subject:"\[Samba\] Samba 4"

Hi!

Authentication works when I set 'password server = server01', but then
testparm complains:
WARNING: The setting 'security=ads' should NOT be combined with the
'password server' parameter.
(by default Samba will discover the correct DC to contact automatically).

But Samba doesn't. DNS is working:

host -t srv _kerberos._tcp
_kerberos._tcp.verwaltung.leibniz-remscheid.de has SRV record 0 100 88
server01.verwaltung.leibniz-remscheid.de.

host server01
server01.verwaltung.leibniz-remscheid.de has address 192.168.20.200


Klaus



On Tue, Aug 6, 2013 at 5:13 PM, steve  wrote:

> On Tue, 2013-08-06 at 14:34 +0200, Klaus Rörig wrote:
> > Hi!
> >
> > I set up s3 on the fileserver now but I cannot connect to my share.
> >
> > 'wbinfo -u' lists all user
> > 'wbinfo-g' lists all groups
> >
> > getent also list the queried user.
> >
> > But when I try to connect from Win7 to my s3 share, it asks for creds
> > but does not accept any. I cannot see any log entries.
> >
> > What's wrong now?
>
> Hi
> Too general without knowing a bit more:
> Who is logged in on the Win7 box?
> Is the Win7 box joined to the domain?
> What are the permissions on /srv and /srv/share?
> Can the user access the share if logged in on the file server?
> Can the user access the share using smbclient?
> Does the share appear as a folder in explorer?
> What does the windows security tab give for the share?
>
> Steve
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server

On Tue, 2013-08-06 at 14:34 +0200, Klaus Rörig wrote:
> Hi!
> 
> I set up s3 on the fileserver now but I cannot connect to my share.
> 
> 'wbinfo -u' lists all user
> 'wbinfo-g' lists all groups
> 
> getent also list the queried user.
> 
> But when I try to connect from Win7 to my s3 share, it asks for creds 
> but does not accept any. I cannot see any log entries.
> 
> What's wrong now?

Hi
Too general without knowing a bit more:
Who is logged in on the Win7 box?
Is the Win7 box joined to the domain?
What are the permissions on /srv and /srv/share?
Can the user access the share if logged in on the file server?
Can the user access the share using smbclient?
Does the share appear as a folder in explorer?
What does the windows security tab give for the share?

Steve

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server


Hi!

I set up s3 on the fileserver now but I cannot connect to my share.

'wbinfo -u' lists all user
'wbinfo-g' lists all groups

getent also list the queried user.

But when I try to connect from Win7 to my s3 share, it asks for creds 
but does not accept any. I cannot see any log entries.


What's wrong now?

Klaus

Am 06.08.2013 12:58, schrieb steve:

On Tue, 2013-08-06 at 12:36 +0200, Klaus Rörig wrote:

Hi,

it seems that the ntvfs module is not working on Ubuntu, I get lots of
error messages about this.
I don't see Samba4 servers on network neighborhood, so users cannot
browses shares but I do see Samba3 servers, so I have to get Samba3
working with Samba4.

Or I have to build Samba4 by myself.

Klaus

Hi
I don't think you can have (or would want?) network neighbourhood with
AD. It may be best to have real shares and control access using ACL's or
smb.conf. If you can, I really would advise building s4 from source:
4.0.8 for both DC and file server and using samba for the DC and smbd
for the file server. It takes longer but it's easy to do and you can be
sure to have the latest version. If you want to stick with Ubuntu then I
see the s4 DC and separate s3 file server the best way to go.
Cheers,
Steve


  



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server

On Tue, 2013-08-06 at 12:36 +0200, Klaus Rörig wrote:
> Hi,
> 
> it seems that the ntvfs module is not working on Ubuntu, I get lots of 
> error messages about this.
> I don't see Samba4 servers on network neighborhood, so users cannot 
> browses shares but I do see Samba3 servers, so I have to get Samba3 
> working with Samba4.
> 
> Or I have to build Samba4 by myself.
> 
> Klaus

Hi
I don't think you can have (or would want?) network neighbourhood with
AD. It may be best to have real shares and control access using ACL's or
smb.conf. If you can, I really would advise building s4 from source:
4.0.8 for both DC and file server and using samba for the DC and smbd
for the file server. It takes longer but it's easy to do and you can be
sure to have the latest version. If you want to stick with Ubuntu then I
see the s4 DC and separate s3 file server the best way to go.
Cheers,
Steve

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server


Hi,

it seems that the ntvfs module is not working on Ubuntu, I get lots of 
error messages about this.
I don't see Samba4 servers on network neighborhood, so users cannot 
browses shares but I do see Samba3 servers, so I have to get Samba3 
working with Samba4.


Or I have to build Samba4 by myself.

Klaus

Am 06.08.2013 11:59, schrieb steve:

On Tue, 2013-08-06 at 10:57 +0200, Klaus Rörig wrote:

OK, than I have to use the Samba 3.6 packages shipped with Ubuntu.
Anything special I have to care about?


Hi, no, but as you have only a few clients, it may be simpler to use the
dc itself as file server, especially as you have specified ntvfs. If you
want rfc2307 from winbind though, you'll have to either build samba
4.0.x from source on a separate box and use smbd or use the Ubuntu 3.6
packages, also on a separate box. If you're OK with ntvfs and you only
have win7 clients, I'd go with the single DC/fileserver and forget about
rfc2307.
HTH
Steve




--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server

On Tue, 2013-08-06 at 10:57 +0200, Klaus Rörig wrote:
> OK, than I have to use the Samba 3.6 packages shipped with Ubuntu.
> Anything special I have to care about?
> 
Hi, no, but as you have only a few clients, it may be simpler to use the
dc itself as file server, especially as you have specified ntvfs. If you
want rfc2307 from winbind though, you'll have to either build samba
4.0.x from source on a separate box and use smbd or use the Ubuntu 3.6
packages, also on a separate box. If you're OK with ntvfs and you only
have win7 clients, I'd go with the single DC/fileserver and forget about
rfc2307.
HTH
Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server


OK, than I have to use the Samba 3.6 packages shipped with Ubuntu.
Anything special I have to care about?

Am 06.08.2013 09:33, schrieb steve:

On Tue, 2013-08-06 at 09:21 +0200, Klaus Rörig wrote:


But there are no smb/nmbd/winbindd binaries.


Hi
Oh, I see. The Ubuntu packages must only be for AD then. Sorry, I missed
that you only wanted ntvfs.




--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server

On Tue, 2013-08-06 at 09:21 +0200, Klaus Rörig wrote:

> 
> But there are no smb/nmbd/winbindd binaries.


Hi
Oh, I see. The Ubuntu packages must only be for AD then. Sorry, I missed
that you only wanted ntvfs.


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server


Hi Steve,

when I start samba without the 'server services' optinion I get:

"At this time the 'samba' binary should only be used for either: 'server 
role = active directory domain controller' or to access the ntvfs file 
server with 'server services= +smb' oder the rpc proxy with 'dcerpc 
endpoint servers = remote'
You should start start smbd/nmbd/winbindd instead for domain member an 
standalone file server tasks"


But there are no smb/nmbd/winbindd binaries.

Klaus

Am 05.08.2013 23:01, schrieb steve:

On Mon, 2013-08-05 at 22:25 +0200, Klaus Rörig wrote:

  I cannot the member server working.

My smb.conf:


Hi
Leave the domain and remove the .tdb files in /var/lib/smb. Then rejoin
with this:


[global]
 workgroup = VERWALTUNG
 security = ads
 realm = VERWALTUNG.LEIBNIZ-REMSCHEID.DE
 encrypt passwords = true
 idmap config *:backend = tdb
 idmap config *:range = 70001-8
 idmap config VERWALTUNG:backend = ad
 idmap config VERWALTUNG:schema_mode = rfc2307
 idmap config VERWALTUNG:range = 500-4

 winbind nss info = rfc2307
 winbind trusted domains only = no
 winbind use default domain = yes
 winbind enum users = yes
 winbind enum groups = yes

[verwaltung]
 path = /srv/shares
 read only = no

Start it with:
smbd; winbindd

Prolly not perfect, but should get you a bit close.
hth
Steve



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 and DFS replication

2013-08-05 Thread Andrew Bartlett

On Mon, 2013-08-05 at 17:24 -0500, Kristofer Pettijohn wrote:
> I realize that Samba 4 doesn't yet support DFS replication. But my
> question is if Samba 4 as an AD server supports DFS replication within
> the environment. For example, if all we have are Samba 4 servers for
> AD domain controllers, and we have 2+ Windows servers doing DFS
> between each other (where the Samba 4 file server isn't involved at
> all), is that supported? 

That should be fine, we just don't implement that protocol yet. 

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 and DFS replication

2013-08-05 Thread Kristofer Pettijohn

I realize that Samba 4 doesn't yet support DFS replication. But my question is 
if Samba 4 as an AD server supports DFS replication within the environment. For 
example, if all we have are Samba 4 servers for AD domain controllers, and we 
have 2+ Windows servers doing DFS between each other (where the Samba 4 file 
server isn't involved at all), is that supported? 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 as member server

2013-08-05 Thread steve

On Mon, 2013-08-05 at 22:25 +0200, Klaus Rörig wrote:
>  I cannot the member server working.
> 
> My smb.conf:
> 

Hi
Leave the domain and remove the .tdb files in /var/lib/smb. Then rejoin
with this:

> [global]
> workgroup = VERWALTUNG
> security = ads
> realm = VERWALTUNG.LEIBNIZ-REMSCHEID.DE
> encrypt passwords = true

> idmap config *:backend = tdb
> idmap config *:range = 70001-8
> idmap config VERWALTUNG:backend = ad
> idmap config VERWALTUNG:schema_mode = rfc2307
> idmap config VERWALTUNG:range = 500-4
> 
> winbind nss info = rfc2307
> winbind trusted domains only = no
> winbind use default domain = yes
> winbind enum users = yes
> winbind enum groups = yes
> 
> [verwaltung]
> path = /srv/shares
> read only = no

Start it with:
smbd; winbindd

Prolly not perfect, but should get you a bit close.
hth
Steve

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 as member server

2013-08-05 Thread Klaus Rörig

Hello list,

I'm trying to setup a small samba4 domain ( 1 DC, 1 member server, 12 Win7
clients) on Ubuntu with the packages shipped with Ubuntu 13.04 (Samba
4.0.0), I also tried on Ubuntu 13.10 (Samba 4.0.3).

DC seems to work fine, I can manage users an gpo, clients can join and
logon. But I cannot the member server working.

My smb.conf:

[global]
workgroup = VERWALTUNG
security = ads
realm = VERWALTUNG.LEIBNIZ-REMSCHEID.DE
encrypt passwords = true
server services = +smb -s3fs

idmap config *:backend = tdb
idmap config *:range = 70001-8
idmap config VERWALTUNG:backend = ad
idmap config VERWALTUNG:schema_mode = rfc2307
idmap config VERWALTUNG:range = 500-4

winbind nss info = rfc2307
winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes

  server role = domain controller
  dcerpc endpoint servers = -winreg -srvsvc
[verwaltung]
path = /srv/shares
read only = no

[sysvol]
  path = /var/lib/samba/sysvol
  read only = no

[netlogon]
  path = /var/lib/samba/sysvol/VERWALTUNG.LEIBNIZ-REMSCHEID.DE/scripts
  read only = no


I did 'samba-tool domain join VERWALTUNG -UAdministrator' with success:
"Joined domain SID". The server is listet in AD Tools.

But 'samba -i -M single -d1' stops working with:

samba: /usr/lib/x86_64-linux-gnu/libwbclient.so.0: no version information
available (required by /usr/lib/x86_64-linux-gnu/samba/libauth4.so)
samba version 4.0.3 started.
Copyright Andrew Tridgell and the Samba Team 1992-2012
samba: using 'single' process model
task_server_terminate: [ldap_server: no LDAP server required in member
server configuration]
task_server_terminate: [cldap_server: no CLDAP server required in member
server configuration]
task_server_terminate: [kdc: no KDC required in member server configuration]
task_server_terminate: [dreplsrv: no DSDB replication required in domain
member configuration]
task_server_terminate: [Cannot start Winbind (domain member): Failed to
find record for VERWALTUNG in /var/lib/samba/private/secrets.ldb: No such
object: (null): Have you joined the VERWALTUNG domain?]
samba_terminate: Cannot start Winbind (domain member): Failed to find
record for VERWALTUNG in /var/lib/samba/private/secrets.ldb: No such
object: (null): Have you joined the VERWALTUNG domain?


root@server04:/var/lib/samba/private# ls -la
insgesamt 3784
drwxr-xr-x 3 root root4096 Aug  5 21:50 .
drwxr-xr-x 7 root root4096 Aug  5 21:47 ..
-rw--- 1 root root 1286144 Aug  5 21:50 privilege.ldb
-rw--- 1 root root 696 Aug  5 21:50 randseed.tdb
-rw--- 1 root root 1286144 Aug  5 21:50 sam.ldb
-rw--- 1 root root 1286144 Aug  5 21:50 secrets.ldb
drwxr-xr-x 3 root root4096 Aug  5 21:50 smbd.tmp


Please help!

Thx,

Klaus
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Slow Performance

2013-08-04 Thread Matthieu Patou

On 07/27/2013 08:20 AM, Kinglok, Fong wrote:

Dear all,

After using samba 3 for two years, I have just spent totally one week finishing
setting up a samba 4 file system in my working school. There are about 200
computers, 80+ staff, 1000 students and 10 printers. The AD was properly
setup, mandatory profile and one GPO policy (which is printer download trust)
is effective for all users. Logon script is for mapping four shares and 10
printers from the file server. Also, I have setup two additional DCs (with AD
replication and DHCP server) for two other subnets in the hope to speed up the
logon process.

The benefits of Samba 4 are clear: more robust file serving (supporting the
windows ACL), speedy printing (with the help of point and printer driver) and
administration of AD through with windows remote admin tool. However, logon
speed is just far from good.

In the days of Samba 3.6, users can logon the system within 20 seconds, even
with more than 80 users logon in the same time (two classes students login
during computer lesson). Now, with only one user logging in (who is me), it
takes nearly 60 seconds to do the logon. I have tried disabling drive and
printer mapping in logon script and applying a registry hack (note 1) shorten
the profile waiting time in windows 7 client side but it makes no difference in
logon speed.

I have taken a look on the document in sambaXP 2013:
http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf

and two thread in samba-technical mailing list:
https://lists.samba.org/archive/samba-technical/2013-January/089755.html
https://lists.samba.org/archive/samba-technical/2013-May/092332.html

It seems that samba team is doing some great work in spotting the unindexed
search in LDB as one of block in performance. Certainly, I can wait for the
new version 4.0.X for the boost of performance. However, I am in deep panic
when lessons are going to be launched on 1st September 2013 here in Hong Kong.
Are there any patches so that I can a hot / dirty fix?

I don't think the problem is in the database in your case, can you do a
tcpdump trace starting just before the client is logging on and stopping
it after the logon (ie the 60 sec or so), see
https://wiki.samba.org/index.php/Capture_Packets on how to the tcpdump
capture.

With this trace we should be able to see where is the delay.
Matthieu.

--
Matthieu Patou
Samba Team
http://samba.org

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Slow Performance

2013-07-30 Thread Andrew Bartlett

On Wed, 2013-07-31 at 10:07 +0800, Kinglok, Fong wrote:
> On 29 Jul, 2013, at 1:13 PM, Andrew Bartlett  wrote:
> 
> > On Sat, 2013-07-27 at 23:20 +0800, Kinglok, Fong wrote:
> >> Dear all,
> >> 
> >> After using samba 3 for two years, I have just spent totally one week
> >> finishing setting up a samba 4 file system in my working school.
> >> There are about 200 computers, 80+ staff, 1000 students and 10
> >> printers.  The AD was properly setup, mandatory profile and one GPO
> >> policy (which is printer download trust) is effective for all users.
> >> Logon script is for mapping four shares and 10 printers from the file
> >> server.   Also, I have setup two additional DCs (with AD replication
> >> and DHCP server) for two other subnets in the hope to speed up the
> >> logon process.
> >> 
> >> The benefits of Samba 4 are clear: more robust file serving
> >> (supporting the windows ACL), speedy printing (with the help of point
> >> and printer driver) and administration of AD through with windows
> >> remote admin tool.  However, logon speed is just far from good.
> >> 
> >> In the days of Samba 3.6, users can logon the system within 20
> >> seconds, even with more than 80 users logon in the same time (two
> >> classes students login during computer lesson).  Now, with only one
> >> user logging in (who is me), it takes nearly 60 seconds to do the
> >> logon.  I have tried disabling drive and printer mapping in logon
> >> script and applying a registry hack (note 1) shorten the profile
> >> waiting time in windows 7 client side but it makes no difference in
> >> logon speed.
> >> 
> >> I have taken a look on the document in sambaXP 2013:
> >> http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf
> >> 
> >> and two thread in samba-technical mailing list:
> >> https://lists.samba.org/archive/samba-technical/2013-January/089755.html
> >> https://lists.samba.org/archive/samba-technical/2013-May/092332.html
> >> 
> >> It seems that samba team is doing some great work in spotting the
> >> unindexed search in LDB as one of block in performance. 
> > 
> > It is one block, but it is the one we expect to really hit at around
> > 1, not 1000-2000.  As Richard has indicated, what we need from you
> > is an indication of what operation is slow.  Timeouts of this order
> > indicate something different to a slow database - they indicate things
> > like DNS timeing out. 
> > 
> > Once you work out which specific operation is blocking, we can
> > investigate more - be it in regards to your network, or our code, we
> > don't mind either way, but we need to work out which to look into.
> > 
> > Andrew Bartlett
> > 
> > -- 
> > Andrew Bartlett
> > http://samba.org/~abartlet/
> > Authentication Developer, Samba Team   http://samba.org
> > Samba Developer, Catalyst IT   http://catalyst.net.nz
> > 
> > 
> 
> 
> Thank you all for responding.
> 
> In these days, I am trying hard to understand the reason of the delay in 
> logon.
> 
> Following your advice, I've done some test on
> 1. Profile deploying
> 2. GPO
> 
> For the first one, I try using roaming profile for one testing user, it turns 
> out 7 seconds to logon the system.  It seems that the culprit of the delay is 
> in the my old mandatory profile.
> For the second one, I try disable all GPO (I only enable point and printer 
> driver trust and folder redirection), turning it on / off does not change the 
> logon time significantly.
> 
> So, I try digging into how to create mandatory profile properly once again.  
> Here I found:
> http://oakdome.com/k5/tutorials/windows-7-mandatory-roaming-profile.php
> 
> By following the link's instruction, I found it needs 20 seconds in logon.  I 
> hope I can further decrease the logon time (anyone got a hint?)
> 
> I will keep updating the list if I found something worth sharing.

Thanks for getting back to us.  It sounds like this is mostly a
client-side delay than a Samba issue. 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Slow Performance

2013-07-30 Thread Kinglok, Fong


On 29 Jul, 2013, at 1:13 PM, Andrew Bartlett  wrote:

> On Sat, 2013-07-27 at 23:20 +0800, Kinglok, Fong wrote:
>> Dear all,
>> 
>> After using samba 3 for two years, I have just spent totally one week
>> finishing setting up a samba 4 file system in my working school.
>> There are about 200 computers, 80+ staff, 1000 students and 10
>> printers.  The AD was properly setup, mandatory profile and one GPO
>> policy (which is printer download trust) is effective for all users.
>> Logon script is for mapping four shares and 10 printers from the file
>> server.   Also, I have setup two additional DCs (with AD replication
>> and DHCP server) for two other subnets in the hope to speed up the
>> logon process.
>> 
>> The benefits of Samba 4 are clear: more robust file serving
>> (supporting the windows ACL), speedy printing (with the help of point
>> and printer driver) and administration of AD through with windows
>> remote admin tool.  However, logon speed is just far from good.
>> 
>> In the days of Samba 3.6, users can logon the system within 20
>> seconds, even with more than 80 users logon in the same time (two
>> classes students login during computer lesson).  Now, with only one
>> user logging in (who is me), it takes nearly 60 seconds to do the
>> logon.  I have tried disabling drive and printer mapping in logon
>> script and applying a registry hack (note 1) shorten the profile
>> waiting time in windows 7 client side but it makes no difference in
>> logon speed.
>> 
>> I have taken a look on the document in sambaXP 2013:
>> http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf
>> 
>> and two thread in samba-technical mailing list:
>> https://lists.samba.org/archive/samba-technical/2013-January/089755.html
>> https://lists.samba.org/archive/samba-technical/2013-May/092332.html
>> 
>> It seems that samba team is doing some great work in spotting the
>> unindexed search in LDB as one of block in performance. 
> 
> It is one block, but it is the one we expect to really hit at around
> 1, not 1000-2000.  As Richard has indicated, what we need from you
> is an indication of what operation is slow.  Timeouts of this order
> indicate something different to a slow database - they indicate things
> like DNS timeing out. 
> 
> Once you work out which specific operation is blocking, we can
> investigate more - be it in regards to your network, or our code, we
> don't mind either way, but we need to work out which to look into.
> 
> Andrew Bartlett
> 
> -- 
> Andrew Bartlett
> http://samba.org/~abartlet/
> Authentication Developer, Samba Team   http://samba.org
> Samba Developer, Catalyst IT   http://catalyst.net.nz
> 
> 


Thank you all for responding.

In these days, I am trying hard to understand the reason of the delay in logon.

Following your advice, I've done some test on
1. Profile deploying
2. GPO

For the first one, I try using roaming profile for one testing user, it turns 
out 7 seconds to logon the system.  It seems that the culprit of the delay is 
in the my old mandatory profile.
For the second one, I try disable all GPO (I only enable point and printer 
driver trust and folder redirection), turning it on / off does not change the 
logon time significantly.

So, I try digging into how to create mandatory profile properly once again.  
Here I found:
http://oakdome.com/k5/tutorials/windows-7-mandatory-roaming-profile.php

By following the link's instruction, I found it needs 20 seconds in logon.  I 
hope I can further decrease the logon time (anyone got a hint?)

I will keep updating the list if I found something worth sharing.

Thanks.

Kinglok, Fong



signature.asc
Description: Message signed with OpenPGP using GPGMail
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Slow Performance

2013-07-28 Thread Andrew Bartlett

On Sat, 2013-07-27 at 23:20 +0800, Kinglok, Fong wrote:
> Dear all,
> 
> After using samba 3 for two years, I have just spent totally one week
> finishing setting up a samba 4 file system in my working school.
> There are about 200 computers, 80+ staff, 1000 students and 10
> printers.  The AD was properly setup, mandatory profile and one GPO
> policy (which is printer download trust) is effective for all users.
> Logon script is for mapping four shares and 10 printers from the file
> server.   Also, I have setup two additional DCs (with AD replication
> and DHCP server) for two other subnets in the hope to speed up the
> logon process.
> 
> The benefits of Samba 4 are clear: more robust file serving
> (supporting the windows ACL), speedy printing (with the help of point
> and printer driver) and administration of AD through with windows
> remote admin tool.  However, logon speed is just far from good.
> 
> In the days of Samba 3.6, users can logon the system within 20
> seconds, even with more than 80 users logon in the same time (two
> classes students login during computer lesson).  Now, with only one
> user logging in (who is me), it takes nearly 60 seconds to do the
> logon.  I have tried disabling drive and printer mapping in logon
> script and applying a registry hack (note 1) shorten the profile
> waiting time in windows 7 client side but it makes no difference in
> logon speed.
> 
> I have taken a look on the document in sambaXP 2013:
> http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf
> 
> and two thread in samba-technical mailing list:
> https://lists.samba.org/archive/samba-technical/2013-January/089755.html
> https://lists.samba.org/archive/samba-technical/2013-May/092332.html
> 
> It seems that samba team is doing some great work in spotting the
> unindexed search in LDB as one of block in performance. 

It is one block, but it is the one we expect to really hit at around
1, not 1000-2000.  As Richard has indicated, what we need from you
is an indication of what operation is slow.  Timeouts of this order
indicate something different to a slow database - they indicate things
like DNS timeing out. 

Once you work out which specific operation is blocking, we can
investigate more - be it in regards to your network, or our code, we
don't mind either way, but we need to work out which to look into.

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org
Samba Developer, Catalyst IT   http://catalyst.net.nz


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] samba 4 userid mapping

2013-07-28 Thread steve

On Tue, 2013-07-09 at 18:22 -0700, Nick B wrote:

Hi
None of this works on a s4 DC
> 
>  # Setup user maps
> 
> idmap config * : backend = tdb
> 
> idmap config * : range = 10-19
> 
> idmap config MYDOMAIN : backend = ad
> 
> idmap config MYDOMAIN : schema_mode = rfc2307
> 
> idmap config MYDOMAIN : range = 5-9
> 
> winbind nss info = rfc2307
> 
> winbind trusted domains only = No
> 
> winbind use default domain = Yes
> 
> winbind enum users = Yes
> 
> winbind enum groups = Yes

replace it with this:
idmap_ldb use:rfc2307 = Yes

make the winbind links:
ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib64/libnss_winbind.so
ln -s libnss_winbind.so /lib64/libnss_winbind.so.2

and the nss stuff in /etc/nsswitch.conf:
passwd:  files winbind
group:   files winbind

Now add the uidNumber and gidNumber attributes to the user or group DN
in AD. YOu can use ldbmodify or ldbedit for that. If you are brave, you
can build the master and use samba-tool add the attributes when you
create the user.

Note: if you want the whole of rfc2307 as your smb.conf suggests, then
use sssd and forget about winbind.

HTH
Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Slow Performance

2013-07-28 Thread Richard Sharpe

On Sat, Jul 27, 2013 at 8:20 AM, Kinglok, Fong  wrote:
> Dear all,
>
> After using samba 3 for two years, I have just spent totally one week 
> finishing setting
> up a samba 4 file system in my working school.  There are about 200 computers,
> 80+ staff, 1000 students and 10 printers.  The AD was properly setup, 
> mandatory
> profile and one GPO policy (which is printer download trust) is effective for 
> all users.
> Logon script is for mapping four shares and 10 printers from the file server. 
>   Also, I
> have setup two additional DCs (with AD replication and DHCP server) for two 
> other
> subnets in the hope to speed up the logon process.

Hmmm, some further info might be useful.

Is the Samba server an AD DC or a simple member server?

Do you know (perhaps from a capture) whether the excess logon time is
mostly caused by the initial authentication or by trying to retrieve
the GPO and/or roaming profiles?

Do you know whether or not Kerberos is being used or if the client is
falling back to NTLM?

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] samba 4 userid mapping

2013-07-28 Thread Nick B

Complete new user here.  Setting up my first samba configuration, using
samba 4.0.6 as a primary domain controller.  I have user profiles, network
shares, active directory, and domain controller working.  But I can not
understand how to map windows userid to linux userid (and map groupid as
well).  I am struggling because much of the documentation is outdated and
meant for samba 3.x or targetted for samba as a domain member.  I followed
some documentation to try the userid mapping through active directory, but
that required Microsoft services for Unix 3.5, which will not install on 64
versions of MS.  I find myself without any orientation of how to proceed.

I am suffering from documentation overload, much of it contradictory or not
applicable.  I am not even sure how to use winbind, or if that is required
for my situation.  I really need a simple step by step howto that is
specific to samba 4 as a PDC.  If you want to reference documentation,
great, but please reference specific sections instead of whole general
chapters.  Any help greatly appreciated.  Thank you.

Configuration information follows:

Server

OS:  OpenSuSE 12.1, 64 bit
Samba:  Samba 4.0.6
Configuration:  Primary domain controller with active directory support
Using BIND 9 DNS server


Client

OS:  Windows 7 Professional, 64 bit


Samba configuration file


# Global parameters

[global]

workgroup = MYDOMAIN

realm = MYDOMAIN.ORG

netbios name = SERVER

wins support = Yes

server role = active directory domain controller

server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind,
ntp_signd, kcc, dnsupdate

encrypt passwords = yes

 # Setup user maps

idmap config * : backend = tdb

idmap config * : range = 10-19

idmap config MYDOMAIN : backend = ad

idmap config MYDOMAIN : schema_mode = rfc2307

idmap config MYDOMAIN : range = 5-9

winbind nss info = rfc2307

winbind trusted domains only = No

winbind use default domain = Yes

winbind enum users = Yes

winbind enum groups = Yes

# Logon path tells samba where to put Windows roaming profiles

logon path = \\%h\profiles\%u

  # Logon home is used to specify home directory and

# Windows 95/98/ME roaming profile location

logon home = \\%h\%u\.win_profiles

# Allow Samba to send correct time to windows

time server = Yes

# Set logging options

log file = /var/log/samba/log.odeon

# Shares configurations follows.  Not included for brevity . . .

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 Slow Performance

2013-07-27 Thread Kinglok, Fong

Dear all,

I have taken a look on the document in sambaXP 2013:
http://sambaxp.org/fileadmin/user_upload/SambaXP2013-DATA/thu/track1/Matthieu_Patou-Smaller_Faster_Scalier.pdf

and two thread in samba-technical mailing list:
https://lists.samba.org/archive/samba-technical/2013-January/089755.html
https://lists.samba.org/archive/samba-technical/2013-May/092332.html

Thanks for attending.

Kinglok, Fong

Note: "Set maximum wait time for the network if a user has a roaming" to 1
(setting it to 0 will default it to 30 seconds) and "Startup policy processing
wait time..." to 1

signature.asc
Description: Message signed with OpenPGP using GPGMail
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 dnsupdate errors

2013-07-26 Thread Dave Hawkes

This has now been fixed - apparmor was preventing bind from writing to 
the /var/tmp directory.


On 13-07-26 09:22 AM, Dave Hawkes wrote:
I have installed samba from source (I've tried both V4-0-stable and 
v4-1-stable) using BIND9_DLZ on Ubuntu server 13.04 and I'm unable to 
get samba_dnsupdate to function.


# samba_dnsupdate --all-names --fail-immediately

will return

dns_tkey_negotiategss: TKEY is unacceptable

If I then try nsupdate directly:

nsupdate -g /tmp/tmpEk4_WK

I also get:

dns_tkey_negotiategss: TKEY is unacceptable

The credential cache looks like:

# klist -c /tmp/tmpQoCe89

Ticket cache: FILE:/tmp/tmpQoCe89
Default principal: ADS1$@INTERNAL.DOMAIN.COM

Valid startingExpires   Service principal
26/07/2013 09:03  26/07/2013 19:03 
krbtgt/internal.domain@internal.domain.com
26/07/2013 09:03  26/07/2013 19:03 
DNS/ads1.internal.domain@internal.domain.com


Dns appears to be functioning correctly with forward and reverse 
lookups correct.


Can anyone help with ideas to track down this problem?

Thanks,
Dave







--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 dnsupdate errors

2013-07-26 Thread Dave Hawkes

I have installed samba from source (I've tried both V4-0-stable and 
v4-1-stable) using BIND9_DLZ on Ubuntu server 13.04 and I'm unable to 
get samba_dnsupdate to function.


# samba_dnsupdate --all-names --fail-immediately

will return

dns_tkey_negotiategss: TKEY is unacceptable

If I then try nsupdate directly:

nsupdate -g /tmp/tmpEk4_WK

I also get:

dns_tkey_negotiategss: TKEY is unacceptable

The credential cache looks like:

# klist -c /tmp/tmpQoCe89

Ticket cache: FILE:/tmp/tmpQoCe89
Default principal: ADS1$@INTERNAL.DOMAIN.COM

Valid startingExpires   Service principal
26/07/2013 09:03  26/07/2013 19:03 
krbtgt/internal.domain@internal.domain.com
26/07/2013 09:03  26/07/2013 19:03 
DNS/ads1.internal.domain@internal.domain.com


Dns appears to be functioning correctly with forward and reverse lookups 
correct.


Can anyone help with ideas to track down this problem?

Thanks,
Dave




--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] "Samba 4" - "smbd"; "can't parse the PAC: NT_STATUS_BUFFER_TOO_SMALL" error but only for a single domain user ("Server 2008 R2" domain, "Server 2008" functional level forest).

2013-07-25 Thread Tris Mabbs

Good day, one and all ...

I just had to rebuild our main Samba server ("OpenSlowlaris" -> "Slowlaris 
11.11"), during which I put the latest (at the time; currently 
4.2.0pre1-GIT-b505111) Samba4 on there.  I thought that by now that Gunther's 
speculative changes to improve the PAC decode might have made their way into 
the trunk revision - obviously I was wrong, as I'm once again getting a load of 
"Can't parse the PAC: NT_STATUS_BUFFER_TOO_SMALL" messages and a user who can't 
access any Samba shares.

Whoops ...

So as we previously discussed looking into things in more detail (specifically 
finding out why there is no "client_principal" being passed into 
"kerberos_decode_pac()"), but nothing else ever happened, is there anything I 
can do to assist in getting the improved PAC decoding included into the trunk 
revision?  Whilst I can't guarantee immediate responses to any request, I'm 
quite happy to stick any code in anywhere you might want if you don't mind 
potentially waiting a day or so for the results :-)

Also:
I appreciate this is off-topic, but I was wondering whether anyone is 
interested in/would like me to open a separate thread on any of these ...
Built the code, installed the code, set it up (joined the domain, etc. etc. 
etc. etc.).  Had 2(-and-a-bit) problems (one of which I've fixed):
1. Although "bin/default/source3/winbindd/idmap_ad_4.o" gets built, 
"bin/default/source3/winbindd/libidmap-ad.so" doesn't, so 
"/lib/idmap/ad.so" doesn't get installed.  No "ad" idmap backend; no 
AD UID/SID mapping; much administrator (me) confusion if said administrator is 
expecting AD UID/SID mapping to work ...
  I'd completely forgotten about this little "hiccup" - it's been a 
while since I initially shoe-horned Samba4 onto "OpenSlowlaris", but 
fortunately I'd made a note of this in the build script I used so after 2 days 
of banging my head against a wall, I finally remembered to check my own darn' 
script and saw the comment "If ''/usr/local/samba/lib/idmap/ad.so'' doesn't 
build and install then ...".  Bang bang bang bang ...  Doh!
   Linked "libidmap-ad.so" manually and copied into 
"/usr/local/samba/lib/idmap/ad.so" and, as if by magic, my UID/SID mapping 
started working ...
2. "net ads testjoin" works; "wbinfo -t" works (as do "wbinfo -u", 
"wbinfo -g", ).  In fact everything works (after installing "ad.so"!) 
*except* ...  If I do a "net rpc testjoin" (and remember, "wbinfo -t" *does* 
work here) I get an error stating that it can't connect to "GATEWAY" (local 
server name) and therefore the join to the "FIRSTGRADE" domain isn't valid.
   Duh?
   So for some reason, "net rpc testjoin" is trying to connect to the 
local server rather than any DC for the domain.  No particular reason apparent 
in the log files, and it doesn't seem to be affecting anything, but it is an 
odd disparity.  Ramped up debugging but couldn't see any sensible explanation 
in the logs ...
[3. Kinda ...  Sorta ...  Can't build Samba4 on "Slowlaris 11.11" 
without complaints about "no ldap_add_result_entry() support in LDAP libs!" 
filling every log file on the system.
So I kicked and forced and prodded and poked and finally managed to 
persuade Samba to build using OpenLDAP-2.4, which gets rid of this problem.
However that involved fiddling with "CPPFLAGS" and "LDFLAGS" before 
calling any build scripts; it's nasty, messy and dirty - I don't approve of any 
"solution" which involves that sort of messing around (yuk).  There has to be a 
better way ...
From looking at other discussions, it seems Samba4 as a DC isn't 
supported (yet?) using OpenLDAP, but might it be worthwhile providing some way 
to "encourage" the use of OpenLDAP, rather than the OS native LDAP (whatever 
that may be), if it *can* be used?  Perhaps a 
"--I-cant-believe-its-not-OpenLDAP" flag of some sort (sorry, British humour - 
that probably doesn't mean anything to anyone else ...)?]
If you think it's worth opening a thread on any of these (probably, I'd guess, 
in the main Samba discussion rather than Samba-Technical?) then please say so 
and I'll do so.  Otherwise I'll continue quietly to ignore them :-)

Many thanks folks, and have a great week/weekend,

Cheers,

Tris.

-Original Message-
From: Tris Mabbs [mailto:tm-samba201...@firstgrade.co.uk] 
Sent: 15 March 2013 17:59
To: Andrew Bartlett
Cc: 'Michael Wood'; Guenther Deschner; samba@lists.samba.org; 
sa

Re: [Samba] Samba 4 not honoring setgid

2013-07-25 Thread steve

On Thu, 2013-07-25 at 08:17 -0400, Ryan Bair wrote:
> Thank you for confirming. I do have g+s on the directory. I'll file a
> bug about this issue today. 

No problem. If you go with the bugzilla, could you post the link here?
Thanks.


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 not honoring setgid

2013-07-25 Thread Ryan Bair

Thank you for confirming. I do have g+s on the directory. I'll file a bug
about this issue today.


On Thu, Jul 25, 2013 at 3:30 AM, steve  wrote:

> On Wed, 2013-07-24 at 22:34 -0400, Ryan Bair wrote:
> > I'm running Samba 4.0.7 on CentOS 6.4 as a AD DC with s3fs.
> >
> > I have a shared directory with the setgid bit set. From the shell on the
> > server, new files and directories inherit the group as expected. However,
> > new items created through samba get the user's primary group instead.
> >
> > Config for the share is super simple:
> >
> > [test]
> > path = /srv/test
> > read only = no
> >
> >
> > Sounds like a bug. Has any one else experienced this?
>
> Hi
> openSUSE 12.3 DC 4.0.7 also tested with latest git
>
> Not sure what /srv/test has but am guessing that you have set chmod g+s?
>
> If so, I can reproduce what you see. The g+s is ignored when accessed on
> a cifs mounted share and instead the primaryGroupID is used.
>
> Cheers,
> Steve
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 not honoring setgid

2013-07-25 Thread steve

On Wed, 2013-07-24 at 22:34 -0400, Ryan Bair wrote:
> I'm running Samba 4.0.7 on CentOS 6.4 as a AD DC with s3fs.
> 
> I have a shared directory with the setgid bit set. From the shell on the
> server, new files and directories inherit the group as expected. However,
> new items created through samba get the user's primary group instead.
> 
> Config for the share is super simple:
> 
> [test]
> path = /srv/test
> read only = no
> 
> 
> Sounds like a bug. Has any one else experienced this?

Hi
openSUSE 12.3 DC 4.0.7 also tested with latest git

Not sure what /srv/test has but am guessing that you have set chmod g+s?

If so, I can reproduce what you see. The g+s is ignored when accessed on
a cifs mounted share and instead the primaryGroupID is used.

Cheers,
Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 not honoring setgid

2013-07-24 Thread Ryan Bair

I'm running Samba 4.0.7 on CentOS 6.4 as a AD DC with s3fs.

I have a shared directory with the setgid bit set. From the shell on the
server, new files and directories inherit the group as expected. However,
new items created through samba get the user's primary group instead.

Config for the share is super simple:

[test]
path = /srv/test
read only = no


Sounds like a bug. Has any one else experienced this?
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 domain members

2013-07-16 Thread steve

On Tue, 2013-07-16 at 09:40 +0100, Chris Alavoine wrote:
> Hi there,
> 
> Just to add I've been using Ubuntu as my distro of choice (cos it's the one
> I know best). Has anyone had any successes with other Distros they could
> share? I am willing to jump ship if it works!

Hi
openSUSE. One install we did has 2 DC's and a 4.0.7 file server. But I
think that if you build from source, it doesn't make much difference.
HTH
Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 domain members

2013-07-16 Thread Chris Alavoine

Hi there,

Just to add I've been using Ubuntu as my distro of choice (cos it's the one
I know best). Has anyone had any successes with other Distros they could
share? I am willing to jump ship if it works!

Thanks,
Chris.


On 12 July 2013 15:21, Chris Alavoine  wrote:

> Hi there,
>
> I would like to setup a Samba 4 member server to act as a separate
> fileserver within my Samba 4 domain.
>
> Does anyone have any recommendations for this setup?
>
> I've tried to create one following this:
>
> https://wiki.samba.org/index.php/Samba4/Domain_Member
>
> Which seems to work ok until I try to change any permission on any shares
> (or anything within the shares). I then get "access denied" errors.
> Obviously, this is unworkable as a solution as I need to set permissions.
>
> Any help much appreciated.
>
> Thanks,
> Chris.
>
> --
> ACS (Alavoine Computer Services Ltd)
> Chris Alavoine
> mob +44 (0)7724 710 730
> www.alavoinecs.co.uk
> http://twitter.com/#!/alavoinecs
> http://www.linkedin.com/pub/chris-alavoine/39/606/192
>



-- 
ACS (Alavoine Computer Services Ltd)
Chris Alavoine
mob +44 (0)7724 710 730
www.alavoinecs.co.uk
http://twitter.com/#!/alavoinecs
http://www.linkedin.com/pub/chris-alavoine/39/606/192
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 domain members

2013-07-12 Thread steve

On Fri, 2013-07-12 at 15:21 +0100, Chris Alavoine wrote:
> Hi there,
> 
> I would like to setup a Samba 4 member server to act as a separate
> fileserver within my Samba 4 domain.
> 
> Does anyone have any recommendations for this setup?
> 
> I've tried to create one following this:
> 
> https://wiki.samba.org/index.php/Samba4/Domain_Member
> 
> Which seems to work ok until I try to change any permission on any shares
> (or anything within the shares). I then get "access denied" errors.
> Obviously, this is unworkable as a solution as I need to set permissions.

Hi
Give us an example of a share that's working. Then, what you change
within it and what permissions you change to get the 'access denied'.
Which version have you installed?
Cheers,
Steve


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 domain members

2013-07-12 Thread Chris Alavoine

Hi there,

I would like to setup a Samba 4 member server to act as a separate
fileserver within my Samba 4 domain.

Does anyone have any recommendations for this setup?

I've tried to create one following this:

https://wiki.samba.org/index.php/Samba4/Domain_Member

Which seems to work ok until I try to change any permission on any shares
(or anything within the shares). I then get "access denied" errors.
Obviously, this is unworkable as a solution as I need to set permissions.

Any help much appreciated.

Thanks,
Chris.

-- 
ACS (Alavoine Computer Services Ltd)
Chris Alavoine
mob +44 (0)7724 710 730
www.alavoinecs.co.uk
http://twitter.com/#!/alavoinecs
http://www.linkedin.com/pub/chris-alavoine/39/606/192
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Rhedhat 6 And classicupgrade errors

2013-07-04 Thread Andrew Bartlett

On Wed, 2013-07-03 at 12:28 +0100, GUEI née worou noee wrote:
> Hi,
> i upgrade on a new server samba3 to samba4 with a LDAP Backend.
> I have followed this HowTO 
>  http://wiki.samba.org/index.php/Samba4/samba-tool/domain/classicupgrade/HOWTO
> 
> until de classicupgrade step
> Here is the errors I get 

> Following sids are both user and group sids:
>S-1-5-21-1770481708-1631662840-68360779-3221

> raise ProvisioningError("Please remove duplicate sid entries before 
> upgrade.")

> Please, could anyone help me. 
> I have this error since one week and coud not figure it out.
> i need help.

Read the above message carefully, and ensure no user has the same SID as
a group in your source databases. 

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] samba 4 installation failing several troubleshooting steps

2013-07-03 Thread Joe Johnson

Troubleshooting steps fail.  Trying to replace a standalone Netware
server with a Samba4 server with AD.  To isolate this test setup,
changed server's static IP address and separated the wiring.  Then
went through the Troubleshooting portion of The Samba Checklist.  Some
tests pass.  Some tests fail.  I'm weak on Samba, DNS and AD.  I
appreciate your instructions on how to overcome the indicated test
failures.

The setup:
- an inexpensive router provides DHCP to a network of three computers
- Samba4 server (SERVER) has static ip 192.168.3.210
- Windows XP Pro SP3 workstation (WORKSTATION)
- Linux Mint workstation (used for ssh to SERVER)
- Domain is domane.lan
- workgroup is OFFICE
- Samba4 downloaded from git, version 4.1.0pre1-GIT-3e66cb7, using internal DNS
- SERVER runs Ubuntu 12 LTS, recent download with updates, no firewall

smb.conf, resolv.conf, and a query result for DNS records may all be seen at
http://pastebin.com/B5gyDi1s  ("samba 4 configurations as part of
troubleshooting questions")

When making suggestions, please detail the commands you would like me to try.

1)  WORKSTATION can log into the domain and can ping SERVER by its ip
address.  WORKSTATION initially could not ping SERVER by its name, but
could after an entry for SERVER was added in
C:\windows\system32\drivers\etc\hosts.

2)  SERVER can ping WORKSTATION by its ip address but cannot ping the
workstation by its name.

3)  /usr/local/samba/bin/testparm /usr/local/samba/etc/smb.conf  does
not report any errors.

4)  On WORKSTATION I was never able to get a browse list of shares.
An early error seen in /usr/local/samba/var/log.samba is:

[2013/06/21 22:43:29,  0] ../source4/dsdb/common/util_samr.c:185(dsdb_add_user)
  Failed to create user record
CN=WORKSTATION,CN=Computers,DC=domane,DC=lan: dsdb_access: Access
check failed on CN=Computers,DC=domane,DC=lan

5)  host -t SRV _ldap._tcp.domane.lan.  gives expected results
host -t SRV _kerberos._udp.domane.lan.  gives expected results
host -t A server.domane.lan.  gives expected results

6)  On WORKSTATION, checked the box “Use this connection's DNS suffix in DNS
 registration” in Windows XP's TCP/IP properties, General, Advanced,
DNS.  SERVER still cannot ping workstation by name.

7)  smbclient -L SERVER  does provide a list of shares.

8)  /usr/local/samba/bin/nmblookup -B SERVER __SAMBA__.responds with
querying __SAMBA__. on 127.0.0.1
name_query failed to find name __SAMBA__.

9)  nmblookup -B WORKSTATION.domane.lan '*'
  gives the confusing response
querying * on 192.168.3.255
192.168.3.2 *<00>
This is confusing because 192.168.3.2 is the ip addres of the Mint
computer running ssh to SERVER.  WORKSTATION has an ip address of
192.168.3.3

10)  nmblookup -d 2 '*'
  responds with
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
added interface eth0 ip=fe80::211:11ff:fe6f:8df0%eth0
bcast=fe80:::::%eth0 netmask=:::::
added interface eth0 ip=192.168.3.210 bcast=192.168.3.255 netmask=255.255.255.0
querying * on 192.168.3.255
Got a positive name query response from 192.168.3.2 ( 192.168.3.2 )
192.168.3.2 *<00>
Again, this is confusing because 192.168.3.2 is the ip address of the
Minut computer running ssh to SERVER.  WORKSTATION has an ip address
of 192.168.3.3

11)  smbclient //SERVER/INVOICES
  -UAdministrator  requests a password and responds with
session setup failed: NT_STATUS_LOGON_FAILURE
Domain=[OFFICE] OS=[Unix] Server=[Samba 4.1.0pre1-GIT-3e66cb7]
smb: \>

12)  smbclient //SERVER/INVOICES
   with a user other and Administrator requests a password and responds with
session setup failed: NT_STATUS_LOGON_FAILURE

13)  On WORKSTATION, the command   net view \\SERVER   responds with a
list of shares.

14)  On WORKSTATION, the command   net use x: \\SERVER\INVOICES
responds well.  If logged in as administrator, it is possible to use
the dir command to see a list of files.

15)  On WORKSTATION, when graphically browsing the network SERVER is
seen but it does not contain a list of shares.  There is nothing to
graphically select to map.  If a share name is known, it can be
manually mapped similar to prior example.

16)  /usr/local/samba/bin
/nmblookup -M OFFICE
  responds with
name_query failed to find name OFFICE#1d
This is in spite of having  preferred master = yes   in smb.conf

Thank you for helping to identify what is going wrong, and for your
suggestions for fixes.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 Rhedhat 6 And classicupgrade errors

2013-07-03 Thread GUEI née worou noee

Hi,
i upgrade on a new server samba3 to samba4 with a LDAP Backend.
I have followed this HowTO 
 http://wiki.samba.org/index.php/Samba4/samba-tool/domain/classicupgrade/HOWTO

until de classicupgrade step
Here is the errors I get 

 /usr/local/samba/bin/samba-tool domain classicupgrade 
--dbdir=/root/samba3/tdbfiles --use-xattrs=yes  --realm=bceao.int 
/root/samba3/tdbfiles/smb.conf

Reading smb.conf
WARNING: The "idmap backend" option is deprecated
WARNING: The "idmap uid" option is deprecated
WARNING: The "idmap gid" option is deprecated
Provisioning
Exporting account policy
Exporting groups
Ignoring group 'Administrateurs' S-1-5-32-544 listed but then not found: Unable 
to enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Operateurs de compte' S-1-5-32-548 listed but then not found: 
Unable to enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Operateurs impression' S-1-5-32-550 listed but then not found: 
Unable to enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Operateurs de sauvegarde' S-1-5-32-551 listed but then not 
found: Unable to enumerate members for alias, 
(-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Replicateurs' S-1-5-32-552 listed but then not found: Unable to 
enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Invites' S-1-5-32-546 listed but then not found: Unable to 
enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Operateurs de serveur' S-1-5-32-549 listed but then not found: 
Unable to enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Ignoring group 'Utilisateurs' S-1-5-32-545 listed but then not found: Unable to 
enumerate members for alias, (-1073741487,NT_STATUS_NO_SUCH_ALIAS)
Exporting users
sid S-1-5-21-3933610348-2251462730-2069165054-1000 does not belong to our domain
  Demoting BDC account trust for z00-dc3, this DC must be elevated to an AD DC 
using 'samba-tool domain promote'
  Skipping wellknown rid=500 (for username=pdc_admin)
  Skipping wellknown rid=501 (for username=nobody)
Ignoring group memberships of 'toto' 
S-1-5-21-1770481708-1631662840-68360779-30866: Unable to enumerate group 
memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)
Ignoring group memberships of 'etoto' 
S-1-5-21-1770481708-1631662840-68360779-66424: Unable to enumerate group 
memberships, (-1073741596,NT_STATUS_INTERNAL_DB_CORRUPTION)
  Demoting BDC account trust for z00-dc02, this DC must be elevated to an AD DC 
using 'samba-tool domain promote'
Next rid = 66425
Following sids are both user and group sids:
   S-1-5-21-1770481708-1631662840-68360779-3221
ERROR(): uncaught exception - 
ProvisioningError: Please remove duplicate sid entries before upgrade.
  File 
"/usr/local/samba/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 
175, in _run
    return self.run(*args, **kwargs)
  File "/usr/local/samba/lib64/python2.6/site-packages/samba/netcmd/domain.py", 
line 1318, in run
    useeadb=eadb, dns_backend=dns_backend, use_ntvfs=use_ntvfs)
  File "/usr/local/samba/lib64/python2.6/site-packages/samba/upgrade.py", line 
778, in upgrade_from_samba3
    raise ProvisioningError("Please remove duplicate sid entries before 
upgrade.")

I create a link to all files wich are in the same directory as the secret.tdb 
file. But this didn't solve the problem.

Please, could anyone help me. 
I have this error since one week and coud not figure it out.
i need help.


MMe GUEI NOEE MELAINE
BP 3108 DAKAR SENEGAL
SERVICE INFORMATIQUE
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 with FreeIPA as Backend

2013-06-29 Thread Andrew Bartlett

On Fri, 2013-06-28 at 14:09 +0800, Mail Robot wrote:
> Hi everyone,
> 
> I am new to this mailing list.
> 
> At the moment I would like to migrate all of my users from Microsoft Active
> Directory to Open Source, and what I have in mind is getting it into Samba
> 4.
> 
> In extending the functionality of it, I decided to intergrate FreeIPA as
> the backend to Samba 4.
> 
> I saw some obsolete reference on how to use FreeIPA as Samba 4 backend, but
> I don't know where are the new reference.
> 
> Herewith I would seek advise on how to go for my mission.

Samba 4.0 as an AD DC can not use anything other than it's own LDB
database as a backend.

FreeIPA I understand is able to sync or integrate with an AD DC, but you
would need to ask them about that.

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 with FreeIPA as Backend

2013-06-27 Thread Mail Robot

Hi everyone,

I am new to this mailing list.

At the moment I would like to migrate all of my users from Microsoft Active
Directory to Open Source, and what I have in mind is getting it into Samba
4.

In extending the functionality of it, I decided to intergrate FreeIPA as
the backend to Samba 4.

I saw some obsolete reference on how to use FreeIPA as Samba 4 backend, but
I don't know where are the new reference.

Herewith I would seek advise on how to go for my mission.

Thank you

Regards
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

That's exactly what I did

From: Michael De Groote [mailto:i...@sint-pietersschool.be]
Sent: Tuesday, June 11, 2013 4:15 PM
To: Dino Edwards
Cc: Marc Muehlfeld; samba@lists.samba.org
Subject: Re: [Samba] Samba 4 Additional DC existing domain

did you put in a

dns forwarder = ip.of.external.dns.server
line?

2013/6/11 Dino Edwards 
mailto:dino.edwa...@mydirectmail.net>>

> You haven't answered my previous question:
>
>  > Did you followed *all* steps from the  >
> http://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC
>  > HowTo? I didn't saw, in the steps you had listed, that you joined
> the  > domain, etc.

I believe I answered it albeit indirectly. One of the first steps of joining a 
domain as a DC was to run the kinit command and upon success proceed with 
joining the domain. Since I wasn't getting any output from running that 
command, I stopped and didn't go any further with joining the domain because I 
thought there was something wrong. I wasn't aware that I had to run klist in 
Ubuntu in order to get the output that I needed. Once I did that, I went ahead 
and followed the steps to join the domain and I was able to get it working. Now 
I have a smb.conf file like I should. However, now I have a few other questions 
if you could be so kind to answer. When I pointed one of the windows machines 
to use the samba 4 DC as its DNS server, I was able to resolve hosts in the 
mydomain.local domain. However, I wasn't able to resolve hosts outside my 
domain. A Windows DNS server is able to do that. Is this behavior because I'm 
not using Bind with the samba 4 DC but instead I'm using the int
 ernal samba DNS? What do I need to do to rectify that?

I'm also assuming that I should use 127.0.0.1 or the IP of the samba 4 DC as 
the DNS server of the samba 4 DC in /etc/network/interfaces file vs. pointing 
to the Windows DC. Is that a correct assumption?

And finally, rebooting the server does not automatically start samba. I have to 
start it manually. Do I need to create a script in /etc/init.d/ and if that's 
the case, is there a template for that somewhere?

Thanks in advance.

Dino

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

--
Michael De Groote
ICT-coordinator Sint-Pietersschool Korbeek-Lo
ICT-support Sancta Maria Basisschool Leuven
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain



> -Original Message-
> From: Marc Muehlfeld [mailto:sa...@marc-muehlfeld.de]
> Sent: Tuesday, June 11, 2013 4:19 PM
> To: Dino Edwards
> Cc: samba@lists.samba.org
> Subject: Re: [Samba] Samba 4 Additional DC existing domain
> 
> Hello Dino,
> 
> 
> I changed the HowTo a bit, to make it more clear, that the output shown
> is from "klist" and not "kinit".
> 

Awesome, thanks!



> > When I pointed one of the windows machines to use the samba 4 DC
>  > as its DNS server, I was able to resolve hosts in the mydomain.local
>  > domain. However, I wasn't able to resolve hosts outside my domain.
>  > A Windows DNS server is able to do that.
> 
> You have to add
> dns forwarder = 8.8.8.8
> to your smb.conf and restart Samba. Adapt 8.8.8.8 to whatever you host
> is, to which you want to forward queries to, your Samba isn't
> authoritative for.

I added it in the [global] section of the smb.conf and it seems to work

 
> > I'm also assuming that I should use 127.0.0.1 or the IP of the samba
> 4
>  > DC as the DNS server of the samba 4 DC in /etc/network/interfaces
> file
>  > vs. pointing to the Windows DC. Is that a correct assumption?
> 
> You can use the IP of any host, that is able to resolve your AD DNS
> domain(s).
> 


> 
> > And finally, rebooting the server does not automatically start samba.
>  > I have to start it manually. Do I need to create a script in
>  > /etc/init.d/ and if that's the case, is there a template for
> > that somewhere?
> 
> Yes, you need something that start the service if you want Samba to
> come
> up on reboots. See
> https://wiki.samba.org/index.php/Samba4/InitScript
> 
>

Awesome that worked too.


Cheers,

Dino
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

2013-06-11 Thread Ricky Nance

On Tue, Jun 11, 2013 at 3:19 PM, Marc Muehlfeld wrote:

> I changed the HowTo a bit, to make it more clear, that the output shown is
> from "klist" and not "kinit".

Marc, thanks for adding that :).

Also dns forwarder = 8.8.8.8 the 8.8.8.8 there is a Google dns server, so
that ip WILL work :) but if you have a local one you'd rather use, then use
it. (8.8.4.4 is another google one if I recall right)

Ricky
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

2013-06-11 Thread Marc Muehlfeld


Hello Dino,


Am 11.06.2013 22:04, schrieb Dino Edwards:

I believe I answered it albeit indirectly. One of the first steps of

> joining a domain as a DC was to run the kinit command and upon success
> proceed with joining the domain. Since I wasn't getting any output from
> running that command, I stopped and didn't go any further with joining
> the domain because I thought there was something wrong.

I changed the HowTo a bit, to make it more clear, that the output shown 
is from "klist" and not "kinit".





When I pointed one of the windows machines to use the samba 4 DC

> as its DNS server, I was able to resolve hosts in the mydomain.local
> domain. However, I wasn't able to resolve hosts outside my domain.
> A Windows DNS server is able to do that.

You have to add
dns forwarder = 8.8.8.8
to your smb.conf and restart Samba. Adapt 8.8.8.8 to whatever you host 
is, to which you want to forward queries to, your Samba isn't 
authoritative for.





I'm also assuming that I should use 127.0.0.1 or the IP of the samba 4

> DC as the DNS server of the samba 4 DC in /etc/network/interfaces file
> vs. pointing to the Windows DC. Is that a correct assumption?

You can use the IP of any host, that is able to resolve your AD DNS 
domain(s).





And finally, rebooting the server does not automatically start samba.

> I have to start it manually. Do I need to create a script in
> /etc/init.d/ and if that's the case, is there a template for

that somewhere?


Yes, you need something that start the service if you want Samba to come 
up on reboots. See

https://wiki.samba.org/index.php/Samba4/InitScript


Regards,
Marc
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

2013-06-11 Thread Michael De Groote

did you put in a

dns forwarder = ip.of.external.dns.server

line?


2013/6/11 Dino Edwards 

>
> > You haven't answered my previous question:
> >
> >  > Did you followed *all* steps from the  >
> > http://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC
> >  > HowTo? I didn't saw, in the steps you had listed, that you joined
> > the  > domain, etc.
>
>
> I believe I answered it albeit indirectly. One of the first steps of
> joining a domain as a DC was to run the kinit command and upon success
> proceed with joining the domain. Since I wasn't getting any output from
> running that command, I stopped and didn't go any further with joining the
> domain because I thought there was something wrong. I wasn't aware that I
> had to run klist in Ubuntu in order to get the output that I needed. Once I
> did that, I went ahead and followed the steps to join the domain and I was
> able to get it working. Now I have a smb.conf file like I should. However,
> now I have a few other questions if you could be so kind to answer. When I
> pointed one of the windows machines to use the samba 4 DC as its DNS
> server, I was able to resolve hosts in the mydomain.local domain. However,
> I wasn't able to resolve hosts outside my domain. A Windows DNS server is
> able to do that. Is this behavior because I'm not using Bind with the samba
> 4 DC but instead I'm using the int
>  ernal samba DNS? What do I need to do to rectify that?
>
> I'm also assuming that I should use 127.0.0.1 or the IP of the samba 4 DC
> as the DNS server of the samba 4 DC in /etc/network/interfaces file vs.
> pointing to the Windows DC. Is that a correct assumption?
>
> And finally, rebooting the server does not automatically start samba. I
> have to start it manually. Do I need to create a script in /etc/init.d/ and
> if that's the case, is there a template for that somewhere?
>
> Thanks in advance.
>
> Dino
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>



-- 
Michael De Groote
ICT-coordinator Sint-Pietersschool Korbeek-Lo
ICT-support Sancta Maria Basisschool Leuven
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain


> You haven't answered my previous question:
> 
>  > Did you followed *all* steps from the  >
> http://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC
>  > HowTo? I didn't saw, in the steps you had listed, that you joined
> the  > domain, etc.


I believe I answered it albeit indirectly. One of the first steps of joining a 
domain as a DC was to run the kinit command and upon success proceed with 
joining the domain. Since I wasn't getting any output from running that 
command, I stopped and didn't go any further with joining the domain because I 
thought there was something wrong. I wasn't aware that I had to run klist in 
Ubuntu in order to get the output that I needed. Once I did that, I went ahead 
and followed the steps to join the domain and I was able to get it working. Now 
I have a smb.conf file like I should. However, now I have a few other questions 
if you could be so kind to answer. When I pointed one of the windows machines 
to use the samba 4 DC as its DNS server, I was able to resolve hosts in the 
mydomain.local domain. However, I wasn't able to resolve hosts outside my 
domain. A Windows DNS server is able to do that. Is this behavior because I'm 
not using Bind with the samba 4 DC but instead I'm using the int
 ernal samba DNS? What do I need to do to rectify that?

I'm also assuming that I should use 127.0.0.1 or the IP of the samba 4 DC as 
the DNS server of the samba 4 DC in /etc/network/interfaces file vs. pointing 
to the Windows DC. Is that a correct assumption?

And finally, rebooting the server does not automatically start samba. I have to 
start it manually. Do I need to create a script in /etc/init.d/ and if that's 
the case, is there a template for that somewhere?

Thanks in advance.

Dino


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

2013-06-11 Thread Marc Muehlfeld


Am 11.06.2013 18:21, schrieb Dino Edwards:

samba version 4.0.6 started.
Copyright Andrew Tridgell and the Samba Team 1992-2012
At this time the 'samba' binary should only be used for either:
'server role = active directory domain controller' or to access the ntvfs file 
server with 'server services = +smb' or the rpc proxy with 'dcerpc endpoint 
servers = remote'
You should start smbd/nmbd/winbindd instead for domain member and standalone 
file server tasks



You haven't answered my previous question:

> Did you followed *all* steps from the
> http://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC
> HowTo? I didn't saw, in the steps you had listed, that you joined the
> domain, etc.


Because, if you haven't joined the domain, then you don't have an 
smb.conf either. And without a smb.conf, you get this error, too



If you have an smb.conf, then please post it.



Regards,
Marc



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain


> > Kinit doesn't have output on all systems (ubuntu is one of them)
> after
> > running that, klist should show that you have an active ticket. 

Running:
Klist

I get the following:

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@MYDOMAIN.LOCAL

Valid starting ExpiresService principal
06/11/13 12:22:52  06/11/13 22:22:42  krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
renew until 06/12/13 12:22:52
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain

> -Original Message-
> From: samba-boun...@lists.samba.org [mailto:samba-
> boun...@lists.samba.org] On Behalf Of "David González Herrera -
> [DGHVoIP]"
> Sent: Tuesday, June 11, 2013 12:02 PM
> To: Ricky Nance
> Cc: samba@lists.samba.org
> Subject: Re: [Samba] Samba 4 Additional DC existing domain
> 
> On 6/11/2013 10:58 AM, Ricky Nance wrote:
> > Kinit doesn't have output on all systems (ubuntu is one of them)
> after
> > running that, klist should show that you have an active ticket. Also
> > do what Marc says samba -i -M single and see where samba is failing
> > the startup.
> If I migh add issue the command with some debug level so you see some
> more info:
> 
> samba -i -M single -d3
> 

When I run:
/usr/local/samba/sbin/samba -i -M single -d3

I get the following: 

samba version 4.0.6 started.
Copyright Andrew Tridgell and the Samba Team 1992-2012
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'schannel' registered
GENSEC backend 'spnego' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
NTPTR backend 'simple_ldb'
NTVFS backend 'default' for type 1 registered
NTVFS backend 'posix' for type 1 registered
NTVFS backend 'unixuid' for type 1 registered
NTVFS backend 'unixuid' for type 3 registered
NTVFS backend 'unixuid' for type 2 registered
NTVFS backend 'cifs' for type 1 registered
NTVFS backend 'smb2' for type 1 registered
NTVFS backend 'simple' for type 1 registered
NTVFS backend 'cifsposix' for type 1 registered
NTVFS backend 'default' for type 3 registered
NTVFS backend 'default' for type 2 registered
NTVFS backend 'nbench' for type 1 registered
PROCESS_MODEL 'single' registered
PROCESS_MODEL 'onefork' registered
PROCESS_MODEL 'prefork' registered
PROCESS_MODEL 'standard' registered
AUTH backend 'sam' registered
AUTH backend 'sam_ignoredomain' registered
AUTH backend 'anonymous' registered
AUTH backend 'winbind' registered
AUTH backend 'winbind_wbclient' registered
AUTH backend 'name_to_ntstatus' registered
AUTH backend 'unix' registered
SHARE backend [classic] registered.
SHARE backend [ldb] registered.
At this time the 'samba' binary should only be used for either:
'server role = active directory domain controller' or to access the ntvfs file 
server with 'server services = +smb' or the rpc proxy with 'dcerpc endpoint 
servers = remote'
You should start smbd/nmbd/winbindd instead for domain member and standalone 
file server task
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba 4 Additional DC existing domain