You are here
Markus KARG - Sat, 2012/11/24 - 17:25
I have set up the turnkey fileserver appliance, then bound samba to my W2K3 domain using Webmin. It said that the appliance joined the domain successfully. The I restarted the domain and now want to set the allowed groups for /storage. But the selection of possible groups only shows the list of all the unix groups, not the list of the groups in the AD. What am I doing wrong? How do I tell the appliance that the lists of users and groups shall always be taken from AD?
Forum:
Tags:
TBH I'm not sure...
I haven't tried to do what you are doing so I can't say for sure. Perhaps google will have some answers? FWIW the v12 appliances are based on Debian 6/Squeeze and by default it uses Samba3.
I suspect that you will need to take some additional steps to sync the Windows users to Samba users. AFAIK Samba users also need to have corresponding Linux user accounts. There should be some way of auto creating Samba users (and the corresponding Linux users) from the Windows users, but I don't know for sure how that works...
A couple of thought...
What you say may well be true, as I have said I have never tried what you are doing. But as has been documented widely Samba 3.x is compatible with NT domains (up to Win Server2k). I know that it does not strictly do the AD thing but was under the impression that it could still join and act as a usable server... but perhaps not.
A quick thought, in your setup are their corresponding Linux users? AFAIK that is a requirement.
I suspect what you really want is Samba 4. There was a great open source project called Resara Server which was a nice implementation of Samba 4 setup as a drop in AD domain controller (AFAIK fully compatible with Server 2k3/2k7 domains), but unfortunately they went bust. They have promised that they will release all the rest of their code and documentation but who knows... Anyway... from what I have read the vanilla Samba 4 works quite well (it is in the repos, but it is under quite heavy development so you may be better off intalling from upstream source).
As for your suggestion perhaps you are right. Perhaps you can fully document your setup as you go and convert it into a TKLPatch which could go into the next TKL release. Although I say, I think that Samba 4 is probably a better starting point...
As for the fileserver being turnkey - I don't think that it was ever intended for the usage scenario that you are trying to achieve (ie a fully functioning Windows domain member server) - but more of a simple SOHO fileserver - and for that it works quite well. I have used it to share files (via SMB/CIFS ie Samba) with both XP and Win7 and it works fine for me (although I set up the users manually). Don't get me wrong I'm not saying that what you are wanting wouldn't be great, but I don't think that was ever the intention... Perhaps in your scenario you would be better served (excuse the pun) by other products out there...
FWIW if it was aimed at only Linux filesharing then it wouldn't have Samba at all and would come with NFS preinstalled...
As I say, if you want it for a different purpose then please feel free to 'fix' it and share your patch. There are probably others who would appreciate your work.
Winbind looks like what you want
But from my quick read about Winbind (in the official Samba docs), it seems that Winbind allows usage of Samba/Windows user account as native Linux user accounts - but only if it can get access to the LDAP database (that should be running on your Win server). From what I can gather you are correct in that you shouldn't need to also create Linux accounts (but I didn't read enough to be sure).
As for the appliance docs go, yes it would be great, but basically the appliance is TKL Core with Samba3 (from the repos) installed on top. Then basic configuration to make Samba work as a simple fileserver (as opposed to an NT domain controller - like the PDC appliance is). So with your usage scenario, perhaps the PDC appliance would be a better starting point (again I don't know because it's not something I've actually tried)? Although it's still only an NT level DC (which use a workgroup, rather than AD). As you have discovered, to make Samba3 compatible with AD you need additional stuff (like Kerbios).
So bottom line is that neither of the Samba appliances (Fileserver nor PDC) are designed to address your usage scenario (to be an AD member server). That does not make them incomplete - just not designed to address your requirements. You wouldn't say that a toothbrush is incomplete because it doesn't include dental floss would you?!? Or that a ball pein hammer is incomlete because it doesn't allow you to pull nails?!? Point is, different tools for different jobs and the TKL appliance range doesn't include an appliance that is the ideal tool for the job you want to do...! But it's not personal, there's lots of other things that could have TKL appliances for that task, but they don't exist either... In fairness to you, perhaps all this should be more clearly stated on the relevant appliance pages...
This leaves you with a number of options. As I see it the obvious ones are:
Add new comment