<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Simo,</span></div><div><span>Could you advise how to add<br></span></div><div>1. the samba samAccount objectclass to a user, and</div><div>2. the sambaGroups class to a group? <br></div><div>I guess I would need to use ldap commands, which I don't know enough.</div><div>By the way, do I need to add both of the above, or if everybody is allowed to use the samba share, (and they are all in ipausers group), I would only need to add the sambaGroups class to ipausers group?</div><div>Thanks,</div><div>George<br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr">
<font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Simo Sorce <simo@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, July 10, 2012 9:56 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa samba win7<br> </font> </div> <br>
On Tue, 2012-07-10 at 06:01 -0700, george he wrote:<br>> Hello all,<br>> I have an ipa client that is also a file server. How do I set up a<br>> samba server on the file server so that the files can be accessed by a<br>> win7 machine, which is not a member of the ipa realm?<br>> Should I set the file server as a domain controller? How do I deal<br>> with the "passdb backend" option? I guess I can set it to "ldapsam",<br>> but the user information is kept on the ipa server, not the file<br>> server.<br>> What else should I take care of before I start?<br>> ps. my ipa version is 2.2, running on fc17.<br>> <br><br>You can install samba with the ldapsam passdb backend.<br>security = user will suffice, you do not need to make it a domain<br>controller.<br>Authentication will happen only using NTLM, so you will have to add the<br>samba samAccount objectclass to those users that you want to be able to<br>log in to samba and the
sambaGroups class to those groups you want to<br>use with samba.<br>After you added the right objectclass to users you will need to change<br>the user's password once so that the ipa-pwd-exto plugin can generate NT<br>hashes for the user.<br>Once that is done samba should allow you to log in using the ipa<br>password.<br><br>Simo.<br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br><br><br><br> </div> </div> </blockquote></div> </div></body></html>