Jakob Lenfers's questions

I'm starting to manually migrate my samba3 (or now samba4 classic) servers into a new samba4 AD domain. (All new servers are running with v4.7.4.) The DCs are running fine and I'm testing my first member server. Works well with Windows 10 domain members, but we won't be adding all clients into the domain just yet.

Our old login scripts that map the drives do create problems now, since the non domain members try to login with "LOCALCOMPUTER\username", passwords are of course the same.

For my old samba 3 PDC, I successfully used map untrusted to domain = yes to solve that problem. I'm now using the new default auto, which will be the only value in 4.8 as far as I understand and it doesn't seem to work as I need it to. AFAIU the member server is supposed to delegate the decision to the DC, which, in case it is unknown, should perform a local authentication. I'm not sure what exactly "local" is (is it the AD or the server?), but it doesn't work here.

By default, and with map untrusted to domain = auto smbd will defer the decision whether the domain name provided by the client is a valid domain name to the Domain Controller (DC) of the domain it is a member of, if it is not a DC. If the DC indicates that the domain portion is unknown, then a local authentication is performed. (man smb.conf v4.7.4)

So in short, is there an easy solution to map all unknown domains to BSS\user? Since I don't have more than this one domain, I don't even mind mapping everything.

DC smb.conf is fairly standard (left out netlogon/sysvol):

[global]
        workgroup = BSS
        realm = BSS.FQDN.EXAMPLE.COM
        netbios name = BARVA
        server role = active directory domain controller
        dns forwarder = 1.2.3.4
        idmap_ldb:use rfc2307 = yes
        time server = yes

Member (file) server, left out the share definitions:

[global]
    workgroup = BSS
    realm = BSS.FQDN.EXAMPLE.COM
    security = ADS

    winbind enum users = yes
    winbind enum groups = yes
    winbind use default domain = yes
    winbind refresh tickets = yes
    winbind nss info = template
    template shell = /bin/false
    template homedir = /srv/samba/homes/%U

    #
https://wiki.samba.org/index.php/Idmap_config_rid#Planning_the_ID_Ranges
    # Default idmap config for local BUILTIN accounts and groups
    idmap config * : backend = tdb
    idmap config * : range = 3000-7999

    # idmap config for the domain
    idmap config BSS : backend = rid
    idmap config BSS : range = 10000-999999

    store dos attributes = yes
    vfs objects = acl_xattr
    inherit acls = yes
    map acl inherit = yes

Thanks in advance, Jakob

I'm setting up a server with Dovecot (2.2.2) and Postfix (3.1.0). Dovecot authenticates against LDAP and Postfix uses Dovecots SASL. That already works fine. But I would like to have slightly different LDAP settings for Dovecot and Postfix. Current setup:

passdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf.ext
}
userdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf.ext
}

Excerpt from dovecot-ldap.conf.ext:

user_filter = (& \
    (objectClass=gosaMailAccount) \
    (allowedServices=*I*) \
    (uid=%u) \
)

I wanted to have sparate LDAP filters (allowedServices=*I* for Dovecot and allowedServices=*S* for Postfix), to be able to disable SMTP and IMAP independently. Does anybody know a way to separate those settings?

TLDR: Can I sensible manage samba accounts in openldap with Apache Directory Studio (or other general purpose ldap editors)?

I'm currently trying to move away from GOsa as our LDAP management tool. (Also I'm changing cyrus to dovecot, but that's taken care of.) I want to get away from solutions like GOsa, because it was hard for us to enhance their software for our need while staying up to date with their code. Also the project had the latest release in 2012. I would like to edit our users with general purpose ldap interfaces like Apache Directory Studio or similar.

Since we use the directory also for storing our samba accounts, I realized that GOsa did more in that department than I thought. I don't want to manually generate the different samba password hashes (sambaLMPassword, sambaNTPassword) and the non human readable fields (sambaPwdLastSet, sambaMungedDial) myself. Also managing the ids could be something that the tool should do. Is there any way between tools like GOsa and LAM and the complete manual approach? Or do I have to use smbldap-tools on the console and edit the rest in ADS? :/

Thanks!

Edit: samba 4, but in classic mode