pattered@gmail.com
by Edward Patterson
pattered(a)gmail.com
--
*Edward J. Patterson II*
*GDIT, Network Engineer*
*(575) 312-5465 cell/home*
5 years, 1 month
Re: Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Gordon Messmer
On 3/8/19 4:58 AM, Janet Houser wrote:
> Thanks!
>
> I read that but I can't switch to freeipa since that software doesn
> support a hash needed with gsync.
>
> hmmmm...... I wonder if I could sync the user/password DB to freeipa
> and then use that to serve out samba shares.....
I don't think FreeIPA generates password hashes outside of the
directory. I'd expect it to store whatever hash you configure 389 DS to
store, if you change that setting directly in the directory service.
On the other hand, I wouldn't recommend syncing password hashes at all.
Google Cloud supports third-party SSO using SAML 2.0. You should be able
to use GCDS to sync your user accounts, and use SAML for authentication.
5 years, 1 month
Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Janet H
Hi Folks,
I'm running DS-389 (version: 1.3.7.5 ; Build: 2018.178.1311) on a Cent OS 7 (vs. 7.6.1810) system.
I've been working through creating a Samba 4 server and using LDAP authentication to my DS-389 server. I've managed to get through
most everything but I'm running into an issue with how passwords are working.
From the Samba box I can user the command "smbpasswd -a testuser" and it will change the Samba NT password internal to the DS-389 system
along with the LDAP userPassword.
I can then use this new password to login to linux systems using ssh and into my Samba shares from a Windows 10 system.
But this isn't how I want the system to run.....
I want to be able to change the LDAP password (userPassword) and have that then update the sambaNTPassword.
I have been googling for days and ran across the suggestion to use the smbkrb5pwd overlay but that looks specific to openldap and not DS-389.
I know there must be a way to update the userPassword field and have that push out to the samba password but I can't find anything useful.
I'm hoping folks might have some suggestions on how to get the two passwords to sync. My smb.conf file looks like the following (scrubbed for
security):
# See smb.conf.example for a more detailed config file or
# read the smb.conf manpage.
# Run 'testparm' to verify the config is correct after
# you modified it.
[global]
workgroup = SAMBA
security = user
passdb backend = ldapsam:ldap://192.168.1.10
ldap suffix = dc=abc,dc=edu
ldap user suffix = ou=People
ldap group suffix = ou=Groups
ldap delete dn = no
ldap admin dn = cn=Directory Manager
ldap passwd sync = Yes
ldap ssl = start_tls
log level = 5 passdb:5 auth:5
printing = cups
printcap name = cups
load printers = yes
cups options = raw
unix charset = UTF-8
dos charset = CP932
hosts allow = 127. 192.168.1.
# max protocol = SMB2
map to guest = Bad User
[homes]
valid users = @smbgroup
browsable = no
writable = yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @printadmin root
force group = @printadmin
create mask = 0664
directory mask = 0775
[Anonymous share]
path = /samba/anonymous_share
writable = yes
browsable = yes
guest ok = yes
guest only = yes
create mode = 0777
directory mode = 0777
Thanks in advance!
(Sincere apologies for the multiple entries. I don't post often and it seems the original post got garbled)
5 years, 1 month
Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Janet Houser
Hi Folks,
I'm running DS-389 (version: 1.3.7.5 ; Build: 2018.178.1311) on a Cent
OS 7 (vs. 7.6.1810) system. I've been working through creating a Samba 4
server and using LDAP authentication to my DS-389 server. I've managed
to get through most everything but I'm running into an issue with how
passwords are working. From the Samba box I can user the command
"smbpasswd -a testuser" and it will change the Samba NT password
internal to the DS-389 system along with the LDAP userPassword. I can
then use this new password to login to linux systems using ssh and into
my Samba shares from a Windows 10 system. But this isn't how I want the
system to run..... I want to be able to change the LDAP password
(userPassword) and have that then update the sambaNTPassword. I have
been googling for days and ran across the suggestion to use the
smbkrb5pwd overlay but that looks specific to openldap and not DS-389. I
know there must be a way to update the userPassword field and have that
push out to the samba password but I can't find anything useful. I'm
hoping folks might have some suggestions on how to get the two passwords
to sync. My smb.conf file looks like the following (scrubbed for
security): # See smb.conf.example for a more detailed config file or #
read the smb.conf manpage. # Run 'testparm' to verify the config is
correct after # you modified it. [global] workgroup = SAMBA
security = user passdb backend =
ldapsam:ldap://192.168.1.10 ldap suffix = dc=abc,dc=edu
ldap user suffix = ou=People ldap group suffix = ou=Groups
ldap delete dn = no ldap admin dn = cn=Directory
Manager ldap passwd sync = Yes ldap ssl = start_tls
log level = 5 passdb:5 auth:5 printing = cups
printcap name = cups load printers = yes cups options =
raw unix charset = UTF-8 dos charset = CP932
hosts allow = 127. 192.168.1. # max protocol = SMB2 map to
guest = Bad User [homes] valid users = @smbgroup
browsable = no writable = yes [printers] comment = All
Printers path = /var/tmp printable = Yes create
mask = 0600 browseable = No [print$] comment = Printer
Drivers path = /var/lib/samba/drivers write list =
@printadmin root force group = @printadmin create mask =
0664 directory mask = 0775 [Anonymous share] path =
/samba/anonymous_share writable = yes browsable = yes
guest ok = yes guest only = yes create mode =
0777 directory mode = 0777 Thanks in advance!
5 years, 1 month
import userRoot: Skipping entry "XXXXXXXXXXX" which has no parent, ending at line 0 of file "(bulk import)"
by Jason Jenkins
Hi Everyone,
One of my colleagues is working on a LDAP cluster that has a recent failure of one of the mult-imasters in a 2 node cluster. We have reinitialized the failed host and found that a bunch of entries are being dropped during the replication. Those entries display the following message:
WARN - import_fifo_fetch - import userRoot: Bad entry: ID XXXX
WARN - import_foreman - import userRoot: Skipping entry "XXXXXXXXXXX" which has no parent, ending at line 0 of file "(bulk import)"
We can see that the entry exists and does have a parent on the source.
5 years, 1 month