<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body class=""><div>If you just need to join a handful of windows machines to a freeIPA domain, try with these instructions:</div><div><br></div><div><a href="https://www.redhat.com/archives/freeipa-users/2013-September/msg00226.html">https://www.redhat.com/archives/freeipa-users/2013-September/msg00226.html</a></div><div><br></div><div>Best regards </div><div><br></div><div>El mar, 11-10-2016 a las 17:43 -0700, Alan Latteri escribió:</div><blockquote type="cite">I am trying to get this to work, but our Samba server is not the same machine as out IPA server, and these instructions seem to assume that. Any ideas? All I need is the 1 windows machine in our network to be able to access our linux based server, using the same user/pass as that of our IPA authenticated linux machines.<div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite"><div class="">On Oct 10, 2016, at 1:35 PM, Степаненко Алексей <<a href="mailto:a.stepanenko@gw.spb.ru">a.stepanenko@gw.spb.ru</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" class="">
<div text="#000000" bgcolor="#FFFFFF" class=""><p class="">I read again the topic
<a href="http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA/NTMLSSP">http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA/NTMLSSP</a><br class="">
It works exactly as I wanted</p><p class=""> ipa-adtrust-install created next configuration:<br class="">
</p><p class="">
<meta http-equiv="content-type" content="text/html; charset=utf-8" class="">
</p>
$ net conf list<br class="">
[global]<br class="">
workgroup = WORKGROUP<br class="">
netbios name = SMB<br class="">
realm = GW.SPB.RU<br class="">
kerberos method = dedicated keytab<br class="">
dedicated keytab file = <a href="file:///etc/samba/samba.keytab">FILE:/etc/samba/samba.keytab</a><br class="">
create krb5 conf = no<br class="">
security = user<br class="">
domain master = yes<br class="">
domain logons = yes<br class="">
log level = 1<br class="">
max log size = 100000<br class="">
log file = /var/log/samba/log.%m<br class="">
passdb backend =
ipasam:<a href="ldapi://%2fvar%2frun%2fslapd-GW-SPB-RU.socket">ldapi://%2fvar%2frun%2fslapd-GW-SPB-RU.socket</a><br class="">
disable spoolss = yes<br class="">
ldapsam:trusted = yes<br class="">
ldap ssl = off<br class="">
ldap suffix = dc=gw,dc=spb,dc=ru<br class="">
ldap user suffix = cn=users,cn=accounts<br class="">
ldap group suffix = cn=groups,cn=accounts<br class="">
ldap machine suffix = cn=computers,cn=accounts<br class="">
rpc_server:epmapper = external<br class="">
rpc_server:lsarpc = external<br class="">
rpc_server:lsass = external<br class="">
rpc_server:lsasd = external<br class="">
rpc_server:samr = external<br class="">
rpc_server:netlogon = external<br class="">
rpc_server:tcpip = yes<br class="">
rpc_daemon:epmd = fork<br class="">
rpc_daemon:lsasd = fork<br class="">
<br class="">
But I don't understand why it wasn't put to smb.conf directly.<br class="">
<br class="">
The second problem is 'passdb backend'. I didn't find any
documentation about this module. An attempt to replace a file socket
on net connection was failed. And I had to make LDAP replication. It
was easy, but "
<meta http-equiv="content-type" content="text/html; charset=utf-8" class="">
ipa-replica-prepare" installed whole IPA server (tomcat, java,
ldap), not only ldap-server. I need to continue to read
documentation. However the problem was solved. <br class="">
<br class="">
<div class="moz-cite-prefix">06.10.2016 23:51, Степаненко Алексей
пишет:<br class="">
</div>
<blockquote cite="mid:ff9d93a0-a3e8-e989-3c4a-4e832c46427d@gw.spb.ru" type="cite">Thank you for your reply. <br class="">
<br class="">
I've got Samba server for a company, accounts are created by hand.
Clients are different windows or linux desktops. <br class="">
<br class="">
I want to install FreeIPA and have one area for managing accounts
(SMB, SSH-access for others servers). Now, I prepare clean samba
installation for testing. It would be great to use FreeIPA as
authorization server for samba. <br class="">
<br class="">
I was looking for information about samba + freeIPA, but I found
only this document. Maybe, I miss obvious things. <br class="">
<br class="">
<br class="">
06.10.2016 20:31, Loris Santamaria пишет: <br class="">
<blockquote type="cite">The document you are linking to explains
how to configure a samba file <br class="">
server in a freeipa domain, which is one of many ways you can
configure <br class="">
and use a samba server. <br class="">
<br class="">
What do you want to achieve with samba, and what is your current
setup? <br class="">
<br class="">
<br class="">
El jue, 06-10-2016 a las 19:23 +0300, Степаненко Алексей
escribió: <br class="">
<blockquote type="cite">Hello. <br class="">
<br class="">
I've read the topic about FreeIPA and SAMBA <br class="">
<a href="http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_Wit">http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_Wit</a>
<br class="">
h_IPA <br class="">
<br class="">
If I understand clearly, samba's client must be present in <br class="">
FreeIPA AD. <br class="">
Unfortunately, it does not work for me. I can't join some work
<br class="">
desktops <br class="">
to AD. Is it possible to make Samba auth trough LDAP IPA ?
Samba has <br class="">
ldap support <br class="">
<br class="">
ldap admin dn <br class="">
ldap group suffix <br class="">
ldap idmap suffix <br class="">
ldap machine suffix <br class="">
ldap passwd sync <br class="">
ldap suffix <br class="">
ldap user suffix <br class="">
<br class="">
Does it work with IPA ? <br class="">
<br class="">
Thanks. <br class="">
<br class="">
</blockquote>
</blockquote>
<br class="">
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset>
<br class="">
</blockquote>
<br class="">
</div>
-- <br class="">Manage your subscription for the Freeipa-users mailing list:<br class=""><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br class="">Go to http://freeipa.org for more info on the project</div></blockquote></div><br class=""></div></blockquote><div><span><pre><pre>-- <br></pre>Loris Santamaria linux user #70506 xmpp:loris@lgs.com.ve
Links Global Services, C.A. http://www.lgs.com.ve
Tel: 0286 952.06.87 Cel: 0414 095.00.10 sip:103@lgs.com.ve
------------------------------------------------------------
"If I'd asked my customers what they wanted, they'd have said
a faster horse" - Henry Ford
</pre></span></div></body></html>