a > > > wonderful enabling technology, but if you don't understand how it > > > works, you'll get terrible performance, and risk exposing private data. > > > > I have no argument with this advice - but please be careful that you do > > not needlessly scare people off from using LDAP. > > > I was wondering if you dropped off the face of this planet since I knew > you wouldn't take his commentary well. I started employment with AMD in January based in Austin, Texas. I've been very much swamped since December. I'll get back to the documentation when I come up for oxygen. > My biggest concern isn't necessarily for performance or exposing data as > much as having a user who relies upon a technology that provides > essential user/group authentication services as well as configuration > information and can neither comprehend nor maintain it and when you know > what hits the fan, that user is ill equipped to solve the problem. > > No one should be scared away from using LDAP and the samba documentation > clearly gives enough information to permit someone to integrate samba in > an LDAP environment but the samba documentation doesn't suggest that you > can use LDAP on your domain without getting a reasonably rounded > education on using LDAP itself. Some people have that erroneous > expectation. I have received a number of emails from people who used the Samba documentation - some of it is rude and some is most appreciative. I can handle criticism if it is valid. The documentation is in open SVN. Anyone can contribute patches - and those who contribute get recognition for their work. When I released the documentation to public CVS, and then to SVN, I made a conscious decision to disown my own work. I want to encourage people to contribute improvements to the documentation. There have been a few contributions - but most people just like to poke holes even where they do not exist. Samba3 by Example is not a book on LDAP. It has a well defined purpose and meets its goals. If anyone wishes to contribute systematic changes that converts the whole book to a new set of goals and objectives I will not object one bit. As far as I am concerned, the source is open and our users are far more experienced and much smarter than I am. Please, please make the problem go away if you feel inclined to do so. I'd be delighted if someone steps forward with an offer to take over responsibility for maintenance and improvement of the documentation. Its about time for a more capable and more enthusiastic person to have a go. Please allow me rush to step aside. :-) Cheers, John T. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager ->sambaadmin)
On Sat, 2006-03-04 at 00:25 +1100, adrian sender wrote: > Well I am glad that there has been alot of input on this topic, alot of > people are having different opinions but that is because we are not focusing > with the problem at hand. > > The documentation provides full details on how to get samba + ldap working > from scratch; but there seems to be a gap between chapter 5 & 6; > > Once again I will say I love this book; by far the best technical reference > manaual available for samba and highly recommend it. > > Chapter 6, is it assumeing we are starting fresh here, because the ldap > database is placed in a different directory to what was in chapter 5 > slapd.conf? > > Questions; > > 1. If it is assumeing that we are starting from scratch; all configuration > files are to that of the documentation - why will the database not populate > with the smbldap-tools using sambaadmin? > > 2. If I change sambaadmin to Manager all works fine; is there anything wrong > with doing this. > > 3. I am not interested in learning ldap and its complexities, otherwise I > would not have bothered using ldap, samba 3 by example provides simple steps > - however this step I am stuck with. > > 4. A solution ? > > For over a year now I have worked around this by using Manager in place of > sambaadmin - but it is time for me to get to the bottom of this so I can > start with another problem and move on to testing samba4. > > All your help and time is greatly appreciated. the reason you can't get past it is inherent in your 'question 3' which of course isn't a question at all. If you aren't interested in learning LDAP - don't use it. Perhaps with Samba 4, you can use LDAP without knowing a thing about it much as you can in a Windows AD but definitely not Samba 3 and OpenLDAP - there is no close my eyes and hope it works scenario that is going to work because the worst thing you can ever do is get lucky and make it work and then depend upon it to work because it will break and you won't be able to fix it. Craig -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager ->sambaadmin)
Well I am glad that there has been alot of input on this topic, alot of people are having different opinions but that is because we are not focusing with the problem at hand. The documentation provides full details on how to get samba + ldap working from scratch; but there seems to be a gap between chapter 5 & 6; Once again I will say I love this book; by far the best technical reference manaual available for samba and highly recommend it. Chapter 6, is it assumeing we are starting fresh here, because the ldap database is placed in a different directory to what was in chapter 5 slapd.conf? Questions; 1. If it is assumeing that we are starting from scratch; all configuration files are to that of the documentation - why will the database not populate with the smbldap-tools using sambaadmin? 2. If I change sambaadmin to Manager all works fine; is there anything wrong with doing this. 3. I am not interested in learning ldap and its complexities, otherwise I would not have bothered using ldap, samba 3 by example provides simple steps - however this step I am stuck with. 4. A solution ? For over a year now I have worked around this by using Manager in place of sambaadmin - but it is time for me to get to the bottom of this so I can start with another problem and move on to testing samba4. All your help and time is greatly appreciated. Thanks. Adrian. From: "adrian sender" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager ->sambaadmin) Date: Fri, 03 Mar 2006 11:49:25 +1100 I have this in my slap.conf as per the docs; access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by * none Should that work? From: "Yanick Durant" <[EMAIL PROTECTED]> To: "adrian sender" <[EMAIL PROTECTED]> CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Thu, 2 Mar 2006 09:49:19 +0100 (CET) You need to give enough rights to your "sambaadmin" to allow him to write to the ldap repository for adding users, and updating information. Ie : This kind of access rule inside your slapd.conf these line need to be after the database tag in the config file. This will also allow user to change their password access to attr=userPassword,sambaLMPassword,sambaNTPassword by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by anonymous auth by * none # The admin dn has full write access access to * by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by * read Regards, Yanick Durant > I will try to explain my situtation a little better so other can > understand. > > I am sticking to the documentation, (samba 3 by example by jht) excellent > book!; > > So here is where I am at; > > I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as per > the documentation chapter 6. > > I do have a bdc; however there is no relivence to that as I am only > working > on the PDC at the time; > > I have these commented out in the slapd.conf for the moment. > > #replica host=192.168.0.3:389 > #suffix="dc=tinistuff,dc=com" > #binddn="cn=updateuser,dc=tinistuff,dc=com" > #bindmethod=simple credentials=123456 > > #replogfile /var/lib/ldap/replogfile > > > This is my smb.conf as per chapter 6; > ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** > > ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com > > [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 > Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in > secrets.tdb > > Does this look right so far; I am now going to configure smbldaptools as > per > the documentation; In chapter 5 (./configure) > > Ok, now we take a look at this - > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading > access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=sambaadmin,dc=tinistuff,dc=com" > masterPw="123456" > > > Time to populate the ldap DB. > [EMAIL PRO
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
John H Terpstra wrote: Where were you when I asked for feedback and review? Beats me, man. Working on something else. :) When will you provide updates to the documentation that improve its real value? Huh... I hadn't considered that it'd be accepted. Specifically, because of this note: Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? ... I made the decision, right or wrong, to keep this material as simple as possible. The intent of this book is to demonstrate a working solution and not to discuss too many peripheral issues. It really bothers me to see any reference material treat security as an exercise for the reader. It bothered me more because as far as I've been able to determine, there's no reference material available which discusses which of the samba attributes need to be hidden from public view, and which need to be protected from writing by "self". Now, maybe my impression of the security practices you had in mind wasn't accurate. If you're open to what I think would be improvements, I could send patches to the documentation. I presume it's in CVS somewhere? Let me know where to check it out. I hope you are willing to contribute corrections and improvements and not just criticism. All contributions are most appreciated. Awww... but criticism is what I've got the most of. ;) Are you sure that chapter 5 does not provide clean-slate installation instructions that create a fully working LDAP directory that has been correctly populated? Um, no. You busted me. I misread some of the docs, and then made an erroneous claim. My mistake was reinforced by the expectation that Adrian had followed the documentation, which probably isn't the case. If it were, then the top level entries of his directory probably wouldn't be missing. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On Thu, 2006-03-02 at 22:38 -0600, John H Terpstra wrote: > > > > I think you should follow Craig's advice, get your hands on a copy of > > "LDAP System Administration", and go through it carefully. LDAP is a > > wonderful enabling technology, but if you don't understand how it works, > > you'll get terrible performance, and risk exposing private data. > > I have no argument with this advice - but please be careful that you do not > needlessly scare people off from using LDAP. > I was wondering if you dropped off the face of this planet since I knew you wouldn't take his commentary well. My biggest concern isn't necessarily for performance or exposing data as much as having a user who relies upon a technology that provides essential user/group authentication services as well as configuration information and can neither comprehend nor maintain it and when you know what hits the fan, that user is ill equipped to solve the problem. No one should be scared away from using LDAP and the samba documentation clearly gives enough information to permit someone to integrate samba in an LDAP environment but the samba documentation doesn't suggest that you can use LDAP on your domain without getting a reasonably rounded education on using LDAP itself. Some people have that erroneous expectation. Craig -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On Thursday 02 March 2006 01:38, Gordon Messmer wrote: > adrian sender wrote: > > I am sticking to the documentation, (samba 3 by example by jht) > > excellent book!; > > Yes, it's an excellent book. I have a copy, myself. However, you won't > get anywhere "sticking to" its LDAP documentation. > > The LDAP documentation in "Samba-3 by Example" is BAD. Very bad. It > completely abrogates any discussion of security as a matter that the > user should be expert enough to handle, and gives example configuration > files that are completely open to attack. It would have been better to > ignore the LDAP server's configuration entirely and explicitly state > that admins are expected to be able to do it on their own. Where were you when I asked for feedback and review? When will you provide updates to the documentation that improve its real value? I hope you are willing to contribute corrections and improvements and not just criticism. All contributions are most appreciated. > Further, "Samba-3 by Example" assumes that you have a working directory, > to begin with. Using OpenLDAP, you must create the containers (using Please explain this claim? Where does chapter 5 of "Samba-3 by Example" make that assumption? Are you sure that chapter 5 does not provide clean-slate installation instructions that create a fully working LDAP directory that has been correctly populated? > slapadd, or ldapadd and the "rootdn") before you can bind and populate > the directory with other tools. This is covered in the quickstart guide: > http://www.openldap.org/doc/admin23/quickstart.html > > I think you should follow Craig's advice, get your hands on a copy of > "LDAP System Administration", and go through it carefully. LDAP is a > wonderful enabling technology, but if you don't understand how it works, > you'll get terrible performance, and risk exposing private data. I have no argument with this advice - but please be careful that you do not needlessly scare people off from using LDAP. - John T. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
you are gonna need to add 'self write' to your ACL's for users to login. You probably should follow Yanick's very simple ACL's at first - just to get you started but you aren't going to learn ACL's from samba Craig On Fri, 2006-03-03 at 11:49 +1100, adrian sender wrote: > I have this in my slap.conf as per the docs; > > > access to attrs=sambaLMPassword,sambaNTPassword >by dn="cn=sambaadmin,dc=tinistuff,dc=com" write >by * none > > Should that work? > > > >From: "Yanick Durant" <[EMAIL PROTECTED]> > >To: "adrian sender" <[EMAIL PROTECTED]> > >CC: samba@lists.samba.org > >Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> > >sambaadmin) > >Date: Thu, 2 Mar 2006 09:49:19 +0100 (CET) > > > >You need to give enough rights to your "sambaadmin" to allow him to write > >to the ldap repository for adding users, and updating information. > > > >Ie : > > > >This kind of access rule inside your slapd.conf these line need to be > >after the database tag in the config file. > >This will also allow user to change their password > > > >access to attr=userPassword,sambaLMPassword,sambaNTPassword > > by self write > > by dn="cn=Manager,dc=tinistuff,dc=com" write > > by dn="cn=sambaadmin,dc=tinistuff,dc=com" write > > by anonymous auth > > by * none > > > ># The admin dn has full write access > >access to * > > by self write > > by dn="cn=Manager,dc=tinistuff,dc=com" write > > by dn="cn=sambaadmin,dc=tinistuff,dc=com" write > > by * read > > > >Regards, > > > >Yanick Durant > > > > > > > I will try to explain my situtation a little better so other can > > > understand. > > > > > > I am sticking to the documentation, (samba 3 by example by jht) > >excellent > > > book!; > > > > > > So here is where I am at; > > > > > > I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as > >per > > > the documentation chapter 6. > > > > > > I do have a bdc; however there is no relivence to that as I am only > > > working > > > on the PDC at the time; > > > > > > I have these commented out in the slapd.conf for the moment. > > > > > > #replica host=192.168.0.3:389 > > > #suffix="dc=tinistuff,dc=com" > > > #binddn="cn=updateuser,dc=tinistuff,dc=com" > > > #bindmethod=simple credentials=123456 > > > > > > #replogfile /var/lib/ldap/replogfile > > > > > > > > > This is my smb.conf as per chapter 6; > > > ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** > > > > > > ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com > > > > > > [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 > > > Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in > > > secrets.tdb > > > > > > Does this look right so far; I am now going to configure smbldaptools as > > > per > > > the documentation; In chapter 5 (./configure) > > > > > > Ok, now we take a look at this - > > > [EMAIL PROTECTED] sbin]# cat > > > /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > > > > > > > # Credential Configuration # > > > > > > # Notes: you can specify two differents configuration if you use a > > > # master ldap for writing access and a slave ldap server for reading > > > access > > > # By default, we will use the same DN (so it will work for standard > >Samba > > > # release) > > > slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" > > > slavePw="123456" > > > masterDN="cn=sambaadmin,dc=tinistuff,dc=com" > > > masterPw="123456" > > > > > > > > > Time to populate the ldap DB. > > > [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0 > > > > > > This does not work because it cannot bind as "sambaadmin" > > > > > > If I change my smbldap_bind to Manager, I can populate the DB. > > > > > > [EMAIL PROTECTED] sbin]# cat > > > /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > > &g
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
I have this in my slap.conf as per the docs; access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by * none Should that work? From: "Yanick Durant" <[EMAIL PROTECTED]> To: "adrian sender" <[EMAIL PROTECTED]> CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Thu, 2 Mar 2006 09:49:19 +0100 (CET) You need to give enough rights to your "sambaadmin" to allow him to write to the ldap repository for adding users, and updating information. Ie : This kind of access rule inside your slapd.conf these line need to be after the database tag in the config file. This will also allow user to change their password access to attr=userPassword,sambaLMPassword,sambaNTPassword by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by anonymous auth by * none # The admin dn has full write access access to * by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by * read Regards, Yanick Durant > I will try to explain my situtation a little better so other can > understand. > > I am sticking to the documentation, (samba 3 by example by jht) excellent > book!; > > So here is where I am at; > > I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as per > the documentation chapter 6. > > I do have a bdc; however there is no relivence to that as I am only > working > on the PDC at the time; > > I have these commented out in the slapd.conf for the moment. > > #replica host=192.168.0.3:389 > #suffix="dc=tinistuff,dc=com" > #binddn="cn=updateuser,dc=tinistuff,dc=com" > #bindmethod=simple credentials=123456 > > #replogfile /var/lib/ldap/replogfile > > > This is my smb.conf as per chapter 6; > ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** > > ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com > > [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 > Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in > secrets.tdb > > Does this look right so far; I am now going to configure smbldaptools as > per > the documentation; In chapter 5 (./configure) > > Ok, now we take a look at this - > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading > access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=sambaadmin,dc=tinistuff,dc=com" > masterPw="123456" > > > Time to populate the ldap DB. > [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0 > > This does not work because it cannot bind as "sambaadmin" > > If I change my smbldap_bind to Manager, I can populate the DB. > > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading > access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=Manager,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=Manager,dc=tinistuff,dc=com" > masterPw="123456" > > Now it populates fine. > > Is this a fault on my behalf, or is there something wrong with > "sambaadmin" > in the config files? > > PS - please forgive any spelling errors. > > Kind Regards, > Adrian Sender. > > > > > >>From: Gordon Messmer <[EMAIL PROTECTED]> >>To: adrian sender <[EMAIL PROTECTED]>, samba >> >>Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> >>sambaadmin) >>Date: Wed, 01 Mar 2006 08:13:32 -0800 >> >>Well... you have to create the containers using slapdadd. After the >>containers are present, then you can populate them with users, etc, using >>ldapadd or other tools. If you haven't created the containers, nothi
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
You need to give enough rights to your "sambaadmin" to allow him to write to the ldap repository for adding users, and updating information. Ie : This kind of access rule inside your slapd.conf these line need to be after the database tag in the config file. This will also allow user to change their password access to attr=userPassword,sambaLMPassword,sambaNTPassword by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by anonymous auth by * none # The admin dn has full write access access to * by self write by dn="cn=Manager,dc=tinistuff,dc=com" write by dn="cn=sambaadmin,dc=tinistuff,dc=com" write by * read Regards, Yanick Durant > I will try to explain my situtation a little better so other can > understand. > > I am sticking to the documentation, (samba 3 by example by jht) excellent > book!; > > So here is where I am at; > > I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as per > the documentation chapter 6. > > I do have a bdc; however there is no relivence to that as I am only > working > on the PDC at the time; > > I have these commented out in the slapd.conf for the moment. > > #replica host=192.168.0.3:389 > #suffix="dc=tinistuff,dc=com" > #binddn="cn=updateuser,dc=tinistuff,dc=com" > #bindmethod=simple credentials=123456 > > #replogfile /var/lib/ldap/replogfile > > > This is my smb.conf as per chapter 6; > ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** > > ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com > > [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 > Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in > secrets.tdb > > Does this look right so far; I am now going to configure smbldaptools as > per > the documentation; In chapter 5 (./configure) > > Ok, now we take a look at this - > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading > access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=sambaadmin,dc=tinistuff,dc=com" > masterPw="123456" > > > Time to populate the ldap DB. > [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0 > > This does not work because it cannot bind as "sambaadmin" > > If I change my smbldap_bind to Manager, I can populate the DB. > > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading > access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=Manager,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=Manager,dc=tinistuff,dc=com" > masterPw="123456" > > Now it populates fine. > > Is this a fault on my behalf, or is there something wrong with > "sambaadmin" > in the config files? > > PS - please forgive any spelling errors. > > Kind Regards, > Adrian Sender. > > > > > >>From: Gordon Messmer <[EMAIL PROTECTED]> >>To: adrian sender <[EMAIL PROTECTED]>, samba >> >>Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> >>sambaadmin) >>Date: Wed, 01 Mar 2006 08:13:32 -0800 >> >>Well... you have to create the containers using slapdadd. After the >>containers are present, then you can populate them with users, etc, using >>ldapadd or other tools. If you haven't created the containers, nothing >> is >>going to work. >> >> >> >>adrian sender wrote: >>>The database has not been populated, and cannot be populated using >>>"sambaadmin" >>> >>> >>> >>>>From: Gordon Messmer <[EMAIL PROTECTED]> >>>>To: adrian sender <[EMAIL PROTECTED]> >>>>CC: samba@lists.samba.org >>>>Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -&
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
adrian sender wrote: I am sticking to the documentation, (samba 3 by example by jht) excellent book!; Yes, it's an excellent book. I have a copy, myself. However, you won't get anywhere "sticking to" its LDAP documentation. The LDAP documentation in "Samba-3 by Example" is BAD. Very bad. It completely abrogates any discussion of security as a matter that the user should be expert enough to handle, and gives example configuration files that are completely open to attack. It would have been better to ignore the LDAP server's configuration entirely and explicitly state that admins are expected to be able to do it on their own. Further, "Samba-3 by Example" assumes that you have a working directory, to begin with. Using OpenLDAP, you must create the containers (using slapadd, or ldapadd and the "rootdn") before you can bind and populate the directory with other tools. This is covered in the quickstart guide: http://www.openldap.org/doc/admin23/quickstart.html I think you should follow Craig's advice, get your hands on a copy of "LDAP System Administration", and go through it carefully. LDAP is a wonderful enabling technology, but if you don't understand how it works, you'll get terrible performance, and risk exposing private data. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On Thu, 2006-03-02 at 14:47 +1100, adrian sender wrote: > I will try to explain my situtation a little better so other can understand. > > I am sticking to the documentation, (samba 3 by example by jht) excellent > book!; > > So here is where I am at; > > I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as per > the documentation chapter 6. > > I do have a bdc; however there is no relivence to that as I am only working > on the PDC at the time; > > I have these commented out in the slapd.conf for the moment. > > #replica host=192.168.0.3:389 > #suffix="dc=tinistuff,dc=com" > #binddn="cn=updateuser,dc=tinistuff,dc=com" > #bindmethod=simple credentials=123456 > > #replogfile /var/lib/ldap/replogfile > > > This is my smb.conf as per chapter 6; > ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** > > ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com > > [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 > Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in > secrets.tdb > > Does this look right so far; I am now going to configure smbldaptools as per > the documentation; In chapter 5 (./configure) > > Ok, now we take a look at this - > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=sambaadmin,dc=tinistuff,dc=com" > masterPw="123456" > > > Time to populate the ldap DB. > [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0 > > This does not work because it cannot bind as "sambaadmin" > > If I change my smbldap_bind to Manager, I can populate the DB. > > [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf > > > # Credential Configuration # > > # Notes: you can specify two differents configuration if you use a > # master ldap for writing access and a slave ldap server for reading access > # By default, we will use the same DN (so it will work for standard Samba > # release) > slaveDN="cn=Manager,dc=tinistuff,dc=com" > slavePw="123456" > masterDN="cn=Manager,dc=tinistuff,dc=com" > masterPw="123456" > > Now it populates fine. > > Is this a fault on my behalf, or is there something wrong with "sambaadmin" > in the config files? > > PS - please forgive any spelling errors. > the problem with this of course is that this really has nothing to do with Samba at all - this is strictly a user grappling with LDAP. What do you get from command line ? ldapsearch -x -h localhost -D 'cn=Manager,dc=tinistuff,dc=com' -W \ '(cn=sambaadmin)' If there is a dn: there it should show several attributes including a userPassword attribute. My guess is that is why it's not working...either there isn't a dn: cn=sambaadmin,dc=tinistuff,dc=com or there isn't a userPassword attribute set. My recommendation to you is to forget all about samba for a while and learn how to set up and manage LDAP. Then integrating samba will be a piece of cake. Here's my best suggestion, buy LDAP System Administration book by Gerald Carter (yes, our Jerry)...it's a bit outdated but it makes understanding LDAP easy. Using samba to learn LDAP is like trying to use salad tongs to do neuro surgery. Craig -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
I will try to explain my situtation a little better so other can understand. I am sticking to the documentation, (samba 3 by example by jht) excellent book!; So here is where I am at; I have configured my smb.conf; slapd.conf, ldap.conf, nssldap.conf as per the documentation chapter 6. I do have a bdc; however there is no relivence to that as I am only working on the PDC at the time; I have these commented out in the slapd.conf for the moment. #replica host=192.168.0.3:389 #suffix="dc=tinistuff,dc=com" #binddn="cn=updateuser,dc=tinistuff,dc=com" #bindmethod=simple credentials=123456 #replogfile /var/lib/ldap/replogfile This is my smb.conf as per chapter 6; ***Note we are using "sambaadmin" and not "Manager" as in Chapter 5*** ldap admin dn = cn=sambaadmin,dc=tinistuff,dc=com [EMAIL PROTECTED] sbin]# smbpasswd -w 123456 Setting stored password for "cn=sambaadmin,dc=tinistuff,dc=com" in secrets.tdb Does this look right so far; I am now going to configure smbldaptools as per the documentation; In chapter 5 (./configure) Ok, now we take a look at this - [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf # Credential Configuration # # Notes: you can specify two differents configuration if you use a # master ldap for writing access and a slave ldap server for reading access # By default, we will use the same DN (so it will work for standard Samba # release) slaveDN="cn=sambaadmin,dc=tinistuff,dc=com" slavePw="123456" masterDN="cn=sambaadmin,dc=tinistuff,dc=com" masterPw="123456" Time to populate the ldap DB. [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0 This does not work because it cannot bind as "sambaadmin" If I change my smbldap_bind to Manager, I can populate the DB. [EMAIL PROTECTED] sbin]# cat /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf # Credential Configuration # # Notes: you can specify two differents configuration if you use a # master ldap for writing access and a slave ldap server for reading access # By default, we will use the same DN (so it will work for standard Samba # release) slaveDN="cn=Manager,dc=tinistuff,dc=com" slavePw="123456" masterDN="cn=Manager,dc=tinistuff,dc=com" masterPw="123456" Now it populates fine. Is this a fault on my behalf, or is there something wrong with "sambaadmin" in the config files? PS - please forgive any spelling errors. Kind Regards, Adrian Sender. From: Gordon Messmer <[EMAIL PROTECTED]> To: adrian sender <[EMAIL PROTECTED]>, samba Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Wed, 01 Mar 2006 08:13:32 -0800 Well... you have to create the containers using slapdadd. After the containers are present, then you can populate them with users, etc, using ldapadd or other tools. If you haven't created the containers, nothing is going to work. adrian sender wrote: The database has not been populated, and cannot be populated using "sambaadmin" From: Gordon Messmer <[EMAIL PROTECTED]> To: adrian sender <[EMAIL PROTECTED]> CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Tue, 28 Feb 2006 22:01:24 -0800 adrian sender wrote: [EMAIL PROTECTED] scripts]# slapadd -v -l admin-accts.ldif added: "cn=updateuser,dc=tinistuff,dc=com" (0002) added: "cn=sambaadmin,dc=tinistuff,dc=com" (0003) Error, entries missing! entry 1: dc=tinistuff,dc=com If you dump the database, does "dc=tinistuff,dc=com" show up in there? It looks like the entry for the base DN is missing, which might explain the problems that you're having. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Well... you have to create the containers using slapdadd. After the containers are present, then you can populate them with users, etc, using ldapadd or other tools. If you haven't created the containers, nothing is going to work. adrian sender wrote: The database has not been populated, and cannot be populated using "sambaadmin" From: Gordon Messmer <[EMAIL PROTECTED]> To: adrian sender <[EMAIL PROTECTED]> CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Tue, 28 Feb 2006 22:01:24 -0800 adrian sender wrote: [EMAIL PROTECTED] scripts]# slapadd -v -l admin-accts.ldif added: "cn=updateuser,dc=tinistuff,dc=com" (0002) added: "cn=sambaadmin,dc=tinistuff,dc=com" (0003) Error, entries missing! entry 1: dc=tinistuff,dc=com If you dump the database, does "dc=tinistuff,dc=com" show up in there? It looks like the entry for the base DN is missing, which might explain the problems that you're having. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
On Wed, 2006-03-01 at 15:45 +1100, adrian sender wrote:
> Hi Gordon,
>
> This is my admin-accts.ldif;
> ---
> dn: cn=updateuser,dc=tinistuff,dc=com
> objectClass: person
> cn: updateuser
> sn: updateuser
> userPassword: {crypt}ABiELdbxGY2fY
>
> dn: cn=sambaadmin,dc=tinistuff,dc=com
> objectClass: person
> cn: sambaadmin
> sn: sambaadmin
> userPassword: {crypt}ABiELdbxGY2fY
>
>
>
> So the ldap server is stopped, I add these entries; and restart ldap.
>
> [EMAIL PROTECTED] scripts]# slapadd -v -l admin-accts.ldif
> added: "cn=updateuser,dc=tinistuff,dc=com" (0002)
> added: "cn=sambaadmin,dc=tinistuff,dc=com" (0003)
> Error, entries missing!
> entry 1: dc=tinistuff,dc=com
>
>
> [EMAIL PROTECTED] programs]# ldapsearch -x -D
> "cn=sambaadmin,dc=tinistuff,dc=com"
> -W uid=sambaadmin
> Enter LDAP Password:
> ldap_bind: Invalid credentials (49)
>
> It will not let me populate the database either; however I can populate fine
> when using "Manager" instead of "sambaadmin"
>
> [EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0
> Populating LDAP directory for domain TINISTUFF
> (S-1-5-21-1850218137-420253120-3974286998)
> (using builtin directory structure)
>
> adding new entry: dc=tinistuff,dc=com
> failed to add entry: modifications require authentication at
> ./smbldap-populate line 471, line 2.
no - this seems to have failed too.
can you authenticate with your rootdn?
Craig
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
adrian sender wrote: [EMAIL PROTECTED] scripts]# slapadd -v -l admin-accts.ldif added: "cn=updateuser,dc=tinistuff,dc=com" (0002) added: "cn=sambaadmin,dc=tinistuff,dc=com" (0003) Error, entries missing! entry 1: dc=tinistuff,dc=com If you dump the database, does "dc=tinistuff,dc=com" show up in there? It looks like the entry for the base DN is missing, which might explain the problems that you're having. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Hi Gordon,
This is my admin-accts.ldif;
---
dn: cn=updateuser,dc=tinistuff,dc=com
objectClass: person
cn: updateuser
sn: updateuser
userPassword: {crypt}ABiELdbxGY2fY
dn: cn=sambaadmin,dc=tinistuff,dc=com
objectClass: person
cn: sambaadmin
sn: sambaadmin
userPassword: {crypt}ABiELdbxGY2fY
So the ldap server is stopped, I add these entries; and restart ldap.
[EMAIL PROTECTED] scripts]# slapadd -v -l admin-accts.ldif
added: "cn=updateuser,dc=tinistuff,dc=com" (0002)
added: "cn=sambaadmin,dc=tinistuff,dc=com" (0003)
Error, entries missing!
entry 1: dc=tinistuff,dc=com
[EMAIL PROTECTED] programs]# ldapsearch -x -D "cn=sambaadmin,dc=tinistuff,dc=com"
-W uid=sambaadmin
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
It will not let me populate the database either; however I can populate fine
when using "Manager" instead of "sambaadmin"
[EMAIL PROTECTED] sbin]# ./smbldap-populate -a root -k 0 -m 0
Populating LDAP directory for domain TINISTUFF
(S-1-5-21-1850218137-420253120-3974286998)
(using builtin directory structure)
adding new entry: dc=tinistuff,dc=com
failed to add entry: modifications require authentication at
./smbldap-populate line 471, line 2.
etc..
Hm :(
Adrian.
From: Gordon Messmer <[EMAIL PROTECTED]>
To: adrian sender <[EMAIL PROTECTED]>
CC: samba@lists.samba.org
Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager ->
sambaadmin)
Date: Sun, 26 Feb 2006 23:08:29 -0800
adrian sender wrote:
Hey Guys,
Gordon, I do not think that is the issue; I have tried what you said but
still get the same error.
Remember I have a SDC or BDC that uses updateuser; the ldif I add for that
uses plain text passwords and works perfectly.
I see... Your original message indicated that you had an "updateuser" in
the database, but didn't indicate that you were actually using it for
anything.
I'm still guessing that this is an LDAP issue, and not a samba one.
Are you able to perform a search with the sambaadmin user, or the
updateuser user, using the ldapsearch command line? Try both of these, and
make sure that sambaadmin is not the rootdn specified in your slapd.conf:
ldapsearch -x -D "cn=sambaadmin,dc=ddesign,dc=com" -W uid=sambaadmin
ldapsearch -x -D "cn=updateuser,dc=ddesign,dc=com" -W uid=sambaadmin
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
adrian sender wrote: Hey Guys, Gordon, I do not think that is the issue; I have tried what you said but still get the same error. Remember I have a SDC or BDC that uses updateuser; the ldif I add for that uses plain text passwords and works perfectly. I see... Your original message indicated that you had an "updateuser" in the database, but didn't indicate that you were actually using it for anything. I'm still guessing that this is an LDAP issue, and not a samba one. Are you able to perform a search with the sambaadmin user, or the updateuser user, using the ldapsearch command line? Try both of these, and make sure that sambaadmin is not the rootdn specified in your slapd.conf: ldapsearch -x -D "cn=sambaadmin,dc=ddesign,dc=com" -W uid=sambaadmin ldapsearch -x -D "cn=updateuser,dc=ddesign,dc=com" -W uid=sambaadmin -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Hey Guys, Gordon, I do not think that is the issue; I have tried what you said but still get the same error. Remember I have a SDC or BDC that uses updateuser; the ldif I add for that uses plain text passwords and works perfectly. H. Adrian. From: Gordon Messmer <[EMAIL PROTECTED]> To: adrian sender <[EMAIL PROTECTED]> CC: samba@lists.samba.org Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin) Date: Mon, 20 Feb 2006 10:20:58 -0800 adrian sender wrote: Hi gordon, I don't think that is the issue here because I am able to use "Manager" ldif with plain text passwords. Yeah... I don't think you are. According to your account, you're only able to use Manager or sambaadmin when it's the rootdn in the openldap configuration file. In that case, the plain text password from the configuration file, and not the password in the directory, is used. Try crypt()ing the password, and see if that allows you to bind as the sambaadmin user, without specifying that account as the rootdn. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
adrian sender wrote: Hi gordon, I don't think that is the issue here because I am able to use "Manager" ldif with plain text passwords. Yeah... I don't think you are. According to your account, you're only able to use Manager or sambaadmin when it's the rootdn in the openldap configuration file. In that case, the plain text password from the configuration file, and not the password in the directory, is used. Try crypt()ing the password, and see if that allows you to bind as the sambaadmin user, without specifying that account as the rootdn. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Hi gordon, I don't think that is the issue here because I am able to use
"Manager" ldif with plain text passwords.
Cheers.
Adrian Sender.
From: Gordon Messmer <[EMAIL PROTECTED]>
To: adrian sender <[EMAIL PROTECTED]>
CC: samba@lists.samba.org
Subject: Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager ->
sambaadmin)
Date: Sun, 19 Feb 2006 10:44:14 -0800
adrian sender wrote:
dn: cn=sambaadmin,dc=ddesign,dc=com
objectClass: person
cn: sambaadmin
sn: sambaadmin
userPassword: 123456
When using sambaadmin instead of manager samba hangs unable to connect to
the ldap database, however if i change this entry in the slapd.conf all
works find also.
rootdn "cn=Manager,dc=ddesign,dc=com"
TO>>>
rootdn "cn=sambaadmin,dc=ddesign,dc=com"
Given that, I'd guess that your directory server doesn't support plain text
userPassword fields. Try crypt()ing them.
# perl -e 'print crypt("123456", "AB") . "\n"'
ABiELdbxGY2fY
So, then, your LDIF should have:
dn: cn=sambaadmin,dc=ddesign,dc=com
objectClass: person
cn: sambaadmin
sn: sambaadmin
userPassword: {crypt}ABiELdbxGY2fY
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
adrian sender wrote:
dn: cn=sambaadmin,dc=ddesign,dc=com
objectClass: person
cn: sambaadmin
sn: sambaadmin
userPassword: 123456
When using sambaadmin instead of manager samba hangs unable to connect
to the ldap database, however if i change this entry in the slapd.conf
all works find also.
rootdn "cn=Manager,dc=ddesign,dc=com"
TO>>>
rootdn "cn=sambaadmin,dc=ddesign,dc=com"
Given that, I'd guess that your directory server doesn't support plain
text userPassword fields. Try crypt()ing them.
# perl -e 'print crypt("123456", "AB") . "\n"'
ABiELdbxGY2fY
So, then, your LDIF should have:
dn: cn=sambaadmin,dc=ddesign,dc=com
objectClass: person
cn: sambaadmin
sn: sambaadmin
userPassword: {crypt}ABiELdbxGY2fY
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] Samba 3 by Example - chapter 5 & 6 ( Manager -> sambaadmin)
Dear Samba & Users. I have spent some time going over the documentation, however I still no not fully understand what the cause is. I am focusing on Samba 3 by Example chapter 5 & 6 specifically Chapter 5 smbpasswd -w 123456 [EMAIL PROTECTED] data]# smbpasswd -w 123456 Setting stored password for "cn=Manager,dc=ddesign,dc=com" in secrets.tdb Chapter 6 indicates in the smb.conf to use sambaadmin instead of manager. If i change this to manager in the smb.conf & also this entry in the slapd.conf access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=ddesign,dc=com" write by * none to access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=Manager,dc=ddesign,dc=com" write by * none Alll works fine. Chapter 6 smbpasswd -w 123456 [EMAIL PROTECTED] ~]# smbpasswd -w 123456 Setting stored password for "cn=sambadmin,dc=ddesign,dc=com" in secrets.tdb [EMAIL PROTECTED] samba]# cat smbd [2006/01/30 15:23:15, 0] lib/smbldap.c:smbldap_connect_system(890) failed to bind to server ldap://127.0.0.1 with dn="cn=sambadmin,dc=ddesign,dc=com" Error: Invalid credentials [2006/01/30 15:23:15, 1] lib/smbldap.c:another_ldap_try(1051) Â Connection to LDAP server failed for the 1 try! I have added this ldif entry from chapter 6 ; dn: cn=updateuser,dc=ddesign,dc=com objectClass: person cn: updateuser sn: updateuser userPassword: 123456 dn: cn=sambaadmin,dc=ddesign,dc=com objectClass: person cn: sambaadmin sn: sambaadmin userPassword: 123456 When using sambaadmin instead of manager samba hangs unable to connect to the ldap database, however if i change this entry in the slapd.conf all works find also. rootdn "cn=Manager,dc=ddesign,dc=com" TO>>> rootdn "cn=sambaadmin,dc=ddesign,dc=com" I have been through this configuration several times and keep getting the same issue. Is it possible that I am missing a crutial step between chapter 5 and the single master ldap chapter 6 master/slave configuration. This is only for testing purposes so I can blow away the database without any worries. I am thinking that the problem may be an entry in ldap is not there, although it shows the sambaadmin user. For the moment I am using Manager in replace of sambaadmin. Thanks. Adrian Sender. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
