Thank you very much for your answer; a very detailed answer!
I hope you will find few more minutes to clarify the things I didn't
understand... particularly the Fumiyas law :-)
> wbinfo should show three domains:
> # wbinfo -m
In my case "MY_SERVER" is missing.
> # net getdomainsid
> SID for local machine YOUR_SERVER is: LOCAL-SID
> SID for domain YOUR_DOMAIN is: DOMAIN-SID
In my case local and domain sids are the same
> # ldapsearch -xLLL "(&(objectclass=sambaDomain)(sambaDomainName=*))"
I don't use ldap, but the simple tdbsam.
I'm trying to switch to openldap, but I'm in trouble as far as I can't
find a working guide.
As you can confirm later, for example, smbldaptools has some "bugs" but
I have never read about them.
> and finally
> # wbinfo --ping-dc
> MUST succeed
Ok, it succeed
> As SATOH Fumiyas tells us, one SHOULD join without a running winbindd
> # net rpc join -S localhost -U administrator
> One are NOT joining "localhost"! One join $HOSTNAME!!
Sorry, I don't understand..
> Verify with
> # net rpc testjoin
> Join to 'YOUR_DOMAIN' is OK
..but this works :-)
> # pdbedit -v $HOSTNAME$
> Account Flags: [S ]
> User SID: "DOMAIN-SID"-"SERVER-RID"
> Primary Group SID: "DOMAIN-SID"-515
Ok, but I have a problem: the PG-SID ends with 3007
Primary Group SID: "DOMAIN-SID"-3007
All our machines have this issue.. because
#> net groupmap list|grep 3007
Domain Computers ("DOMAIN-SID"-3007) -> msmachines
I don't know why.. I remember it was 515.. I'm confused, it's very
strange. How can I have changed it? Many other SID ends in 30xx
I don't know if this can cause the following problem.
> It works for me with Samba 3.5.6 and also with 3.5.11 from backports :-)
Perfect, so I'm sure I can make it works :-)
Are you using the windbind.conf workaround?
> Step-by-step guide
> You should verify these three groups:
> # net sam list builtin
For me "guest" is missing
> # net sam show administrators
> BUILTIN\administrators is a Local Group with SID S-1-5-32-544
> # net sam show guests
> BUILTIN\guests is a Local Group with SID S-1-5-32-546
> # net sam show users
> BUILTIN\users is a Local Group with SID S-1-5-32-545
Finally a perfect result! :-)
> and verify that these groups have their default members:
> # net rpc group members Administrators
> YOUR_DOMAIN\Domain Admins
> # net rpc group members guests
> YOUR_DOMAIN\Domain Guests
> # net rpc group members users
> YOUR_DOMAIN\Domain Users
Strange, it ask me for root's password, but:
Could not connect to server 127.0.0.1
The username or password was not correct.
Connection failed: NT_STATUS_LOGON_FAILURE
> You must have a valid "idmap alloc setup"
> and have stored the secret in secrets.tdb
I hope "idmap secret" refers to a ldpap password.
> will store user and passord in secrets.tdb, so that winbindd has enough
> rights to work. If your administrator account has uidnumber=0, you may
> use this account.
> stop samba, start winbind, start samba
> wait some seconds, winbindd will now create the third domain which has
> the name of your PDCs hostname.
I lost myself.. because I cant' distinguish the ldap from the tdbsam
In my case, with tdbsam, winbind needs to find a password in secret.tdb?
> when I checked winbindd.conf with testparm, I have get some errors,
> until I put an empty or comment line before the line with the include
> statement :-) .
Here it doesn't need it :-)
I will try to know how is possible to have Sid ending in 3007, but I'm
sure I have some problem in the tdbsam database as far I can't delete
some machine accounts.
Probably it could be better to solve this problem before all others
("tdbbackup -s" should be enaugh.. ).