including root - which shouldn't need winbind to succeed!
Normally I have to reboot to fix, however if I was lucky enough for it
to happen before my screensaver kicked in, then simply restarting
winbind fixes the problem.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigati
ot;
Wireshark shows the server sending "STATUS_FILE_LOCK_CONFLICT" errors to
Linux, but it appears that isn't exposed to the OS?
Is this a bug - or a lack of a feature? This is samba-3.2.11-1
Thanks
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone:
On 10/22/2009 12:07 PM, Jeremy Allison wrote:
> On Thu, Oct 22, 2009 at 10:33:28AM +1300, Jason Haar wrote:
>
>> Hi there
>>
>> I recall in times past that when a locked file on a Windows server was
>> accessed by smbfs, you received a kind of "text file busy&
is
continually trying to talk to these non-available domain controllers and
it never gives up - and so the offline mode never kicks in.
It's got so bad that I now have scripts that run whenever a network
change occurs, to check if winbind is "stuck" and restart accordingly.
--
Chee
I've tried this with 3.2.11, I'm assuming it still affects the current
version
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubs
Windows dropped the messaging service with Vista - you simply cannot do what
you want with Win7 either
Jason
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
lock = 1" would allow
up to 99 domains without any effort?
I know there are ldap and ad backends - but they all assume your Windows
environment is "Unix friendly" which ours isn't. I'm just trying to make
our Samba servers play nicely within our Windows-dominated empire
more time in troubleshooting I hoped that someone
>> could assist and tell me if such a configuration is possible.
>>
>> If this is not possible, it would be great to know why.
>>
>> Best Regards,
>> Hagai
>>
>>
>>
>> --
>> To u
ssword samba-...@ad.domain failed: KRB5 error code 29
Join to domain is not valid: Undetermined error
The "Undetermined error" is a bit of a pain :-)
Any ideas what's happening here? I assume tonnes of other Samba sites
talk to RODCs and I haven't heard of this as a general iss
4. I'll also upload it to bugzilla
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
%define initdir %{_sysconfdir}/rc.d/init.d
%define auth %(test -f /e
One thing: do you have "log level" set? If so, put it down to "0" -
logging (which is really debugging) totally kills Samba performance
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint:
ing a DNS update? It doesn't
appear to happen very often: I have 28 servers world-wide with this same
"eth0, eth0:2" trick and this is the first time I've seen it.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635
Samba work its way around
this? As an added advantage, ping tests could even ensure Samba connects
to the closest DC by measuring the latency...?
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E
is
share (test)
Any ideas? I can send the entire log (even a packet trace) to someone if
they need it.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
Ch
Jason Haar wrote:
Does this ring any bells? Would recompiling Samba with
"--with-dnsupdate" (which still seems to be disabled by default)
enable Samba to *continually* ensure its "A" record is kept intact?
Weirdly enough, we find that if you go through this grief
kept intact? Weirdly
enough, we find that if you go through this grief of disappearing "A"
records for a week or so (and adding it back in), then suddenly it seems
to all go right and the problem disappears for that particular server.
But then the next one you install goes through t
to Unix login processes in
all this, e.g. ssh, console, etc. And yes, we have 3.0.28 and I can
"flip flop" between these two scenarios by making this change - I just
checked :-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +
NTLM works,
Squid can't cache the lookups as much (from a posting in 2003 - can't
find anything newer).
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
but - again -
we've found issues with DSL links - which I see you mentioning too.
Change your client's MTU to 1300 and see if the problem disappears. Then
reduce it on the Samba server involved instead - as that's an easier
solution than touching every client.
--
Cheers
Jaso
be a pain - that's why you should use the "-A
/path/file" option where possible.
...unfortunately the Samba "net" command doesn't support it - I think
it's the only Samba client command that doesn't?
--
Cheers
Jason Haar
Information Security Manager, Trimbl
;testparam" shows nothing
that stands out as being behind this, and the logs show no other
errors/failures besides this.
Any ideas? This is CentOS4 systems with samba-3.0.28a. Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 F
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailma
s a bit of HTTP/1.1 Keepalive reuse that speeds things up - but
effectively it's a cow.
If you can stomach the lack of encryption, go back to Basic proxy
authentication - squid can cache the hell out of that! I bet you'll find
all your problems disappear.
--
Cheers
Jason Haar
I
can stomach
the lack of encryption, but with basic proxy auth can they still
authenticate to AD?
Absolutely. There is no difference in Squid's ntlm_auth functionality
between choosing Basic or NTLM/Negotiate. ie you can still do
group-based access controls using Basic.
--
Cheers
Jason Haa
t map.
Known issue in pre-3.0.29 releases of Samba. Upgrade to 3.0.30 and
you'll be right :-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubs
and then rejoin ADS and
restart. That always fixes it. This just happened today under 3.0.30 -
so it's still a problem with the current release.
Is there a tool or something to manipulate/delete individual entries
from "the cache" so that we don't have to go through this wh
pears.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lis
's working well in that direction...?
Am I right, or have we got a problem that could actually be fixed? :-)
This is under FC8.
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6
ep'ping /var/log/sambe/* for
the groupname shows only 'getgrnam domain3\group2' - no real error as such
PS: there are now 155 winbindd processes running - so it did come down a
bit. But I don't think that's normal? Under 3.0.30 it never seemed to go
above 10-ish?
--
C
is a Distribution List too BTW (not just a Security Group).
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the following UR
330-6760
...and yet "wbinfo --sid-to-name" maps that back to the correct
username, and "wbinfo --name-to-sid" maps the username to the same SID.
As mentioned earlier, ntlm_auth with such an account and correct
password returns OK.
Any ideas? It smells so close to working...
--
I must say it surprises me. I know I can easily deduce the same values
that I just put into krb5.conf via some DNS lookups - I thought Samba
would have done the same... (actually you don't even need DNS for that:
Under ADS, realm == fqdn)
Thanks!
--
Cheers
Jason Haar
Information Security
k to RPC...
Joined domain SUBDOM.
..but it didn't work. MMC Users and Computers shows the hostname in the
Computers container - but it either has 8bit garbage after the name (i.e
it's corrupt), or it's marked as Disabled.
Any ideas what's wrong?
Thanks!
--
Cheers
Jason Haar
s first time.
I'd still say that was a bug in Samba - but the workaround will do for
now :-)
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
rick.
Good luck. Hope that helps. I just love being able to "chown
domain\\username filename" - freaks the hell out of the Windows Admins ;-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A
E
[2006/12/21 07:56:19, 5] lib/util.c:show_msg(485)
I have re-added the machine to the domain without any change. Any other
ideas? I have just finished adding 16 Samba servers to 4 different
domains and this is the only one to fail in such a way. I'm a bit stumped...
--
Cheers
Jason Haar
In
their closest DC is from that information - but it looks like
Samba can not? Is that correct, or is there something else I can do?
Resolving usernames/groups is pretty dire due to this - a Samba server
in Sweden is currently using a DC in Beijing for example.
This is Samba-3.0.23d under Cen
becomes a bit dodgy? (e.g. does that
lack of a TTY in cron trigger something?)
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe
beforehand is a bit odd. If "%U" can
be created on the fly - why not anything else?
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To uns
os really wants to stop you assigning multiple names to the same
token (at least I had huge trouble getting it to work correctly), so
mapping everything to separate IPs is the cleanest IMHO.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax:
(with 100M
cards) and couldn't figure out what was wrong. Then we noticed "log
level = 9" ;-) Turning that off kicked performance up to 80Mbs - which
is equivalent to our Win2K3 servers.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3
e iocharset=utf8 option
to ensure best "compatibility" with the backend Win2K and Win2K3 servers?
(I assuming all Win2K/WinwK3 servers are utf8?)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C
e
DOM1 members - **but not any from DOM2 or the other trusted forests**!
BTW The DOM1 Samba server is quite capable of successfully doing a
"getent passwd DOM2\account".
Am I doing something wrong? How can I get a Samba server in either DOM1
or DOM2 to fully support allowing anyone in tha
work (it implies
winbind is totally happy?), whereas smbd should return Access Denied?
And yes, "allow trusted domains = Yes" is set.
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C
geographically separate. Neither NFS nor Samba/SMB perform
well over a WAN.
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to th
n NFS client?
I'm really surprised at that
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the foll
y incoming ticket".
Correcting the time fixed the fault. However, it remains that Samba
rejected them when Windows servers didn't.
Is that an option that can be enabled? Anything that makes Samba look
more like Windows is a Good Thing (even if it violates the entire point
of Kerberos! ;-
that sort of defeats the purpose. We certainly
tear down and build up new DCs often enough to turn that into a
maintainance disaster anyway ;)
Have I missed something that could make these trusts more reliable? We
are running Samba-3.0.24 under CentOS4.4
Thanks!
--
Cheers
Jason Haar
Infor
2K3 client had a ntp agent installed, it was
unable to keep it's clock in sync. We also have an identical issue with
running virtual Linux in the same environment. The syslog is filled with
ntp errors about being unable to slew the clock.
So we're going to run VMware under Fedora instead
d idea to make Samba
look more like a Windows server - even if it means handling such a
hare-brained situation. But - that's easy for me to say :-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9
ring clock-slew events. Doesn't that mean
Active Directory's Kerberos is susceptible to man-in-the-middle attacks
then? :-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 842
he
> time from the DC and all connections to servers work
> (as you'd expect with the correct time).
>
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Gerald (Jerry) Carter wrote:
> Jason Haar wrote:
> > Hi there
>
> > We have a bunch of Win2K3 trusted domains that are
> > parts of other forests from our own Win2K3 forest.
> ...
> We should be talking to DNS anyways in this case.
> Can you DNS resolve teh S
ersion of a "pure" 2.6.20 kernel, and am seeing it on my FC6
workstation as well as a FC7pre3 laptop.
Can anyone else confirm? This is a serious bug for us. Returning bogus
data is majorly worse than even a crash... (we're supposed to be
rsync'ing that data). We're stickin
hose directories results in the same list of 74 top-level
subdirs again.
So maybe this problem only hits servers with DFS enabled? But it works
under 2.6.18...?
Help?
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerpr
in the cifs kernel module in newer
releases?
> I reported this as a bug a while ago, but it apparently hasn't been
> fixed yet. See https://bugzilla.samba.org/show_bug.cgi?id=4066.
Thanks for that - I'll add a "me too"
--
Cheers
Jason Haar
Information Security Ma
7;t. Has the
format of "username map" changed? I currently have "jhaar=DOM\jhaar" and
that worked under 3.0.24 and previous.
I have rolled back to 3.0.24 and the problem disappears - so it's
something in 3.0.25 fer shure...
--
Cheers
Jason Haar
Information Security Manager,
Christian Perrier wrote:
> Quoting Jason Haar ([EMAIL PROTECTED]):
>
>> Hi there
>>
>> I was using "username map" under 3.0.24 so that when I connected from
>> DOM\jhaar under (ADS Win2K3) Windows, it was mapped to my local "jhaar"
ad due to this ;-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.or
so maybe winbind was talking to the RODC there -
maybe not - dunno
Is this a known issue, and if not, what can I do to track down the
cause, as it "sort of" diminishes the usefulness of Samba if you can't
trust the file ownership anymore
Thanks
--
Cheers
Jason Haar
Information Secu
the 3.5 line. We had serious issues with
3.6 which I've blamed on old system libraries and have given up on 3.6
until we upgrade to CentOS-6 later this year. At that point the
intention is to keep to the vendor release
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
1-1705711945-1589781387-1543859470-20569:
NT_STATUS_UNSUCCESSFUL
So that makes no sense: how can "wbinfo -s SID" work, when the winbind
logfile shows that it couldn't convert the same sid?
Thanks
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1
#x27;t appear to be editable! That makes no sense - any ideas
what's gone wrong? I suspect the server has some old library that is
triggering this - but don't know where to look...?
Thanks
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
P
27;t a RODC either (although
it used to be - I forced the Windows guys to upgraded it to a full DC in
an attempt to fix this problem - didn't help)
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B
ke a new smbmount option "ignore-attribs" :-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
To unsubscribe from this list go to the following URL and read
u. One of our sites uses rsync on NT for backup to a
remote tape library server. Use rsync to backup the data, and cacls into a
file to gain the perm structure.
So the same could be done with xfs - using whatever command it uses to show
ACLs.
Could all be wrapped into one funky shell script...
--
n" share. Then
> automatically, as the user logs on, he/she will gain local administrator
> rights and privilidges.
That doesn't really work does it? Basically an unpriviledged user runs a
program, and suddenly they're local admin?!?!?
--
Cheers
Jason Haar
Information Security Man
67 matches
Mail list logo