Search the Community

Hi all, First of all let me say that I am a UNIX newbie, so I am learning as I go! I have recently been getting some samba shares to work on a new Solaris server. This new server is replacing a retiring server with the same setup, so I know this can work! Now that these samba shares are working (and browsable), I move on to the next hurdle! We have a few externally hosted (Windows Server 2008 R2) web servers which are not on our domain, but can still communicate with our network. I can successfully browse to the samba shares on the existing (soon to be retired) solaris server from these webservers, so as I said a bove, I know that this can work. These web servers can successfully ping the new solaris server, but I cannot browse to the shares whether I use the server name or the IP address. This morning I turned on some deeper Samba logging details and the problem looks like an authentication issue: Example log when connecting as me from my PC (on the domain) [color=#0B374D][font=Courier][2014/09/30 09:37:50.140615, 2] auth/auth.c:309(check_ntlm_password)[/font][/color] check_ntlm_password: authentication for user [myusername] -> [myusername] -> [myusername] succeede Example log when connecting from the webserver (MYWEBSERVER) while logged on as user WEBUSER [/font][color=#0B374D][font=Courier]check_ntlm_password: Authentication for user [WEBUSER] -> [WEBUSER] FAILED with error NT_STATUS_NO_SUCH_USER[2014/09/30 10:12:21.161315, 0] auth/auth_domain.c:331(domain_client_validate) domain_client_validate: unable to validate password for user WEBUSER in domain MYWEBSERVER to Domain controller MY.INTERNAL.DOMAIN.COM. Error was NT_STATUS_NO_SUCH_USER.[2014/09/30 10:12:21.161877, 2] auth/auth.c:319(check_ntlm_password) check_ntlm_password: Authentication for user [WEBUSER] -> [WEBUSER] FAILED with error NT_STATUS_NO_SUCH_USER[/font][/color][font=Open Sans] So the problem is quite obvious, Samba cannot authenticate the user as they are not on the domain. As I understand it, on the existing Solaris server the webservers 'bypass' the authentication and connect to the shares as the guest user “web”. However, this doesn’t seem to be working on the new server. I did read about adding the line “map untrusted to domain = yes” to the smb.conf, but this doesn’t seem to have made any difference. Is anyone able to help - I am tearing my hair out over this!

I need to change the group owner to "07, 06" etc.... wbinfo -g | grep 07 07 07 exists from winbind ! setfacl -R -m group:"07":r-x ./07 getfacl 07 # file: 07 # owner: root # group: domain\040admins user::rwx group::r-x group:lp:r-x group:teachers:rwx group:support\040staff:rwx mask::rwx other::--- It doesn't change the group to "07" - instead it changes it to lp (lineprinter) group. Same with 03,04,05,06 respectively. grep lp /etc/passwd lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin ha - group 7. I can see its' obviously picking up the unix groups, not the windows ones. It DOES work for other windows groups (teachers, support staff, domain admins as above) I tried deleting the winbind cache, restarting winbind etc.. any ideas? It seems to be a new phenomena. TIA

Apple seem to have finally sorted out the whole OSX and Active Directory/SAMBA printers problem that has existed over the last few versions of OSX. So now, in OS X 10.5.1 lists the printers on the AD server just fine, and allows you to simply select one, select the right driver, enter your username and password on the AD and voila, it works. Just thought people may like to know, as the whole printer issue was a thorn in many people's sides for a while!

I need a hand here, my scripting skills are insufficent to pull this one off. However the end result is likely to benifit others in the future. But first, some background info. I have recently been creating a new file server running Ubuntu 8.04 on a HP DL140G3 with an external MSA60 Disk Array. Obviously to service the Windows clients this is running Samba (with all the ACL, quota, etc bells and whistles). The underlying file system for the user storage is RAID-5. This is then allocated with LVM2 into various partitions. These are formatted as JFS and mounted some place sensible (/home/samba/blah normally) and then shared via samba as required. I wish to use LVM based snapshots to provide 'shadow copies' to Windows clients. To do this I need a suite of scripts to do the following: 1) create LVM snapshots on a regular basis of some LVM paritions. New snapshots must be mounted in the way sambas shadow copy VFS module expects. 2) remount LVM snapshots cleanly in the case of a server reboot/crash/etc. 2) delete LVM snapshots after a predetermined time and/or when disk space is low. A couple of links with background info: Chapter 23. Stackable VFS modules Samba Shadow Copy Howto - Waikato Linux Users Group Samba and MS Shadow Copy

Hi Guys, I've been trying to set up SSO using Apache on the debian server, the users are authenticate using LDAP (which works), I've built and configured the auth_ntlm_winbind_module, and configured winbind. Our moodle version is Moodle 1.9.4+ (Build: 20090422). wbinfo -u returns a list of all the users, so that works fine. I've set up a test file (ntlmTest.php) which does echo ""; var_dump($_SERVER); echo ""; and the REMOTE_USER is being set by the NTLM as: OURDOMAIN\itrob so that part works, in the sites-enabled default file I've added NTLMAuth on AuthType NTLM AuthName "Moodle NTLM Authentication" NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" NTLMBasicAuthoritative on require valid-user NTLMAuth on AuthType NTLM AuthName "Moodle NTLM Authentication" NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" NTLMBasicAuthoritative on require valid-user and there are no errors in the /var/log/apache2/error.log file so this appears to be working ok ( plus that test file works, so again it's fine!) However! when I go to http://moodle it still presents me with a login page, I've added http://moodle to the trusted sites so IE should still send the NTLM information but I'm at a loss as to why it's just not working now! Bit more info: NTLM SSO is enabled, the subnet is 10.133.0.0/16 and IE fast path is off. Does anyone have ANY idea as to why it's not doing the SSO, I think I'm going insane here! Thanks -Rob

I'm having fun trying to setup my ACLs here so that they do what I want. Currently I'm doing the ACLs for the staff area. The filesystem has EA/ACL support (it's jfs). The following samba global settings are enabled: # Enable ACLs inherit permissions = yes inherit owner = yes map acl inherit = yes nt acl support = yes ea support = yes store dos attributes = yes The share is setup as follows: [staff$] comment = Staff Share read only = no path = /home/staff guest ok = no hide unreadable = yes admin users = @"domain admins", administrator hide files = /*quota.*/ veto files = /*.bat/*.cmd/*.com/*.exe/*.vbs/*.msi/*.pif/*.reg/ vfs objects = default_quota I want the following setup: all_staff has read access /home/staff (and is group owner) and r/w to /home/staff/* (and is group owner) has r/w to /home/staff/ and owns the directory (for quotas) root,administrator and domain admins have full rights to /home/staff I concocted the following script to set the permissions: cd /home/staff #*nix permissions chown administrator:all_staff . chmod 740 . ls -l | grep "^d" | awk -F" " '{print "chown -v -R "tolower($9)" "$9}' | sh ls -l | grep "^d" | awk -F" " '{print "chgrp -v -R all_staff "$9}' | sh ls -l | grep "^d" | awk -F" " '{print "chmod -v -R 660 "$8}' | sh #Extended ACLs setfacl -R -b . setfacl -R -m u:administrator:rwx . setfacl -R -m g:"domain admins":rwx . setfacl -R -m u:root:rwx . However, when users browse their my documents they cannot see their files. Inspecting the ACLs from Windows reveals that users have no right to delete or directory traversal. What have I missed?