10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi all,
You may have seen my recent topic, where I asked for help getting some samba shares to work on our network.
Now that these are working, I move on to the next hurdle!
We have a few externally hosted (Windows Server 2008 R2) web servers which are not on our domain, but can still... (0 Replies)
Discussion started by: mgreen81
0 Replies
2. Windows & DOS: Issues & Discussions
Hello,
I have apparently lost all domain admin privledges in Samba. I have had several problems ever since I installed the 1/31 Solaris patch cluster. I had to roll out one Samba update (146363-01), which denied all logons network access. However, this particular problem seems to have begun... (0 Replies)
Discussion started by: stringman
0 Replies
3. Debian
Hello,,,
We have an existing(working) MS PDC in our office.
I have already installed SAMBA with LDAP Authentication on a TEST machine (on same LAN).
But, am unable to join a WinXP machine to this domain.
in smb.conf i have:
WORKGROUP = mydomain
and tried to join the XP machine to... (0 Replies)
Discussion started by: coolatt
0 Replies
4. UNIX for Dummies Questions & Answers
Hello people i have a samba and they changed domain controller from a windows 2003 to a windows 2008, there is a problem with the version of samba maybe incompatibilities i dont know what show me this
domain_client_validate: unable to validate password for user xxxx in domain xxxx to Domain... (0 Replies)
Discussion started by: enkei17
0 Replies
5. Homework & Coursework Questions
Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted!
1. The problem statement, all variables and given/known data:
I have a barebones XP Pro SP2 with no firewall.
CentOS 5.xx running a Samba 3.xx Domain (PDC)
The XP machine... (2 Replies)
Discussion started by: pogipants
2 Replies
6. Solaris
Hello to everybody from Argentina.
I need to stop samba because i need to fsck a filesystem
How can i do this?
I presume that the version is higher than 3.0.
/usr/sfw/sbin/smbd -D This is the out of ps -ef | grep smbd.
Thank you very much for your time i am a litle lost.
The... (4 Replies)
Discussion started by: enkei17
4 Replies
7. Red Hat
Hi all,
I'm having some problems with joining an active directory domain as a member. My Linux servers using the same configuration across the board are all joining as domain controllers, which is bad.
I am running Samba 3.0.25b-0.4E.6 on all of my RHEL servers.
Here is my global... (1 Reply)
Discussion started by: Bert
1 Replies
8. AIX
Hello,
I've created new DNS servers and changed all of the clients /etc/resolv.conf to point to them, but when I check the old DNS logs, I see that the clients are still querying it. Does anybody know why?
thanks, (2 Replies)
Discussion started by: ctcuser
2 Replies
9. UNIX for Advanced & Expert Users
I have a samba server and a raid SAN which is actually running samba. Neither one lets me access anything on the samba unix side. I really do not know where to look anymore. there are no errors. When I try to connect to the samba server I get prompted with login and password repeatedly.
Frank (4 Replies)
Discussion started by: frankkahle
4 Replies
10. UNIX for Dummies Questions & Answers
I am trying to set samba up to join my windows 2000 domain and I am having troubles
If anyone if familiar with this help would be greatly appreciated
I issue the following command
# ./smbpasswd -j DOMAIN -r DOMAINCONTROLER
And the following gets returned
load_client_codepage: filename... (4 Replies)
Discussion started by: gennaro
4 Replies
ipa-adtrust-install(1) IPA Manual Pages ipa-adtrust-install(1)
NAME
ipa-adtrust-install - Prepare an IPA server to be able to establish trust relationships with AD domains
SYNOPSIS
ipa-adtrust-install [OPTION]...
DESCRIPTION
Adds all necessary objects and configuration to allow an IPA server to create a trust to an Active Directory domain. This requires that the
IPA server is already installed and configured.
Please note you will not be able to estabilish an trust to an Active Directory domain unless the realm name of the IPA server matches its
domain name.
ipa-adtrust-install can be run multiple times to reinstall deleted objects or broken configuration files. E.g. a fresh samba configuration
(smb.conf file and registry based configuration can be created. Other items like e.g. the configuration of the local range cannot be
changed by running ipa-adtrust-install a second time because with changes here other objects might be affected as well.
OPTIONS
-d, --debug
Enable debug logging when more verbose output is needed
--ip-address=IP_ADDRESS
The IP address of the IPA server. If not provided then this is determined based on the hostname of the server.
--netbios-name=NETBIOS_NAME
The NetBIOS name for the IPA domain. If not provided then this is determined based on the leading component of the DNS domain name.
Running ipa-adtrust-install for a second time with a different NetBIOS name will change the name. Please note that changing the Net-
BIOS name might break existing trust relationships to other domains.
--no-msdcs
Do not create DNS service records for Windows in managed DNS server. Since those DNS service records are the only way to discover
domain controllers of other domains they must be added manually to a different DNS server to allow trust realationships work prop-
erly. All needed service records are listed when ipa-adtrust-install finishes and either --no-msdcs was given or no IPA DNS service
is configured. Typically service records for the following service names are needed for the IPA domain which should point to all IPA
servers:
o _ldap._tcp
o _kerberos._tcp
o _kerberos._udp
o _ldap._tcp.dc._msdcs
o _kerberos._tcp.dc._msdcs
o _kerberos._udp.dc._msdcs
o _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs
o _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs
o _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs
--add-sids
Add SIDs to existing users and groups as a final step of the ipa-adtrust-install run. If there a many existing users and groups and
a couple of replicas in the environment this operation might lead to a high replication traffic and a performance degradation of all
IPA servers in the environment. To avoid this the SID generation can be run after ipa-adtrust-install is run and scheduled indepen-
dently. To start this task you have to load an edited version of ipa-sidgen-task-run.ldif with the ldapmodify command info the
directory server.
-U, --unattended
An unattended installation that will never prompt for user input
-U, --rid-base=RID_BASE
First RID value of the local domain. The first Posix ID of the local domain will be assigned to this RID, the second to RID+1 etc.
See the online help of the idrange CLI for details.
-U, --secondary-rid-base=SECONDARY_RID_BASE
Start value of the secondary RID range, which is only used in the case a user and a group share numerically the same Posix ID. See
the online help of the idrange CLI for details.
-A, --admin-name=ADMIN_NAME
The name of the user with administrative privileges for this IPA server. Defaults to 'admin'.
-a, --admin-password=password
The password of the user with administrative privileges for this IPA server. Will be asked interactively if -U is not specified.
The credentials of the admin user will be used to obtain Kerberos ticket before configuring cross-realm trusts support and afterwards, to
ensure that the ticket contains MS-PAC information required to actually add a trust with Active Directory domain via 'ipa trust-add
--type=ad' command.
--enable-compat
Enables support for trusted domains users for old clients through Schema Compatibility plugin. SSSD supports trusted domains
natively starting with version 1.9. For platforms that lack SSSD or run older SSSD version one needs to use this option. When
enabled, slapi-nis package needs to be installed and schema-compat-plugin will be configured to provide lookup of users and groups
from trusted domains via SSSD on IPA server. These users and groups will be available under cn=users,cn=compat,$SUFFIX and
cn=groups,cn=compat,$SUFFIX trees. SSSD will normalize names of users and groups to lower case.
In addition to providing these users and groups through the compat tree, this option enables authentication over LDAP for trusted
domain users with DN under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.
LDAP authentication performed by the compat tree is done via PAM 'system-auth' service. This service exists by default on Linux
systems and is provided by pam package as /etc/pam.d/system-auth. If your IPA install does not have default HBAC rule 'allow_all'
enabled, then make sure to define in IPA special service called 'system-auth' and create an HBAC rule to allow access to anyone to
this rule on IPA masters.
As 'system-auth' PAM service is not used directly by any other application, it is safe to use it for trusted domain users via com-
patibility path.
EXIT STATUS
0 if the installation was successful
1 if an error occurred
IPA
Aug 23 2011 ipa-adtrust-install(1)
