Welcome to Soft32 Linux Forums!
FAQFAQ    SearchSearch      ProfileProfile    Private MessagesPrivate Messages   Log inLog in

[Samba] Domain trusts "forgetting" trusted users

  
   Soft32 Home -> Linux -> Samba RSS
Next:  (none)  
Author Message
Gaiseric Vandal

External


Since: Oct 12, 2009
Posts: 7



(Msg. 1) Posted: Thu Oct 29, 2009 3:20 pm
Post subject: [Samba] Domain trusts "forgetting" trusted users
Archived from groups: linux>samba (more info?)
I am running Samba ver 3.0.33 on Solaris 10 (sparc) as a PDC with LDAP
for the backend for both samba and unix accounts.

I have also set up a trust with an Windows domain- lets call it
WINDOMAIN- (the PDC for the Windows domain is Win 2003 but is in
mixed mode for backwards compat.) The SAMBA domain trusts the WINDOWS
domain, not not vice versa.

I had also tried setting up trusts with another, test domain (lets
call it TESTDOMAIN.)

I have winbind enabled. Initially idmap entries were stored in the
local tdb backend. I switched this to ldap (wanted idmappings with
in the domain to be consistent across member servers, and wanted to
add a BDC.)






smb.conf includes

----------------------------------------------------------------------------------------------

passdb backend = ldapsam:ldap://ldap1.mydomain.com
ldap suffix=o=mydomain.com
ldap user suffix=ou=people
ldap group suffix=ou=smb_groups
ldap machine suffix=ou=machines
ldap admin dn="cn=Directory Manager"
ldap ssl = no
ldap passwd sync = no
ldap idmap suffix=ou=idmap

winbind enum users = Yes
winbind enum groups = no
winbind use default domain = no
winbind trusted domains only = no

#ldap time out default is 15 sec
ldap timeout=30

# idmap domains = WINDOMAIN, TESTDOMAIN
idmap domains = WINDOMAIN


idmap config WINDOMAIN:backend = ldap
idmap config WINDOMAIN:readonly = no
idmap config WINDOMAIN:default=no
idmap config WINDOMAIN:ldap_base_dn = ou=windomain,ou=idmap,o=mydomain.com
idmap config WINDOMAIN:ldap_user_dn = cn=Directory Manager
idmap config WINDOMAIN:ldap_url =ldap1.mydomain.com
idmap config WINDOMAIN:range = 30000-39999


#idmap config TESTDOMAIN:backend = ldap
#idmap config TESTDOMAIN:readonly = no
#idmap config TESTDOMAIN:default=no
#idmap config TESTDOMAIN:ldap_base_dn =ou=testdomain,ou=idmap,o=mydomain.com
#idmap config TESTDOMAIN:ldap_user_dn = cn=Directory Manager
#idmap config TESTDOMAIN:ldap_url =ldap1.mydomain.com
#idmap config TESTDOMAIN:range = 40000-49999



idmap alloc backend = ldap
idmap alloc config:ldap_base_dn = ou=alloc,ou=idmap,o=mydomain.com
idmap alloc config:ldap_user_dn = cn=Directory Manager
idmap alloc config:ldap_url = ldap1.mydomain.com
idmap alloc config:range = 70000 - 79999



----------------------------------------------------------------------------------------------


getting the correct (or mostly correct syntax) took a little while.
/etc/nsswitch.conf is configured for winbind.

When I first run "wbinfo -u" and "wbinfo -g", samba would populate
entries for the WINDOMAIN account in
windomain,ou=idmap,o=mydomain.com. The id's would be in the 70000
range not the 30000 range- which is fine with me since entries for
each domain were still in the correct ldap container.

"getent passwd" and "getent group" would show the WINDOMAIN domain
accounts. Everything would be fine for several days. However, after
a few days, getent commands no longer showed the WINDOMAIN accounts.

The only solution would be to stop windbind, delete the idmap entries
from ldap, restart winbind and let the entries repopulate.


I am unclear on if the "idmap config SOMEDOMAIN:range" setting for each
domain should be within the "idmap alloc config:range"

The syntax for this seems to change with different versions of samba.

Any thoughts?

Thanks
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Back to top
Login to vote
Gaiseric Vandal

External


Since: Oct 12, 2009
Posts: 7



(Msg. 2) Posted: Mon Nov 02, 2009 3:20 pm
Post subject: [Samba] Domain trusts "forgetting" trusted users [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
Upon further testing I find that the passwd and group info for the
trusted domain get cached once, and one time only. When the cache
expires, "getent passwd" and "getent group" no longer return users
from the trusted domain.


By default, "idmap cache time=900" (15 min.) If I increased this to
7200, then the caching was good for two hours (and not more.)

The timestamp on /var/samba/locks/idmap_cache.tdb file does get
updated frequently - at least every 20 minutes while I try "getent
passwd." idmapd_cache.tdb does have entries for the remote users.



nscd is not running.

Thoughts?

Thanks.


---------- Forwarded message ----------
From: Gaiseric Vandal <gaiseric.vandal.DeleteThis@gmail.com>
Date: Thu, Oct 29, 2009 at 1:30 PM
Subject: Domain trusts "forgetting" trusted users
To: samba.DeleteThis@lists.samba.org


I am running Samba ver 3.0.33 on Solaris 10 (sparc) as a PDC with LDAP
for the backend for both samba and unix accounts.

I have also set up a trust with an Windows domain- lets call it
WINDOMAIN- (the PDC for the Windows domain is Win 2003 but is in
mixed mode for backwards compat.) The SAMBA domain trusts the WINDOWS
domain, not not vice versa.

I had also tried setting up trusts with another, test domain (lets
call it TESTDOMAIN.)

I have winbind enabled. Initially idmap entries were stored in the
local tdb backend. I switched this to ldap (wanted idmappings with
in the domain to be consistent across member servers, and wanted to
add a BDC.)






smb.conf includes

----------------------------------------------------------------------------------------------

passdb backend = ldapsam:ldap://ldap1.mydomain.com
ldap suffix=o=mydomain.com
ldap user suffix=ou=people
ldap group suffix=ou=smb_groups
ldap machine suffix=ou=machines
ldap admin dn="cn=Directory Manager"
ldap ssl = no
ldap passwd sync = no
ldap idmap suffix=ou=idmap

winbind enum users = Yes
winbind enum groups = no
winbind use default domain = no
winbind trusted domains only = no

#ldap time out default is 15 sec
ldap timeout=30

# idmap domains = WINDOMAIN, TESTDOMAIN
idmap domains = WINDOMAIN


idmap config WINDOMAIN:backend = ldap
idmap config WINDOMAIN:readonly = no
idmap config WINDOMAIN:default=no
idmap config WINDOMAIN:ldap_base_dn = ou=windomain,ou=idmap,o=mydomain.com
idmap config WINDOMAIN:ldap_user_dn = cn=Directory Manager
idmap config WINDOMAIN:ldap_url =ldap1.mydomain.com
idmap config WINDOMAIN:range = 30000-39999


#idmap config TESTDOMAIN:backend = ldap
#idmap config TESTDOMAIN:readonly = no
#idmap config TESTDOMAIN:default=no
#idmap config TESTDOMAIN:ldap_base_dn =ou=testdomain,ou=idmap,o=mydomain.com
#idmap config TESTDOMAIN:ldap_user_dn = cn=Directory Manager
#idmap config TESTDOMAIN:ldap_url =ldap1.mydomain.com
#idmap config TESTDOMAIN:range = 40000-49999



idmap alloc backend = ldap
idmap alloc config:ldap_base_dn = ou=alloc,ou=idmap,o=mydomain.com
idmap alloc config:ldap_user_dn = cn=Directory Manager
idmap alloc config:ldap_url = ldap1.mydomain.com
idmap alloc config:range = 70000 - 79999



----------------------------------------------------------------------------------------------


getting the correct (or mostly correct syntax) took a little while.
/etc/nsswitch.conf is configured for winbind.

When I first run "wbinfo -u" and "wbinfo -g", samba would populate
entries for the WINDOMAIN account in
windomain,ou=idmap,o=mydomain.com. The id's would be in the 70000
range not the 30000 range- which is fine with me since entries for
each domain were still in the correct ldap container.

"getent passwd" and "getent group" would show the WINDOMAIN domain
accounts. Everything would be fine for several days. However, after
a few days, getent commands no longer showed the WINDOMAIN accounts.

The only solution would be to stop windbind, delete the idmap entries
from ldap, restart winbind and let the entries repopulate.


I am unclear on if the "idmap config SOMEDOMAIN:range" setting for
each domain should be within the "idmap alloc config:range"

The syntax for this seems to change with different versions of samba.

Any thoughts?

Thanks
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Back to top
Login to vote
Gaiseric Vandal

External


Since: Oct 12, 2009
Posts: 7



(Msg. 3) Posted: Thu Nov 05, 2009 1:20 pm
Post subject: Re: [Samba] Domain trusts "forgetting" trusted users [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
And as I dig further into this:

after the cache time expires the idmap_cache.tbd file is updated, and
more specifically the SID-to-ID entries get marked as "expired."

I have two samba servers configured- one as the PDC, one as the BDC,
both using the LDAP backend for everything.

The PDC currently has "idmap cache time = 604800" in smb.conf (should
be a week.)
The BDC smb.conf was set to "idmap cache time = 900" (15 min.)


So on the BDC "getent passwd" no longer returns winbind users. I
updated the BDC smb.conf to "idmap cache time = 604800", deleted the
idmap_cache.tbd and winbind_cache.tdb and restarted winbind.


A new idmap_cache.tbd is created but it already shows the entries as
"expired." Which makes me think that there is some other file
somewhere were the samba server records when the cached expires- and
since since the winbind entries in ldap are older than that time, it
will automatically negatively cache them. The only way to reload them
is to delete the entries in ldap.

If I knew what file to delete I could have a nightly cron job that
deleted any local cache files and restarted winbind.


Thanks




On 11/02/09 14:28, Gaiseric Vandal wrote:
> Upon further testing I find that the passwd and group info for the
> trusted domain get cached once, and one time only. When the cache
> expires, "getent passwd" and "getent group" no longer return users
> from the trusted domain.
>
>
> By default, "idmap cache time=900" (15 min.) If I increased this to
> 7200, then the caching was good for two hours (and not more.)
>
> The timestamp on /var/samba/locks/idmap_cache.tdb file does get
> updated frequently - at least every 20 minutes while I try "getent
> passwd." idmapd_cache.tdb does have entries for the remote users.
>
>
>
> nscd is not running.
>
> Thoughts?
>
> Thanks.
>
>
> ---------- Forwarded message ----------
> From: Gaiseric Vandal<gaiseric.vandal DeleteThis @gmail.com>
> Date: Thu, Oct 29, 2009 at 1:30 PM
> Subject: Domain trusts "forgetting" trusted users
> To: samba DeleteThis @lists.samba.org
>
>
> I am running Samba ver 3.0.33 on Solaris 10 (sparc) as a PDC with LDAP
> for the backend for both samba and unix accounts.
>
> I have also set up a trust with an Windows domain- lets call it
> WINDOMAIN- (the PDC for the Windows domain is Win 2003 but is in
> mixed mode for backwards compat.) The SAMBA domain trusts the WINDOWS
> domain, not not vice versa.
>
> I had also tried setting up trusts with another, test domain (lets
> call it TESTDOMAIN.)
>
> I have winbind enabled. Initially idmap entries were stored in the
> local tdb backend. I switched this to ldap (wanted idmappings with
> in the domain to be consistent across member servers, and wanted to
> add a BDC.)
>
>
>
>
>
>
> smb.conf includes
>
> ----------------------------------------------------------------------------------------------
>
> passdb backend = ldapsam:ldap://ldap1.mydomain.com
> ldap suffix=o=mydomain.com
> ldap user suffix=ou=people
> ldap group suffix=ou=smb_groups
> ldap machine suffix=ou=machines
> ldap admin dn="cn=Directory Manager"
> ldap ssl = no
> ldap passwd sync = no
> ldap idmap suffix=ou=idmap
>
> winbind enum users = Yes
> winbind enum groups = no
> winbind use default domain = no
> winbind trusted domains only = no
>
> #ldap time out default is 15 sec
> ldap timeout=30
>
> # idmap domains = WINDOMAIN, TESTDOMAIN
> idmap domains = WINDOMAIN
>
>
> idmap config WINDOMAIN:backend = ldap
> idmap config WINDOMAIN:readonly = no
> idmap config WINDOMAIN:default=no
> idmap config WINDOMAIN:ldap_base_dn = ou=windomain,ou=idmap,o=mydomain.com
> idmap config WINDOMAIN:ldap_user_dn = cn=Directory Manager
> idmap config WINDOMAIN:ldap_url =ldap1.mydomain.com
> idmap config WINDOMAIN:range = 30000-39999
>
>
> #idmap config TESTDOMAIN:backend = ldap
> #idmap config TESTDOMAIN:readonly = no
> #idmap config TESTDOMAIN:default=no
> #idmap config TESTDOMAIN:ldap_base_dn =ou=testdomain,ou=idmap,o=mydomain.com
> #idmap config TESTDOMAIN:ldap_user_dn = cn=Directory Manager
> #idmap config TESTDOMAIN:ldap_url =ldap1.mydomain.com
> #idmap config TESTDOMAIN:range = 40000-49999
>
>
>
> idmap alloc backend = ldap
> idmap alloc config:ldap_base_dn = ou=alloc,ou=idmap,o=mydomain.com
> idmap alloc config:ldap_user_dn = cn=Directory Manager
> idmap alloc config:ldap_url = ldap1.mydomain.com
> idmap alloc config:range = 70000 - 79999
>
>
>
> ----------------------------------------------------------------------------------------------
>
>
> getting the correct (or mostly correct syntax) took a little while.
> /etc/nsswitch.conf is configured for winbind.
>
> When I first run "wbinfo -u" and "wbinfo -g", samba would populate
> entries for the WINDOMAIN account in
> windomain,ou=idmap,o=mydomain.com. The id's would be in the 70000
> range not the 30000 range- which is fine with me since entries for
> each domain were still in the correct ldap container.
>
> "getent passwd" and "getent group" would show the WINDOMAIN domain
> accounts. Everything would be fine for several days. However, after
> a few days, getent commands no longer showed the WINDOMAIN accounts.
>
> The only solution would be to stop windbind, delete the idmap entries
> from ldap, restart winbind and let the entries repopulate.
>
>
> I am unclear on if the "idmap config SOMEDOMAIN:range" setting for
> each domain should be within the "idmap alloc config:range"
>
> The syntax for this seems to change with different versions of samba.
>
> Any thoughts?
>
> Thanks
>

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Back to top
Login to vote
Display posts from previous:   
Related Topics:
[Samba] Trusted domains, one-domain users and ACL's modifi.. - Hi, currently I have the following Samba 3.0.2rc2 setup: [w2k 1] --- [Samba1] ----VPN Link---- [Samba2] --- [w2k 2] ..

[Samba] Winbind ldap samba 3 BDC getent passwd answer don'.. - Helo, On redhat 9 - samba 3 stable - Using the rpm from 24 september. I try to configure a bdc. Smb.conf is...

[Samba] Re: Winbind ldap samba 3 BDC getent passwd answer .. - I have seen the same thing in my two installation of beta2 and rc4. Some how, I forgot what I have played around in..

[Samba] adding users from trusted domains into groups - Hello I have domain KEVF_D4 run by samba PDC that trusts domain KEVF_D1 run by NT4 PDC. The trust is running judging..

[Samba] Access rights for users from trusted domains - Hello I have a Samba 3.0.2 domain D4 that trusts NT4 domain D1 I tried to change access permissions of a file on..

[Samba] winbind + trusted domain - hello I have a linux samba file server, 2.2.7a I have a win nt4 pdc for domain HOME, which the above server is a membe...
       Soft32 Home -> Linux -> Samba All times are: Pacific Time (US & Canada) (change)
Page 1 of 1

 
 You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Categories:
 Windows
  Linux
 Mac
 PDA

[ Contact us | Terms of Service/Privacy Policy ]