Prev: [Samba] upgrade 3.0.28 to 3.5.3 (SerNet package)
Next: upgrade 3.0.28 to 3.5.3 (SerNet package)
From: Gaiseric Vandal on 26 May 2010 18:40
This is a revision of an earlier post with some futher results.


Some time back I upgraded a domain controller (Solaris 10) from samba
3.0.x (bundled with Solaris ) to 3.4.5 (and then to 3.4.8) which I had
compiled from source code. I copied nsswitch and all the idmap modules.

In order to support interdomain trusts I am using winbind and idmap
allocation with a samba backend. Samba 3.0.x was not able to configure
trusts with WIn 2003 or Win 2008 domains in Win 2003 mode. It was
able to configure trusts with Win 2003 domain in mixed (i.e. NT4
compatibility) mode. Samba does detect that the mixed-mode domain is
still Active Directory and not actually NT4.

The second problem with Samba 3.0.x was that it would initially
populate ldap with idmap entries, cache them locally and then when the
cache period expired it would not reload the mappings from ldap. (in
fact it them seemed to get negatively cached.)

upgrading to samba 3.4.x fixed the following -
- no more negative caching of idmap entries from ldap
- can establish domain trusts with Win 2003 mode domains.

However, idmap does not allocate new entries. This is not a problem
for the mix mode domain since I have a samba 3.0.x server that can do
this.) For the other domains I can manually create an idmap entry
(either with the ldap editor or the wbinfo command if I temp change the
"ldap idmap suffix" parameter to the domain specific ou .) . We don't
add or remove accounts that frequently. "wbinfo -u" can be a little
slow to respond so I increasing the default "idmap cache time" and
"winbind cache time" from the default 300 seconds seems appropriate.



Unlike the samba 3.0.x machine, I don't see any idmap specific or domain
specific log files.



Partial smb.conf file

------------------------------------------------------------------------------------

client NTLMv2 auth = yes
client lanman auth = No
client plaintext auth = No

security = user
passdb backend = ldapsam:ldap://ldap1.domain.com

wins support = No
wins server = x.x.x.x

winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = no
winbind trusted domains only = no

idmap cache time = 14400
winbind cache time = 604800



ldap suffix=o=domain.com
ldap user suffix=ou=people
ldap machine suffix=ou=people
ldap admin dn="cn=Directory Manager"
ldap ssl = no
ldap passwd sync = no
ldap idmap suffix=ou=idmap

#IDMAP DEFAULT SETTINGS
idmap backend=ldap:ldap://ldap1.domain.com
idmap uid = 70000-79999
idmap gid = 70000-79999

#IDMAP DEFAULT ALLOC
idmap alloc backend = ldap
idmap alloc config:ldap_url = ldap://ldap1.domain.com
idmap alloc config:ldap_base_dn = ou=alloc,ou=idmap,o=domain.com
idmap alloc config:ldap_user_dn = cn=Directory Manager
idmap alloc config:range = 30000 - 79999

#following is a Win 2003 domain in mixed mode
idmap config DOMA:backend = ldap
idmap config DOMA:readonly = no
idmap config DOMA:default=no
idmap config DOMA:ldap_base_dn = ou=doma,ou=idmap,o=domain.com
idmap config DOMA:ldap_user_dn = cn=Directory Manager
idmap config DOMA:ldap_url = ldap://ldap1.domain.com
idmap config DOMA:range = 30000-35999

#following is a Win 2008 domain in Win 2003 mode
idmap config DOMB:backend = ldap
idmap config DOMB:readonly = no
idmap config DOMB:default=no
idmap config DOMB:ldap_base_dn = ou=domb,ou=idmap,o=domain.com
idmap config DOMB:ldap_user_dn = cn=Directory Manager
idmap config DOMB:ldap_url = ldap://ldap1.domain.com
idmap config DOMB:range = 40000-45999

#following is a Win 2003 domain in Win 2003 mode
idmap config DOMC:backend = ldap
idmap config DOMC:readonly = no
idmap config DOMC:default=no
idmap config DOMC:ldap_base_dn = ou=domc,ou=idmap,o=domain.com
idmap config DOMC:ldap_user_dn = cn=Directory Manager
idmap config DOMC:ldap_url = ldap://ldap1.domain.com
idmap config DOMC:range = 50000-55999


------------------------------------------------------------------------------------


The man pages indicate that the domain specific id ranges must be within
the alloc range. the ou=alloc object in ldap does not include an
mappings but does have uid and gid parameters to track the next
available one.

With samba 3.0.x, running getent would populate idmap entries in the
domain specific ou. The domain specific id would be ignored.


Any thoughts on the allocation problem?

Thanks



--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
 | 
Pages: 1
Prev: [Samba] upgrade 3.0.28 to 3.5.3 (SerNet package)
Next: upgrade 3.0.28 to 3.5.3 (SerNet package)