389-users March 2019

389-users@lists.fedoraproject.org

13 participants
15 discussions

Start a nNew thread

pattered@gmail.com
by Edward Patterson 12 Mar '19

12 Mar '19

pattered(a)gmail.com -- *Edward J. Patterson II* *GDIT, Network Engineer* *(575) 312-5465 cell/home*

1 0

Re: Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Gordon Messmer 10 Mar '19

10 Mar '19

On 3/8/19 4:58 AM, Janet Houser wrote: > Thanks! > > I read that but I can't switch to freeipa since that software doesn > support a hash needed with gsync. > > hmmmm...... I wonder if I could sync the user/password DB to freeipa > and then use that to serve out samba shares..... I don't think FreeIPA generates password hashes outside of the directory. I'd expect it to store whatever hash you configure 389 DS to store, if you change that setting directly in the directory service. On the other hand, I wouldn't recommend syncing password hashes at all. Google Cloud supports third-party SSO using SAML 2.0. You should be able to use GCDS to sync your user accounts, and use SAML for authentication.

3 2

Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Janet H 08 Mar '19

08 Mar '19

Hi Folks, I'm running DS-389 (version: 1.3.7.5 ; Build: 2018.178.1311) on a Cent OS 7 (vs. 7.6.1810) system. I've been working through creating a Samba 4 server and using LDAP authentication to my DS-389 server. I've managed to get through most everything but I'm running into an issue with how passwords are working. From the Samba box I can user the command "smbpasswd -a testuser" and it will change the Samba NT password internal to the DS-389 system along with the LDAP userPassword. I can then use this new password to login to linux systems using ssh and into my Samba shares from a Windows 10 system. But this isn't how I want the system to run..... I want to be able to change the LDAP password (userPassword) and have that then update the sambaNTPassword. I have been googling for days and ran across the suggestion to use the smbkrb5pwd overlay but that looks specific to openldap and not DS-389. I know there must be a way to update the userPassword field and have that push out to the samba password but I can't find anything useful. I'm hoping folks might have some suggestions on how to get the two passwords to sync. My smb.conf file looks like the following (scrubbed for security): # See smb.conf.example for a more detailed config file or # read the smb.conf manpage. # Run 'testparm' to verify the config is correct after # you modified it. [global] workgroup = SAMBA security = user passdb backend = ldapsam:ldap://192.168.1.10 ldap suffix = dc=abc,dc=edu ldap user suffix = ou=People ldap group suffix = ou=Groups ldap delete dn = no ldap admin dn = cn=Directory Manager ldap passwd sync = Yes ldap ssl = start_tls log level = 5 passdb:5 auth:5 printing = cups printcap name = cups load printers = yes cups options = raw unix charset = UTF-8 dos charset = CP932 hosts allow = 127. 192.168.1. # max protocol = SMB2 map to guest = Bad User [homes] valid users = @smbgroup browsable = no writable = yes [printers] comment = All Printers path = /var/tmp printable = Yes create mask = 0600 browseable = No [print$] comment = Printer Drivers path = /var/lib/samba/drivers write list = @printadmin root force group = @printadmin create mask = 0664 directory mask = 0775 [Anonymous share] path = /samba/anonymous_share writable = yes browsable = yes guest ok = yes guest only = yes create mode = 0777 directory mode = 0777 Thanks in advance! (Sincere apologies for the multiple entries. I don't post often and it seems the original post got garbled)

4 5

Syncing DS 389's userPassword with Samba 4's sambaNTPassword
by Janet Houser 07 Mar '19

07 Mar '19

1 0

import userRoot: Skipping entry "XXXXXXXXXXX" which has no parent, ending at line 0 of file "(bulk import)"
by Jason Jenkins 07 Mar '19

07 Mar '19

Hi Everyone, One of my colleagues is working on a LDAP cluster that has a recent failure of one of the mult-imasters in a 2 node cluster. We have reinitialized the failed host and found that a bunch of entries are being dropped during the replication. Those entries display the following message: WARN - import_fifo_fetch - import userRoot: Bad entry: ID XXXX WARN - import_foreman - import userRoot: Skipping entry "XXXXXXXXXXX" which has no parent, ending at line 0 of file "(bulk import)" We can see that the entry exists and does have a parent on the source.

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2019