Re: [Samba] How to allow users to be local admin

2013-09-05 Thread Götz Reinicke - IT Koordinator
Am 04.09.13 17:00, schrieb Gregory Sloop: GRIK Am 02.09.13 18:20, schrieb Marc Muehlfeld: Hello Götz, Am 02.09.2013 14:43, schrieb Götz Reinicke - IT Koordinator: it's some time that I had to touch our samba installation and may be somewon can point me to the right direction. We run a

Re: [Samba] oplocks for Access DB

2013-09-05 Thread Volker Lendecke
On Thu, Sep 05, 2013 at 11:07:17AM +1200, sond wrote: [DB_BE] path = /home/DATA2/DB_BE write list = +db-users force group = +db-users force create mode = 0770 force directory mode = 0770 oplocks = no level2 oplocks = no veto

Re: [Samba] Empty DNS entry, no A record, can't delete or update

2013-09-05 Thread Thomas Zeitinger
Hi Georg, On 2013-09-04 17:24, Georg Bretschneider wrote: root:~# samba-tool dns query pdc.domain.local zoneA hostA ALL -Uadministrator Name=, Records=0, Children=0 root:~# samba-tool dns query pdc.domain.local zoneA @ ALL -Uadministrator [a lot of correct host entries with their

[Samba] How do I lock a shared file?

2013-09-05 Thread steve
4.0.9 as a file server Hi We have a rw folder where we can share files. If a user opens a file, I would like it to be locked so the other users can't open and edit it at the same time. Is this possible? Here is the share with its acl: [privado] path = /home/privado read only = No inherit acls =

Re: [Samba] Empty DNS entry, no A record, can't delete or update

2013-09-05 Thread Georg Bretschneider
Hi Thomas, same result as with 'samba-tool dns add'. I have to delete some kind of record, but there is non really. Just some meta-entry. I finally found the location where everything is stored and used 'tdbtool' to edit the database. Somehow for said hostA there were two entries, each with a

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Volker Lendecke
On Thu, Sep 05, 2013 at 10:30:56AM +0200, steve wrote: 4.0.9 as a file server Hi We have a rw folder where we can share files. If a user opens a file, I would like it to be locked so the other users can't open and edit it at the same time. Is this possible? Open the file with a smb client

Re: [Samba] dns update failt (kerberos)

2013-09-05 Thread Thomas Zeitinger
re, found something different, but important: root@linsrv:~# kinit LINSRV$@DOMAIN.LOCAL kinit: Client not found in Kerberos database while getting initial credentials root@linsrv:~# kinit administrator@DOMAIN.LOCAL Password for administrator@DOMAIN.LOCAL: Warning: Your password will expire in

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread steve
On Thu, 2013-09-05 at 11:51 +0200, Volker Lendecke wrote: On Thu, Sep 05, 2013 at 10:30:56AM +0200, steve wrote: 4.0.9 as a file server Hi We have a rw folder where we can share files. If a user opens a file, I would like it to be locked so the other users can't open and edit it at the

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Volker Lendecke
On Thu, Sep 05, 2013 at 01:23:14PM +0200, steve wrote: On Thu, 2013-09-05 at 11:51 +0200, Volker Lendecke wrote: On Thu, Sep 05, 2013 at 10:30:56AM +0200, steve wrote: 4.0.9 as a file server Hi We have a rw folder where we can share files. If a user opens a file, I would like it to

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread steve
On Thu, 2013-09-05 at 13:34 +0200, Volker Lendecke wrote: On Thu, Sep 05, 2013 at 01:23:14PM +0200, steve wrote: On Thu, 2013-09-05 at 11:51 +0200, Volker Lendecke wrote: On Thu, Sep 05, 2013 at 10:30:56AM +0200, steve wrote: 4.0.9 as a file server Hi We have a rw folder where we

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Volker Lendecke
On Thu, Sep 05, 2013 at 02:08:27PM +0200, steve wrote: This is a feature of the SMB protocol that a client can explicitly request. It's called share modes. There is no option where you can enable this for all open files. This would not make sense, as very often a single client opens a

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread steve
On Thu, 2013-09-05 at 14:14 +0200, Volker Lendecke wrote: On Thu, Sep 05, 2013 at 02:08:27PM +0200, steve wrote: This is a feature of the SMB protocol that a client can explicitly request. It's called share modes. There is no option where you can enable this for all open files. This

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Volker Lendecke
On Thu, Sep 05, 2013 at 02:23:10PM +0200, steve wrote: It's a pity that we'll have to work around it. Surely Samba knows if a file is open or not doesn't it? What's all this oplock stuff? It would Samba certainly knows if a file is open. But it is by no way safe that an application really

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Helmut Hullen
Hallo, steve, Du meintest am 05.09.13: School classes often have projects with files that many students will need to edit. [...] Also, nobody forces applications to keep files open while they are edited. For example even some Windows native editor (I don't remember which) loads files into

[Samba] Winbindd IDMAP SID-to-UNIX-IDs problem

2013-09-05 Thread Burgess, Adam
IDAMP cache somehow ends up with an unmapped SID2UID entry (i.e value = -1) and the SID2GID entry expires. At this stage winbindd returns unmapped for a SID-to-UNIX-IDs request. This results in smbd giving incorrect group memberships and incorrect resource access, until the SID2UID entry

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread steve
On Thu, 2013-09-05 at 14:40 +0200, Helmut Hullen wrote: Hallo, steve, Du meintest am 05.09.13: School classes often have projects with files that many students will need to edit. [...] Also, nobody forces applications to keep files open while they are edited. For example even

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread Jeremy Allison
On Thu, Sep 05, 2013 at 06:25:15PM +0200, steve wrote: Hi Yeah, the lesson plan is a good idea! LibreOffice locks files as you'd expect:) Nothing else works though. I'm amazed that no one else has encountered this before. Every content management service software product is based on the

[Samba] DNSMasq and OpenWRT as DHCP and Internal DNS

2013-09-05 Thread Szymon Życiński
Hello I use DNSMasq on OpenWRT router, OpenWRT provides also DHCP. Another linux box works as PDC with Samba 4. Everything seems to be ok except Internal DNS. Whole Domain (60 machines) works ok but only Domain Controler created it's account in dns. How can i diagnose problem? Maybe it

Re: [Samba] AD DC eventually not browsable without restart

2013-09-05 Thread Kevin Field
I just noticed something interesting, since I have /etc under version control: /etc/mtab changed thusly: -tmpfs /dev/shm tmpfs rw,rootcontext=system_u:object_r:tmpfs_t:s0 0 0 +tmpfs /dev/shm tmpfs rw 0 0 Does this mean anything to our troubleshooting? Thanks, Kev On 2013-09-04 2:02 PM, Kevin

Re: [Samba] Conversion error: Illegal multibyte sequence

2013-09-05 Thread Jeremy Allison
On Thu, Sep 05, 2013 at 10:15:16PM +0200, Laurent Blume wrote: Hello list, I've noticed this problem for a few years now, I think. I see it popped out now and then in discussions. But they always end before a solution is given. So let's try one more time :-) I have plenty of UTF-8

Re: [Samba] Conversion error: Illegal multibyte sequence

2013-09-05 Thread Laurent Blume
On 2013-09-05 10:35 PM, Jeremy Allison wrote: This is the call to smb_iconv() returning an errno of EINVAL. Firstly, add some debug statements inside smb_iconv_open_ex() to find out if we're using the sys_iconv() function (that calls the system iconv) or the internal UFT8 converters. If

Re: [Samba] Conversion error: Illegal multibyte sequence

2013-09-05 Thread Jeremy Allison
On Thu, Sep 05, 2013 at 11:28:14PM +0200, Laurent Blume wrote: I'm not sure I'm still good at adding printf(DEBUG\n) lines around :-) so I tried my hand with dtrace for a start. Here are some examples of what it returns when looking at smb_iconv() while I opened the directory and listed

[Samba] Conversion error: Illegal multibyte sequence

2013-09-05 Thread Laurent Blume
Hello list, I've noticed this problem for a few years now, I think. I see it popped out now and then in discussions. But they always end before a solution is given. So let's try one more time :-) I have plenty of UTF-8 named files and directories. It's UTF-8 all round, I don't use anything

Re: [Samba] Empty DNS entry, no A record, can't delete or update

2013-09-05 Thread Thomas Zeitinger
re, thanks for the hint, now I know where the important files for the backup lying around ;-) On 2013-09-05 11:04, Georg Bretschneider wrote: [...] cd [install prefix]/samba/private/sam.ldb.d/ tdbtool -H tdb://DC=DOMAINDNSZONES,DC=DOMAIN,DC=LOCAL.ldb [...] -- Thomas Zeitinger

Re: [Samba] How to allow users to be local admin

2013-09-05 Thread Ricky Nance
Its been a long time, but I think NTPoledit would let you create a .pol file you could put on the netlogon share and have the groups linked. Example, make a domain group called privileged and then create a policy that adds the privileged group to the local admins group... It'd be worth a shot.

Re: [Samba] dns update failt (kerberos)

2013-09-05 Thread Thomas Zeitinger
Hey! I found another interessting fact: samba_dnsupdate --verbose --all-names -d 10 shows me: [...] privateKeytab: secrets.keytab [...] So I tried root@linsrv:~# klist -t -k /usr/local/samba/private/secrets.keytab Keytab name: FILE:/usr/local/samba/private/secrets.keytab KVNO Timestamp

Re: [Samba] primary GID based access for user in 16 supplementary groups

2013-09-05 Thread steve
On Thu, 2013-09-05 at 19:45 +0100, Tris Mabbs wrote: 5. Are you *absolutely* sure that your idmap back-ends are doing what you thought? Here's another few cents: What you are describing is almost certainly mismatched gidNumbers. Depending on where the SID to GID mapping came from it will be

Re: [Samba] dns update failt (kerberos)

2013-09-05 Thread Burgess, Adam
They will likely be different entries with different kvno and encryption type combinations. Not sure what syntax your klist uses but -e option may give you the encryption type output for example. Adam -Original Message- From: samba-boun...@lists.samba.org

[Samba] primary GID based access for user in 16 supplementary groups

2013-09-05 Thread Burgess, Adam
We observe a difference between a Windows 7 client and Windows 2003/XP client when accessing directories that should be accessible via the UNIX accounts primary group GID. Windows client refuses access. Ignoring for now why the two different client behaviours (either some subtle difference in

Re: [Samba] samba Digest, Vol 129, Issue 5

2013-09-05 Thread paulw
I am Currently out of the office and will return on Monday 9th September. My email will not be monitor , so if you require assistance please email supp...@swift-computing.co.uk. -- To unsubscribe from this list go to the following URL and read the instructions:

Re: [Samba] How do I lock a shared file?

2013-09-05 Thread steve
On Thu, 2013-09-05 at 10:25 -0700, Jeremy Allison wrote: On Thu, Sep 05, 2013 at 06:25:15PM +0200, steve wrote: Hi Yeah, the lesson plan is a good idea! LibreOffice locks files as you'd expect:) Nothing else works though. I'm amazed that no one else has encountered this before.

Re: [Samba] DNSMasq and OpenWRT as DHCP and Internal DNS

2013-09-05 Thread Gerry Reno
dnsmasq: not authoritative, no SOA, no NS, no master-slaves, just has caching and forwarding basically just a client side solution. --- If this has changed I would like to know. On 09/05/2013 02:26 PM, Szymon Życiński wrote: Hello I use DNSMasq on OpenWRT router, OpenWRT provides also

Re: [Samba] primary GID based access for user in 16 supplementary groups

2013-09-05 Thread Tris Mabbs
Hiya Adam, We too have had no end of problems with this sort of issue using Samba on Solaris (11 in our case) running against AD and using (predominantly) Windows 7 clients. Someone with more knowledge of the Samba internals can probably answer your questions about what is the correct behaviour,

[Samba] Fail to login from trusted AD: NT_STATUS_TRUSTED_DOMAIN_FAILURE

2013-09-05 Thread xfwangbest
Hello I have two MS AD 2008 let's say AD1 and AD2. They have bi-direction trusted relationship. I have two linux servers joined into AD2, let's say LNX1 and LNX2. On LNX1, it can authenticate any users both from AD1 or AD2. Howerver, on LNX2, it can only authenticate users in AD2 but failed

[Samba] Windows 7 samba 4 domain join problem

2013-09-05 Thread jared . m . jacobson
I stood up a samba 4 (4.0.9) Active Directory domain controller on a Red Hat Enterprise Linux 6.3 server, configured in accordance with the Samba AD DC HOWTO https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO , and tailored to the domain name I want. I'm trying to join a Windows 7 Enterprise

Re: [Samba] Samba4/Windows DNS replication and administration issue

2013-09-05 Thread Pete Storkey
t looks as though I have a bad key in my dns.keytab. I see the following messages in /var/named/data/named.run: process_gsstkey(): dns_tsigerror_badkey If I manually trigger replication from the Linux/samba server, I see denied messages for dynamic dns updates coming from the windows server in

[SCM] Samba Shared Repository - branch master updated

2013-09-05 Thread Jeremy Allison
The branch, master has been updated via d3c689f lib: Use mem_ctx arg in gencache_get via 32037e0 Add a talloc context to sitename_fetch(). via 6b915bf Add a talloc context to saf_fetch(). via 8a7246a lib: Add a mem_ctx arg to gencache_get (unused so far) via

[SCM] Samba Shared Repository - branch master updated

2013-09-05 Thread Jeremy Allison
The branch, master has been updated via 196da59 smbd: Remove FORCE_OPLOCK_BREAK_TO_NONE via 7786369 torture: Adapt raw.oplock to w2k12 via f6afdcd torture: Add a new w2k12 target via 5e450f5 smbd: Fix breaking level2 on allocate from d3c689f lib: Use mem_ctx