Re: Problems setting up Samba+LDAP PDC in Debian Sarge
On Wednesday 26 October 2005 06:48 am, Chema wrote:
> Dear list,
>
> I have been struggling to get working a PDC using Samba with LDAP
> backend, in a fresh Debian Sarge install.
>
> 1. SeMachineAccountPrivilege
>
> I'm reading IDEALX's Linux Samba-OpenLDAP Howto as guidance. In my
> last attempt, everything appeared to be fine until the very end, the
> Integration test, when I added an admin user, got it on the "Domain
> Admin" and then tried to grant such group the
> SeMachineAccountPrivilege:
>
> dellj81:/# net -U root%MyUnixRootPass rpc rights grant 'CORENA\Domain
> Admins' SeMachineAccountPrivilege
> Failed to grant privileges for CORENA\Domain Admins
> (NT_STATUS_ACCESS_DENIED)
>
> Seems I have some kind of account problem here, since I can't make this
> to work using root nor Manager.
>
> The Howto states:
>
> <<To allow workstations to be joined to the domain, a root user must
> exist and used (uid=0).
>
> Such a user is created when initializing the directory whith the
> smbldap-populate script.
>
> >From Samba 3.0.12, it is now possible for admin users to join computers
>
> to the domain without using the "root" account."
> ...
> In fact, the 'root' account is needed in the first place so that the
> SeXXX privileges can be set.>>
>
> The smbldap-tools didn't setup any root/uid=0 account in LDAP:
>
> dellj81:/# slapcat | grep -i ^uid:
> uid: Administrator
> uid: nobody
> uid: admin
> uid: chema
> dellj81:/# slapcat | grep -i uidnum
> uidNumber: 1004
> uidNumber: 998
> uidNumber: 999
> uidNumber: 1002
> uidNumber: 1003
>
> So maybee that's what I'm missing, or should a standard (/etc/passwd)
> root suffice?
>
> 2. net getlocalsid
>
> Anyway, after fiddling around looking for clues, I found that I no
> longer can get my local sid:
>
lookup your SID from LDAP, then try:
$ net setlocalsid <SID>
[snip]
then make sure your groups are mapped. try:
$ net groupmap list
etc..
i can't remember the exact steps off the top of my head. but i hope this gets
you going. if not, post back here and cc me and i'll try to find my notes.
anoop.
Reply to: