[Fedora-directory-users] Problem with Samba - Fedora-ds Integration (HOWTO:SAMBA)
by Tom.Tran@noaa.gov
I followed the document until I get the following error:
#/opt/fedora-ds/slapd-miapogo/ldif2ldap "cn=Directory Manager" fds80000
/tmp/sambaGroups.ldif
This command returns:
adding new entry cn=Domain Admins,ou=Groups,dc=sefsc,dc=noaa,dc=gov
adding new entry cn=Domain Users,ou=Groups,dc=sefsc,dc=noaa,dc=gov
adding new entry cn=Domain Guests,ou=Groups,dc=sefsc,dc=noaa,dc=gov
adding new entry cn=Domain
Computers,ou=Groups,dc=sefsc,dc=noaa,dc=gov
I then run the following command:
# net groupmap add rid=512 ntgroup='Domain Admins' unixgroup='Domain
Admins'
This command returns:
[2005/08/19 09:48:37, 0]
passdb/pdb_ldap.c:ldapsam_add_group_mapping_entry(2330)
ldapsam_add_group_mapping_entry: failed to add group 2512 error:
Insufficient 'write' privilege to teh 'sambaSID' attribute of
entry 'cn=domain admins,ou=groups,dc=sefsc,dc=noaa,dc=gov'.
(Insufficient access)
adding entry for group Domain Admins failed!
I am a novice on this subject and have no idea how to fix it. Please
help!
Tom Tran
----- Original Message -----
From: <Tom.Tran(a)noaa.gov>
Date: Wednesday, August 17, 2005 3:15 pm
Subject: Samba - Fedora-ds Integration (HOWTO:SAMBA)
> Hi,
>
> I have problems with following the instruction in the HOWTO:SAMBA
> document. I have RedHat 4.1.18, samba-3.0.10, and
> fedora-ds-7.1-2.RHEL4. I don't have ldap or openldap installed
> because
> I am using fedora-ds
> instead. I tested samba and fedora-ds, both seemed to work fine.
> I
> also made sure that samba's daemons
> (smbd, nmbd, winbindd), and fedora-ds were started
>
> I followed the steps in the HOWTO:SAMBA doc, when I reached the
> step "Populating FDS with PDC
> Entry" and ran the command:
> # net getlocalsid
> I got the message:
> lib/smbldap.c:smbldap_search_domain_info(1392)
> Adding domain info to SEFSC failed with NT_STATUS_UNSUCCESSFUL
> SID for domain MIAPOGO is : S-1-5-21-2139381707-154793685-
> 3088283579
> Here is my /etc/samba/smb.conf
> ------------------------------
> # Global parameters
> [global]
> workgroup = SEFSC
> netbios name = MIAPOGO
> server string = Samba %u on (%L)
> log file = /var/log/samba/%m.log
> max log size = 50
> socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
> printcap name = /etc/printcap
> dns proxy = No
> idmap uid = 16777216-33554431
> idmap gid = 16777216-33554431
> cups options = raw
>
> security = user
> passdb backend = ldapsam:ldap://miapogo.sefsc.noaa.gov
> ldap suffix = dc=sefsc,dc=noaa,dc=gov
> ldap user suffix = ou=People
> ldap machine suffix = ou=Computers
> ldap group suffix = ou=Groups
>
> os level = 33
> domain logons = yes
> domain master = yes
> local master = yes
> preferred master = yes
>
> wins support = yes
>
> logon home = \\%L\%u\profiles
> logon path = \\%L\profiles\%u
> logon drive = H:
>
> template shell = /bin/false
> winbind use default domain = yes
>
> [netlogon]
> path = /var/lib/samba/netlogon
> read only = yes
> browseable = no
>
> [profiles]
> path = /var/lib/samba/profiles
> read only = no
> create mask = 0600
> directory mask = 0700
>
> [homes]
> comment = Home Directories
> read only = No
> browseable = No
>
> [printers]
> comment = All Printers
> path = /var/spool/samba
> printable = Yes
> browseable = No
> --------------------------
>
> Tom Tran
>
>
>
18 years, 8 months
[Fedora-directory-users] Samba - Fedora-ds Integration (HOWTO:SAMBA)
by Tom.Tran@noaa.gov
Hi,
I have problems with following the instruction in the HOWTO:SAMBA
document. I have RedHat 4.1.18, samba-3.0.10, and
fedora-ds-7.1-2.RHEL4. I don't have ldap or openldap installed because
I am using fedora-ds
instead. I tested samba and fedora-ds, both seemed to work fine. I
also made sure that samba's daemons
(smbd, nmbd, winbindd), and fedora-ds were started
I followed the steps in the HOWTO:SAMBA doc, when I reached the
step "Populating FDS with PDC
Entry" and ran the command:
# net getlocalsid
I got the message:
lib/smbldap.c:smbldap_search_domain_info(1392)
Adding domain info to SEFSC failed with NT_STATUS_UNSUCCESSFUL
SID for domain MIAPOGO is : S-1-5-21-2139381707-154793685-3088283579
Here is my /etc/samba/smb.conf
------------------------------
# Global parameters
[global]
workgroup = SEFSC
netbios name = MIAPOGO
server string = Samba %u on (%L)
log file = /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
printcap name = /etc/printcap
dns proxy = No
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
cups options = raw
security = user
passdb backend = ldapsam:ldap://miapogo.sefsc.noaa.gov
ldap suffix = dc=sefsc,dc=noaa,dc=gov
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
os level = 33
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins support = yes
logon home = \\%L\%u\profiles
logon path = \\%L\profiles\%u
logon drive = H:
template shell = /bin/false
winbind use default domain = yes
[netlogon]
path = /var/lib/samba/netlogon
read only = yes
browseable = no
[profiles]
path = /var/lib/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[homes]
comment = Home Directories
read only = No
browseable = No
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
browseable = No
--------------------------
If I commentted out the line: passdb backend =
ldapsam:ldap://miapogo.sefsc.noaa.gov
then the command 'net getlocalsid' works. But I got more problems when
I continued following the instructions in the HOWTO:SAMBA.
Please help!
Tom Tran
18 years, 8 months
RE: [Fedora-directory-users] problem importing DUAConfigProfile Schema in to FDS 7.1
by Tay, Gary
Is this what you need?
# cat $FDS_ROOT/slapd-`hostname`/config/schema/61DUAConfigProfile.ldif
dn: cn=schema
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' DESC
'Default LDAP server host address used by a DUA' EQUALITY
caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' DESC
'Default LDAP base DN used by a DUA' EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList'
DESC 'Preferred LDAP server host addresses to be used by a DUA' EQUALITY
caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC
'Maximum time in seconds a DUA should allow for a search to complete'
EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE
)
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC
'Maximum time in seconds a DUA should allow for the bind operation to
complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC
'Tells DUA if it should follow referrals returned by a DSA search
result' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod'
DESC 'A keystring which identifies the type of authentication method
used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC 'Time
to live, in seconds, before a client DUA should re-read this
configuration profile' EQUALITY integerMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME
'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by a
DUA' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC
'Attribute mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX
1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' DESC
'Identifies type of credentials a DUA should use when binding to the
LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC
'Objectclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX
1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope'
DESC 'Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME
'serviceCredentialLevel' DESC 'Identifies type of credentials a DUA
should use when binding to the LDAP server for a specific service'
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME
'serviceAuthenticationMethod' DESC 'Authentication method used by a
service of the DUA' EQUALITY caseIgnoreMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 )
objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.4 NAME 'DUAConfigProfile' SUP
top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST
( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase
$ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel
$ authenticationMethod $ followReferrals $ serviceSearchDescriptor $
serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $
attributeMap $ profileTTL ) )
Gary
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Justin
Albstmeijer
Sent: Thursday, August 18, 2005 4:21 PM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] problem importing DUAConfigProfile
Schema in to FDS 7.1
I suppose someone got it to work? non of the previous suggestions did
the trick.
Anyone? I seem to be looking for a modify ldif file to import the
DUAConfigProfile Schema
Justin
--
Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years, 8 months
[Fedora-directory-users] Re: proper procedure to add a unix group
by Steve Bonneville
Rich Megginson wrote:
> Igor wrote:
>
> >Hi, all. This is probably a dumb question but how do
> >I add a group? Simply adding a group thru the UI
> >doesn't allow one to specify a GID. I tried adding an
> >object type "OTHER" and selecting posixGroup. That
> >seemed to have worked, is that how this is to be done?
> >
> >
> Yes.
>
> > Because under company name aci, it shows up with gid
> >number, NOT the group name which is kind of ugly.
> >
> >
> Right. A console "group" is a groupOfUniqueNames. A posixGroup is a
> unix /etc/groups replacement group.
One cool thing I've noticed while working on research for Red Hat's
RH423 class: it turns out that Red Hat Directory Server allows you
to assign an entry both the groupOfUniqueNames and posixGroup object
classes at the same time!
Strictly speaking this is a schema violation, since they are
unrelated structural classes, but Directory Server does not enforce
the rule that there can only be one structural class chain on an
entry. Now, the interesting thing is that it's been proposed
(in the expired Internet-Draft draft-howard-rfc2307bis-00.txt)
that posixGroup be changed to an auxiliary class so that it and
groupOfUniqueNames can be used together to make this legal. It
was further proposed that group members can be stored not just as
login names (in memberUid attributes from posixGroup), but ALSO
as DNs of posixAccount entries (in uniqueMember attributes from
groupOfUniqueNames).
It turns out that the author of the proposal is the developer of
the nss_ldap package used by Red Hat Enterprise Linux, so nss_ldap
already supports this. This means that if there is a directory
entry uid=testuser,ou=people,dc=example,dc=com that's a valid
posixAccount user, you can define a static group entry with LDIF
like the following:
dn: cn=unixgroup,ou=groups,dc=example,dc=com
objectclass: top
objectclass: groupOfUniqueNames
objectclass: posixGroup
cn: unixgroup
gidNumber: 1701
uniqueMember: uid=testuser,ou=people,dc=example,dc=com
use system-config-authentication to set up a RHEL client to use
nss_ldap to look up user information from the directory, and get this:
[root@example ~]# getent group unixgroup
unixgroup:x:1701:testuser
-- Steve Bonneville
18 years, 8 months
[Fedora-directory-users] proper procedure to add a unix group
by Susan
Hi, all. This is probably a dumb question but how do
I add a group? Simply adding a group thru the UI
doesn't allow one to specify a GID. I tried adding an
object type "OTHER" and selecting posixGroup. That
seemed to have worked, is that how this is to be done?
Because under company name aci, it shows up with gid
number, NOT the group name which is kind of ugly.
Thank you.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
18 years, 8 months
[Fedora-directory-users] Admin server setup issue on FC3
by Vsevolod (Simon) Ilyushchenko
Hi,
After successfully running FDS on RH3, I've tried to install it on FC3.
I got this:
***
Your new directory server has been started.
Created new Directory Server
Start Slapd Starting Slapd server configuration.
Fatal Slapd ERROR: Ldap authentication failed for url
ldap://fds1.cshl.edu:389/o=NetscapeRoot user id admin (151:Unknown error.)
Fatal Slapd Did not add Directory Server information to Configuration
Server.
Configuring Administration Server...
Setting up Administration Server Instance...
ERROR: Administration Server configuration failed. See install.log.
INFO Finished with setup, logfile is setup/setup.log
***
First of all, I'm not sure why it's using "o=NetscapeRoot" - I've
specified a different manager DN. Second, the setup/nsperl/install.log
file is not informative:
***
You might want to reconfigure these parameters:
./reconfigure "myhostname=localhost"
./reconfigure "mydomain=.local.domain.com"
./reconfigure "perladmin=LOCAL.ADMIN(a)local.domain.com"
./reconfigure "cf_email=LOCAL.USER(a)local.domain.com"
./reconfigure "cf_by=LOCAL.USER"
nsPerl is installed in /opt/fedora-ds/lib/nsPerl5.6.1
***
However, I've found part of the problem: the file
./admin-serv/config/server.xml contain several variables instead of
variable values. For example:
<VARS accesslog="$SERVER_ROOT/admin-serv/logs/access"/>
So it looks like the configuration program had a glitch. Is there a way
to fix that on FC3?
Thanks,
Simon
--
Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu
http://www.simonf.com
Terrorism is a tactic and so to declare war on terrorism
is equivalent to Roosevelt's declaring war on blitzkrieg.
Zbigniew Brzezinski, U.S. national security advisor, 1977-81
18 years, 8 months