Re: [Samba] winbind causes Linux to lockup when connectivity to AD is lost (subject line edited for clarity)

including root - which shouldn't need winbind to succeed! Normally I have to reboot to fix, however if I was lucky enough for it to happen before my screensaver kicked in, then simply restarting winbind fixes the problem. -- Cheers Jason Haar Information Security Manager, Trimble Navigati

[Samba] mount.cifs not reporting locking issues to Linux?

ot; Wireshark shows the server sending "STATUS_FILE_LOCK_CONFLICT" errors to Linux, but it appears that isn't exposed to the OS? Is this a bug - or a lack of a feature? This is samba-3.2.11-1 Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone:

Re: [Samba] mount.cifs not reporting locking issues to Linux?

On 10/22/2009 12:07 PM, Jeremy Allison wrote: > On Thu, Oct 22, 2009 at 10:33:28AM +1300, Jason Haar wrote: > >> Hi there >> >> I recall in times past that when a locked file on a Windows server was >> accessed by smbfs, you received a kind of "text file busy&

Re: [Samba] winbind causes Linux to lockup when connectivity to AD is lost (subject line edited for clarity)

is continually trying to talk to these non-available domain controllers and it never gives up - and so the offline mode never kicks in. It's got so bad that I now have scripts that run whenever a network change occurs, to check if winbind is "stuck" and restart accordingly. -- Chee

[Samba] way to get smbclient to do "dir *\filename"?

I've tried this with 3.2.11, I'm assuming it still affects the current version Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubs

Re: [Samba] smbclient -M to windows 7 workstation problem

Windows dropped the messaging service with Vista - you simply cannot do what you want with Win7 either Jason -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

[Samba] question about "idmap config" in multi-forest environment

lock = 1" would allow up to 99 domains without any effort? I know there are ldap and ad backends - but they all assume your Windows environment is "Unix friendly" which ours isn't. I'm just trying to make our Samba servers play nicely within our Windows-dominated empire

Re: [Samba] Can SAMBA work with 2008 R2 Read Only Domain controller

more time in troubleshooting I hoped that someone >> could assist and tell me if such a configuration is possible. >> >> If this is not possible, it would be great to know why. >> >> Best Regards, >> Hagai >> >> >> >> -- >> To u

[Samba] ongoing problems with winbind since we rolled out RODCs

ssword samba-...@ad.domain failed: KRB5 error code 29 Join to domain is not valid: Undetermined error The "Undetermined error" is a bit of a pain :-) Any ideas what's happening here? I assume tonnes of other Samba sites talk to RODCs and I haven't heard of this as a general iss

Re: [Samba] samba version to use on CentOS?

4. I'll also upload it to bugzilla -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 %define initdir %{_sysconfdir}/rc.d/init.d %define auth %(test -f /e

Re: [Samba] samba 3.3 - poor performance (compared to NFS)

One thing: do you have "log level" set? If so, put it down to "0" - logging (which is really debugging) totally kills Samba performance -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint:

[Samba] DNS registration pushing up wrong IP?

ing a DNS update? It doesn't appear to happen very often: I have 28 servers world-wide with this same "eth0, eth0:2" trick and this is the first time I've seen it. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635

[Samba] NT_STATUS_NO_LOGON_SERVERS errors sporadically occurring

Samba work its way around this? As an added advantage, ping tests could even ensure Samba connects to the closest DC by measuring the latency...? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E

[Samba] Vista SP1-rc1 appears to break against Samba-3.0.27a

is share (test) Any ideas? I can send the entire log (even a packet trace) to someone if they need it. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- Ch

Re: [Samba] Win2K3 DNS losing Samba DNS entries?

Jason Haar wrote: Does this ring any bells? Would recompiling Samba with "--with-dnsupdate" (which still seems to be disabled by default) enable Samba to *continually* ensure its "A" record is kept intact? Weirdly enough, we find that if you go through this grief

[Samba] Win2K3 DNS losing Samba DNS entries?

kept intact? Weirdly enough, we find that if you go through this grief of disappearing "A" records for a week or so (and adding it back in), then suddenly it seems to all go right and the problem disappears for that particular server. But then the next one you install goes through t

Re: [Samba] change in AD authentication behaviour since 3.0.24

to Unix login processes in all this, e.g. ssh, console, etc. And yes, we have 3.0.28 and I can "flip flop" between these two scenarios by making this change - I just checked :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +

Re: [Samba] winbindd: Exceeding 200 client connections, no idle connection found

NTLM works, Squid can't cache the lookups as much (from a posting in 2003 - can't find anything newer). -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: [Samba] Strange behaviour of Samba3 with wireless clients

but - again - we've found issues with DSL links - which I see you mentioning too. Change your client's MTU to 1300 and see if the problem disappears. Then reduce it on the Samba server involved instead - as that's an easier solution than touching every client. -- Cheers Jaso

Re: [Samba] $ char in password

be a pain - that's why you should use the "-A /path/file" option where possible. ...unfortunately the Samba "net" command doesn't support it - I think it's the only Samba client command that doesn't? -- Cheers Jason Haar Information Security Manager, Trimbl

[Samba] winbind between trusted domains really acting up under 3.0.28a

;testparam" shows nothing that stands out as being behind this, and the logs show no other errors/failures besides this. Any ideas? This is CentOS4 systems with samba-3.0.28a. Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 F

Re: [Samba] Re: How to create a write-only share?

-- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailma

Re: [Samba] winbindd: Exceeding 200 client connections, no idle connection found

s a bit of HTTP/1.1 Keepalive reuse that speeds things up - but effectively it's a cow. If you can stomach the lack of encryption, go back to Basic proxy authentication - squid can cache the hell out of that! I bet you'll find all your problems disappear. -- Cheers Jason Haar I

Re: [Samba] winbindd: Exceeding 200 client connections, no idle connection found

can stomach the lack of encryption, but with basic proxy auth can they still authenticate to AD? Absolutely. There is no difference in Squid's ntlm_auth functionality between choosing Basic or NTLM/Negotiate. ie you can still do group-based access controls using Basic. -- Cheers Jason Haa

Re: [Samba] Samba & Vista

t map. Known issue in pre-3.0.29 releases of Samba. Upgrade to 3.0.30 and you'll be right :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubs

[Samba] Samba corruption of ADS authentication details?

and then rejoin ADS and restart. That always fixes it. This just happened today under 3.0.30 - so it's still a problem with the current release. Is there a tool or something to manipulate/delete individual entries from "the cache" so that we don't have to go through this wh

Re: [Samba] FreeBSD, Samba 3.0.28a joined to AD domain but prompts for login

pears. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the following URL and read the instructions: https://lis

[Samba] nested group support still broken in 3.2.2?

's working well in that direction...? Am I right, or have we got a problem that could actually be fixed? :-) This is under FC8. Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6

Re: [Samba] nested group support still broken in 3.2.2?

ep'ping /var/log/sambe/* for the groupname shows only 'getgrnam domain3\group2' - no real error as such PS: there are now 155 winbindd processes running - so it did come down a bit. But I don't think that's normal? Under 3.0.30 it never seemed to go above 10-ish? -- C

Re: [Samba] nested group support still broken in 3.2.2?

is a Distribution List too BTW (not just a Security Group). -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the following UR

[Samba] Cannot connect to Samba-3.0.23d (and earlier) from other trusted AD domains

330-6760 ...and yet "wbinfo --sid-to-name" maps that back to the correct username, and "wbinfo --name-to-sid" maps the username to the same SID. As mentioned earlier, ntlm_auth with such an account and correct password returns OK. Any ideas? It smells so close to working... --

Re: [Samba] Cannot connect to Samba-3.0.23d (and earlier) from other trusted AD domains

I must say it surprises me. I know I can easily deduce the same values that I just put into krb5.conf via some DNS lookups - I thought Samba would have done the same... (actually you don't even need DNS for that: Under ADS, realm == fqdn) Thanks! -- Cheers Jason Haar Information Security

[Samba] Failed to set servicePrincipalNames error

k to RPC... Joined domain SUBDOM. ..but it didn't work. MMC Users and Computers shows the hostname in the Computers container - but it either has 8bit garbage after the name (i.e it's corrupt), or it's marked as Disabled. Any ideas what's wrong? Thanks! -- Cheers Jason Haar

Re: [Samba] Failed to set servicePrincipalNames error

s first time. I'd still say that was a bug in Samba - but the workaround will do for now :-) Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: [Samba] Trouble getting samba AD integration to work

rick. Good luck. Hope that helps. I just love being able to "chown domain\\username filename" - freaks the hell out of the Windows Admins ;-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A

[Samba] weird kerberos enctype error on otherwise working 3.0.23d install

E [2006/12/21 07:56:19, 5] lib/util.c:show_msg(485) I have re-added the machine to the domain without any change. Any other ideas? I have just finished adding 16 Samba servers to 4 different domains and this is the only one to fail in such a way. I'm a bit stumped... -- Cheers Jason Haar In

[Samba] can samba figure out the "closest" domain controller in ADS mode?

their closest DC is from that information - but it looks like Samba can not? Is that correct, or is there something else I can do? Resolving usernames/groups is pretty dire due to this - a Samba server in Sweden is currently using a DC in Beijing for example. This is Samba-3.0.23d under Cen

[Samba] fam inconsistent in noticing changes

becomes a bit dodgy? (e.g. does that lack of a TTY in cron trigger something?) Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe

Re: [Samba] Auto Create user home directory

beforehand is a bit odd. If "%U" can be created on the fly - why not anything else? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To uns

Re: [Samba] Dual Computer Names

os really wants to stop you assigning multiple names to the same token (at least I had huge trouble getting it to work correctly), so mapping everything to separate IPs is the cleanest IMHO. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax:

Re: [Samba] slow streaming but fast copy

(with 100M cards) and couldn't figure out what was wrong. Then we noticed "log level = 9" ;-) Turning that off kicked performance up to 80Mbs - which is equivalent to our Win2K3 servers. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3

Re: [Samba] UTF8 not working - solved.

e iocharset=utf8 option to ensure best "compatibility" with the backend Win2K and Win2K3 servers? (I assuming all Win2K/WinwK3 servers are utf8?) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C

[Samba] Do Domain Local groups work via 'valid users = "@dom\Group Name"'?

e DOM1 members - **but not any from DOM2 or the other trusted forests**! BTW The DOM1 Samba server is quite capable of successfully doing a "getent passwd DOM2\account". Am I doing something wrong? How can I get a Samba server in either DOM1 or DOM2 to fully support allowing anyone in tha

[Samba] winbind design query: why does ntlm_auth work when the same auth via smbd fails?

work (it implies winbind is totally happy?), whereas smbd should return Access Denied? And yes, "allow trusted domains = Yes" is set. Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C

Re: [Samba] Q: Samba Proxy or SAMBA Cluster?

geographically separate. Neither NFS nor Samba/SMB perform well over a WAN. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to th

Re: [Samba] Q: Samba Proxy or SAMBA Cluster?

n NFS client? I'm really surprised at that -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the foll

[Samba] Samba kerberos more time sensitive that Windows?

y incoming ticket". Correcting the time fixed the fault. However, it remains that Samba rejected them when Windows servers didn't. Is that an option that can be enabled? Anything that makes Samba look more like Windows is a Good Thing (even if it violates the entire point of Kerberos! ;-

[Samba] winbind occasionally failing to find domain controllers for trusted domains

that sort of defeats the purpose. We certainly tear down and build up new DCs often enough to turn that into a maintainance disaster anyway ;) Have I missed something that could make these trusts more reliable? We are running Samba-3.0.24 under CentOS4.4 Thanks! -- Cheers Jason Haar Infor

Re: [Samba] Samba kerberos more time sensitive that Windows?

2K3 client had a ntp agent installed, it was unable to keep it's clock in sync. We also have an identical issue with running virtual Linux in the same environment. The syslog is filled with ntp errors about being unable to slew the clock. So we're going to run VMware under Fedora instead

Re: [Samba] Samba kerberos more time sensitive that Windows?

d idea to make Samba look more like a Windows server - even if it means handling such a hare-brained situation. But - that's easy for me to say :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9

Re: [Samba] Samba kerberos more time sensitive that Windows?

ring clock-slew events. Doesn't that mean Active Directory's Kerberos is susceptible to man-in-the-middle attacks then? :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 842

Re: [Samba] Samba kerberos more time sensitive that Windows?

he > time from the DC and all connections to servers work > (as you'd expect with the correct time). > -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: [Samba] winbind occasionally failing to find domain controllers for trusted domains

Gerald (Jerry) Carter wrote: > Jason Haar wrote: > > Hi there > > > We have a bunch of Win2K3 trusted domains that are > > parts of other forests from our own Win2K3 forest. > ... > We should be talking to DNS anyways in this case. > Can you DNS resolve teh S

[Samba] major cifs bug in 2.6.19+?

ersion of a "pure" 2.6.20 kernel, and am seeing it on my FC6 workstation as well as a FC7pre3 laptop. Can anyone else confirm? This is a serious bug for us. Returning bogus data is majorly worse than even a crash... (we're supposed to be rsync'ing that data). We're stickin

Re: [Samba] Re: major cifs bug in 2.6.19+?

hose directories results in the same list of 74 top-level subdirs again. So maybe this problem only hits servers with DFS enabled? But it works under 2.6.18...? Help? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerpr

Re: [Samba] Re: major cifs bug in 2.6.19+?

in the cifs kernel module in newer releases? > I reported this as a bug a while ago, but it apparently hasn't been > fixed yet. See https://bugzilla.samba.org/show_bug.cgi?id=4066. Thanks for that - I'll add a "me too" -- Cheers Jason Haar Information Security Ma

[Samba] 3.0.25 breaks "username map"?

7;t. Has the format of "username map" changed? I currently have "jhaar=DOM\jhaar" and that worked under 3.0.24 and previous. I have rolled back to 3.0.24 and the problem disappears - so it's something in 3.0.25 fer shure... -- Cheers Jason Haar Information Security Manager,

Re: [Samba] 3.0.25 breaks "username map"?

Christian Perrier wrote: > Quoting Jason Haar ([EMAIL PROTECTED]): > >> Hi there >> >> I was using "username map" under 3.0.24 so that when I connected from >> DOM\jhaar under (ADS Win2K3) Windows, it was mapped to my local "jhaar"

Re: [Samba] s3fs vs. zfs

ad due to this ;-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.or

[Samba] samba-3.5.14 (and less) corrupting AD->UID mappings

so maybe winbind was talking to the RODC there - maybe not - dunno Is this a known issue, and if not, what can I do to track down the cause, as it "sort of" diminishes the usefulness of Samba if you can't trust the file ownership anymore Thanks -- Cheers Jason Haar Information Secu

Re: [Samba] samba-3.5.14 (and less) corrupting AD->UID mappings

the 3.5 line. We had serious issues with 3.6 which I've blamed on old system libraries and have given up on 3.6 until we upgrade to CentOS-6 later this year. At that point the intention is to keep to the vendor release -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd.

[Samba] samba-3.6.1 cannot be used by trusted domain users?

1-1705711945-1589781387-1543859470-20569: NT_STATUS_UNSUCCESSFUL So that makes no sense: how can "wbinfo -s SID" work, when the winbind logfile shows that it couldn't convert the same sid? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1

[Samba] idmap config doesn't allow range to be changed?

#x27;t appear to be editable! That makes no sense - any ideas what's gone wrong? I suspect the server has some old library that is triggering this - but don't know where to look...? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 P

[Samba] testjoin happy but kerberos broken

27;t a RODC either (although it used to be - I forced the Windows guys to upgraded it to a full DC in an attempt to fix this problem - didn't help) Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B

[Samba] Any way for smbmount to ignore Read-Only attribs?

ke a new smbmount option "ignore-attribs" :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- To unsubscribe from this list go to the following URL and read

Re: [Samba] Re: MS DFS and File Replication

u. One of our sites uses rsync on NT for backup to a remote tape library server. Use rsync to backup the data, and cacls into a file to gain the perm structure. So the same could be done with xfs - using whatever command it uses to show ACLs. Could all be wrapped into one funky shell script... --

Re: [Samba] Issues with Samba

n" share. Then > automatically, as the user logs on, he/she will gain local administrator > rights and privilidges. That doesn't really work does it? Basically an unpriviledged user runs a program, and suddenly they're local admin?!?!? -- Cheers Jason Haar Information Security Man