<div dir="ltr"><div class="gmail_extra">I don't have any documentation on my winbind setup, meaning that I've only adjusted configs for SSSD (1.9.2) and Samba (configs for these included below).</div><div class="gmail_extra">
<br></div><div class="gmail_extra">Before SSSD implemented ID mapping in a manner consistent with winbind, I had to use Identity Management for Unix on the domain controller to manually assign each user's UID (using an LDAP attribute) to the same value as the UID that windbind would generate. Later, after SSSD implemented the same ID mapping as Winbind, I removed IMU and let SSSD do its thing.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">On this fileserver, PAM isn't even aware of winbind; all auth is handled by SSSD. Winbind is only used by Samba when sharing files.</div><div class="gmail_extra">
<br></div><div class="gmail_extra"><div class="gmail_extra">[root@tic windows_pc_backups]# cat /etc/samba/smb.conf</div><div class="gmail_extra"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
# This file automatically generated and maintained by Puppet.<br># Manual editing of this file is NOT recommended as your changes<br># will be overwritten.<br>### Begin minimal global configuration ###<br>[global]<br># These settings will be overwritten by puppet.<br>
# Please make local changes to the include file<br>log level = 5<br>client ldap sasl wrapping = seal<br>disable netbios = yes<br>security = ads<br>server signing = mandatory<br>realm = DOMAIN.LOCAL<br>workgroup = DOMAIN<br>
winbind separator = +<br>winbind enum users = Yes<br>winbind enum groups = Yes<br>winbind nested groups = Yes<br>winbind use default domain = yes<br>kerberos method = system keytab<br>load printers = yes<br>printing = bsd<br>
include = /etc/samba/extra-settings.conf</blockquote><div><br></div><div>extra-settings.conf just sets up some file shares:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
# Settings for backup servers<br>printcap name = /dev/null<br>disable spoolss = yes<br>server string = Tic - Half Fresh<br>idmap backend = tdb<br>idmap uid = 1000000-1999999<br>idmap gid = 1000000-1999999<br>idmap config DOMAIN : backend = ad<br>
idmap config DOMAIN : range = 10000-50000<br>[backups]<br>path = /mnt/storage2/windows_pc_backups<br>read only = yes<br>printable = no<br>guest ok = no<br>valid users = "@DOMAIN+Domain Users"<br>create mask = 0775<br>
writeable = no</blockquote><div><div><br></div><div>And my sssd.conf:</div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
# This file is autogenerated by Puppet.<br># # Manually editing this file is NOT recommended<br># # as your changes will be overwritten.<br>#<br>[sssd]<br>config_file_version = 2<br>debug_level = 0<br>reconnection_retries = 3<br>
sbus_timeout = 30<br>services = nss, pam<br>domains = DOMAIN<br> <br>[pam]<br>debug_level = 0<br>[nss]<br>debug_level = 0<br>filter_users = ...<br>filter_groups = ...<br>reconnection_retries = 3<br>default_shell = /bin/bash<br>
shell_fallback = /bin/bash<br>[domain/DOMAIN]<br>debug_level = 0<br>ad_domain = DOMAIN.local<br>id_provider = ad<br>auth_provider = ad<br>chpass_provider = ad<br>access_provider = ad<br>enumerate = true<br>cache_credentials = true<br>
# Will check unixHomeDirectory LDAP attribute for a value first<br>fallback_homedir = /home/%u<br># This is necessary for IPv4 and IPv6 dynamic DNS updates<br>dyndns_iface = eth0<br>ldap_user_home_directory = unixHomeDirectory<br>
dyndns_update = true<br>dyndns_update_ptr = true<br>ldap_schema = ad<br>ldap_id_mapping = true</blockquote></div><div><br></div>-Chris</div>
<br><br><div class="gmail_quote">On Mon, Jan 27, 2014 at 12:26 PM, Rowland Penny <span dir="ltr"><<a href="mailto:repenny241155@gmail.com" target="_blank">repenny241155@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">On 27/01/14 17:21, Chris Hartman wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
For what it's worth, I use winbind + sssd as a windows fileserver and have no problems with the setup. It's true that winbind is necessary to share files but certainly SSSD can co-exist with winbind.<br>
<br>
<br>
-Chris<br>
<br>
<br>
</blockquote></div>
Do you have to set winbind up? and if so how?<div class=""><div class="h5"><br>
<br>
Rowland<br>
______________________________<u></u>_________________<br>
sssd-devel mailing list<br>
<a href="mailto:sssd-devel@lists.fedorahosted.org" target="_blank">sssd-devel@lists.fedorahosted.<u></u>org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/sssd-<u></u>devel</a><br>
</div></div></blockquote></div><br></div></div>