Re: [Samba] Security = ADS and uidnumbers

2013-06-06 Thread steve
On Thu, 2013-06-06 at 10:19 +0100, Jonathan Buzzard wrote: > > So given the OP wants consistent UID's on presumably his Samba file > server running a 3.6.x variant of Samba how does sssd help? Hi sssd is an alternative to using winbind to extract information from AD. It may help the OP to try it

Re: [Samba] Security = ADS and uidnumbers

2013-06-06 Thread Jonathan Buzzard
On Thu, 2013-06-06 at 10:25 +0200, steve wrote: > On Wed, 2013-06-05 at 23:13 +0100, Jonathan Buzzard wrote: > > > > > As far as I can tell sssd does not provide a mechanism for the smbd on > > at least 3.5 (the 4.x series might be different but the OP is running > > 3.6) to see an incoming SID

Re: [Samba] Security = ADS and uidnumbers

2013-06-06 Thread steve
On Wed, 2013-06-05 at 23:13 +0100, Jonathan Buzzard wrote: > > As far as I can tell sssd does not provide a mechanism for the smbd on > at least 3.5 (the 4.x series might be different but the OP is running > 3.6) to see an incoming SID and work out the UID. It would be pretty useless without.

Re: [Samba] Security = ADS and uidnumbers

2013-06-06 Thread steve
On Wed, 2013-06-05 at 23:13 +0100, Jonathan Buzzard wrote: > On 05/06/13 17:56, steve wrote: > > On Wed, 2013-06-05 at 16:22 +0100, Jonathan Buzzard wrote: > >> On Wed, 2013-06-05 at 15:42 +0100, Rowland Penny wrote: > >>> > >>> I never said that I couldn't get it to work, I just said that it is >

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Jonathan Buzzard
On 05/06/13 17:56, steve wrote: On Wed, 2013-06-05 at 16:22 +0100, Jonathan Buzzard wrote: On Wed, 2013-06-05 at 15:42 +0100, Rowland Penny wrote: I never said that I couldn't get it to work, I just said that it is just too complicated. Yes I can read and there was no need to get personal Y

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread steve
On Wed, 2013-06-05 at 18:32 +0100, Rowland Penny wrote: > Well said Steve > > > From what I have read on the two samba mailing lists, Samba 4 is > supposed to be a clone of windows AD, well windows AD does not have > winbind, so I suppose this begs the question, why when running as a DC > control

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Rowland Penny
Well said Steve >From what I have read on the two samba mailing lists, Samba 4 is supposed to be a clone of windows AD, well windows AD does not have winbind, so I suppose this begs the question, why when running as a DC controller does Samba4? On 5 June 2013 17:56, steve wrote: > On Wed, 201

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread steve
On Wed, 2013-06-05 at 16:22 +0100, Jonathan Buzzard wrote: > On Wed, 2013-06-05 at 15:42 +0100, Rowland Penny wrote: > > > > I never said that I couldn't get it to work, I just said that it is > > just too complicated. Yes I can read and there was no need to get > > personal > > > > You said you

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Rowland Penny
Oh yes it works ok on the samba4 server, using winbind getent passwd user DOMAIN\user:*:3001106:20513::/home/DOMAIN/user:/bin/bash uid=3001106(DOMAIN\user) gid=20513(DOMAIN\Domain Users) groups=20513(DOMAIN\Domain Users),21110(DOMAIN\linuxusers) change to sssd getent passwd user user:*:3001106:2

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Jonathan Buzzard
On Wed, 2013-06-05 at 15:42 +0100, Rowland Penny wrote: > > I never said that I couldn't get it to work, I just said that it is > just too complicated. Yes I can read and there was no need to get > personal > You said you gave up because it was too complicated. Also if you are setting up a Samba

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Rowland Penny
I never said that I couldn't get it to work, I just said that it is just too complicated. Yes I can read and there was no need to get personal You can have an smb.conf like this: [global] workgroup = DOMAIN security = ADS realm = DOMAIN.LAN encrypt passwords = yes

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Jonathan Buzzard
On Wed, 2013-06-05 at 13:30 +0100, Rowland Penny wrote: > Hi, I gave up on winbind, it is just too complicated and most, if not all, > of the webpages I found via google are incomplete or just down right wrong. > It's actually dead simple, and these days the manual page is actually accurate. Real

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Rowland Penny
Yes, he could do that, providing his users never go anywhere near any files or directories stored on a samba4 server, if they do, they will suddenly find that have a different id on the server, I have been there and it is just a mess, it took me a bit to realise why users did not own the files the

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Franz Strebel
Why not use the rid backend for your idmap. That is what I use for my member servers and my accounts have identical ids across machines. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Rowland Penny
Hi, I gave up on winbind, it is just too complicated and most, if not all, of the webpages I found via google are incomplete or just down right wrong. Why not try sssd, it just works, all you need to do is add uidNumbers to your users, set up sssd and away you go, have a look here: http://linuxco

Re: [Samba] Security = ADS and uidnumbers

2013-06-05 Thread Jim Potter
Hi JAB I've tried this every whichway, including making ranges not overlap. It looks to me to depend on this line: idmap config BECAUSE : range = 1000-8000 If I add it, wbinfo for jingram gives a UID of 2338, but no getent passwd entry. If I remove it, getent passwd jingram gives a uidnumber i

[Samba] Security = ADS and uidnumbers

2013-06-04 Thread Jim Potter
Hi all, I'm trying to set up a samba (3.6.6, debian wheezy 64bit) member server on a 2008R2 domain. I'd like to be able to specify the uidnumbers users get on here in AD but I'm getting really erratic results. I've tried changing various range options, and as far as I can tell it works sometimes,