AveryFreeman's questions

I am connecting NFS v3 shares (ZFS datasets) from a Solaris file server owned by domain users to Windows computers, but the concept should apply to basically any POSIX-style server. I'm hoping to find an intuitive way for permissions to persist across platforms, which can also apply to multiple users using the same client.

The Solaris server does not recognize the users' identity when mounting the dataset using mount command in cmd, despite the datasets being set to the same domain user present on the server, but identified using AD LDAP's uidNumber and gidNumber.

I've seen a solution where uid/gid can be set in the registry, allowing the NFS share to be mounted in Windows as an anonymous share with one user's identity. This is not only inconvenient, it would only apply to one user.

I was using MSYS2 (e.g. "Git Bash") and noticed the id command doesn't show anything near to the uidNumber/gidNumber set in ADUC's attribute tab. I'm aware that Windows uses SIDs for identifying users and devices, which is quite dissimilar to the Unix id system - but where is MSYS2 getting this number from?

I'm hoping by shedding light on this it might help me figure out some way to set user attributes so the mount command in cmd will relay my users' identity in a way my Solaris server will understand.

Here's an example of what I'm talking about:

In ADUC, let's review the uid/gid of Administrator:

Active Directory Users and Computers
----------------------------------------------
    [Menu]  View --> Advanced Features -->
+ [Domain] Users --> Administrator --> Properties -->
  + [Tabs] Attribute Editor -->
+ [Tables] uidNumber, gidNumber

uidNumber: 2500
gidNumber: 2512

Ok, then let's check Administrator's id in MSYS2:

└─ ▶ id administrator
uid=1049076(Administrator) gid=1049089(Domain Users) groups=1049089(Domain Users)

Obviously these are very different numbers. Wouldn't it make more sense for the user's Unix uid/gid to be shown?

Where's MSYS2 getting these odd-looking numbers from, and is there any way to utilize a user's AD-specified uid/gid as identity in the command line?

so I've got the dreaded 'samba keeps asking for password' issue in Debian Stretch.

My environment:

2x AD DCs running WS2012R2

A few physical computers and several VMs running on ESXi 6.7

All machines can log into domain and access domain shares

All machines can authenticate using the domain users

Samba changed the syntax for smb.conf in version 4.6 so I thought it might have been a problem related to the Stretch standard repo packages being 4.5.12, so I added a Samba repo for Ubuntu called 'Samba Latest':

https://launchpad.net/~linux-schools/+archive/ubuntu/samba-latest

I'm currently using the one for Xenial, which is 4.7.8

I derived my AD join configuration straight from the Samba official wiki. It's been trivial in the past for me to get machines ranging from FreeBSD 11.1-RELEASE to OpenSUSE Leap 15 for the Raspberry Pi 3B+ working with Samba using my configuration. It doesn't make any sense that it wouldn't work with Debian Stretch with either the 4.5.12 standard repo packages or the 4.7.8 packages from Samba-latest.

I also just set up Ubuntu 18.04 Bionic Beaver on a laptop and was able to authenticate as domain users for the desktop and via SSH and su. I am surprised that Debian would be giving me issues if Ubuntu is working fine because they are so similar.

So the only one that isn't working is Debian Stretch. Shame, since usually I like Debian very much, but it seems to really suck for Samba out of the box.

Please note, that I tried all the variables I am about to detail on both the standard repo Samba version 4.5.12 and also the Samba-latest repo 4.7.8

Here's my configs:

[global]
    netbios name = DEBIAN
    security = ADS
    workgroup = WEBTOOL
    realm = WEBTOOL.SPACE
    client use spnego = no
    client signing = auto
    ;server signing = auto
    ;client ntlmv2 auth = yes
    ;encrypt passwords = yes

    log file = /var/log/samba/%m.log
    log level = 1

    idmap config * : backend = tdb
    idmap config * : range = 3000-7999

    idmap config WEBTOOL : backend = ad
    idmap config WEBTOOL : schema_mode = rfc2307
    idmap config WEBTOOL : range = 10000-999999
    idmap config WEBTOOL : unix_nss_info = yes
    idmap config WEBTOOL : unix_primary_group = yes

    ;winbind use default domain = yes
    winbind enum users = yes
    winbind enum groups = yes
    winbind offline logon = yes
    ;winbind nested groups = yes
    winbind refresh tickets = yes
    winbind nss info = rfc2307

    ;winbind nss info = template
    ;template shell = /bin/bash
    ;template homedir = /home/%D/%U

My hostname and /etc/hosts settings are correct, my dns pointers point to the two DCs.

My NTP is synced as checked with ntpq -p and:

 $ date
 Sat Jun 30 16:52:23 PDT 2018

Matches all other computers on my domain.

I have krb5-user installed and got keytabs from the DCs as administrator as both user and root.

My kinit works but my net ads join -k or net ads join -U [email protected] shows:

$ sudo net ads join -U [email protected]
Enter [email protected]'s password:
Using short domain name -- WEBTOOL
Joined 'DEBIAN' to dns domain 'webtool.space'
DNS Update for debian.webtool.space failed: ERROR_DNS_UPDATE_FAILED
DNS update failed: NT_STATUS_UNSUCCESSFUL

I don't have this message on any of my other VMs, but I should note that if I did in the past the VM would still join the domain and act properly, and then it was just a matter of figuring out the issue from there.

Here's what I've tried:

Commenting out anything to do with authentication in the first paragraph of [global]

Changing client use spnego = yes to = no, Changing client signing = yes to = auto, Commenting out server signing = yes and trying = auto, Commenting out client ntlmv2 auth = yes Commenting out encrypt passwords = yes and changing it to = no

Does anyone have any ideas?

Noticing none of the settings in an ESXi 6.7 installation are surviving reboot.

I created the USB with a stock installation ISO like always, downloaded from the VMWare website. Just used the USB key like a normal drive. Have been doing this for several years now. Been using ESXi since version 5.5.

Have had a FreeNAS VM with the SATA controller on a Supermicro X9SCL-F passed through the whole time, too.

I upgraded (via new install) to 6.7 tonight. I toggled the SATA controller to passthrough, reboot. Upon reboot, passthrough disabled.

I thought maybe it was the fault of the VMKernel.boot.disableACScheck = false flag, so I set it to true. Reboot, flag set to false again.

I tried setting a VM to autostart. Reboot, VM not set to autostart anymore.

That's when I noticed -- none of the settings are surviving a reboot.

Now I've set boot.cfg to include the following:

kernelopt=autoPartition=TRUE skipPartitioningSsds=TRUE autoPartitionCreateUSBCoreDumpPartition=TRUE

Settings still appear not to be persistent.

During boot I'm seeing the following regarding passthrough:

method invocation failed: pcipassthrough->start() failed: error while executing the cli

Does anybody know what's going on? This is really frustrating. I've been struggling with it for hours.

Let me preface this by saying I am completely unfamiliar with VLAN tagging. I understand the basic concept, but I lack any sort of real-world experience.

I am looking into installing FreeIPA for a homelab. I have a simple 192.168.1.0/24 Active Directory setup with all hosts on same subnet.

Reading about FreeIPA, from what I understand it is best to have a separate domain name on a separate subnet, and create a trust relationship between AD and FreeIPA.

If I do this, how can the computers talk to one another? Aren't they isolated on separate subnets? Wouldn't this inhibit any sort of file sharing (e.g. samba, NFS, etc.)?

Has anyone who is using FreeIPA help me be less confused?

If possible, would love explanation to include (VLAN?) requirements for router (pfSense) and switches

Edit: Question in response to the first comment, then pfSense can configure the VLAN routing (e.g. "router on a stick") and allow routing as if on same subnet between separate subnets?

Then does switch have to be configured to allow VLAN tags (e.g. 10 for VLAN10 192.168.10.1 and 3 for VLAN20 192.168.20.1)?

I have an ESXi 6.5 server without vSphere I've been running for a couple years. I have a VM with PCI passthrough of a cougar point SATA controller from the SM X9SCL-F-O motherboard.

I wanted to move the CP controller to another VM, but no matter which VM I try to pass the controller through to, it won't boot after I pass it through. The VMs boot fine once the controller is removed. The error is:

Failed - Invalid memory setting: memory reservation (sched.mem.min) should be equal to memsize(2048)

I have tried:

Increasing or decreasing the VM memory allotment

Manually reserving memory allotment in .vmx file

Changing the latency sensitivity from low to high, and everything between

Does anyone have any idea what I'm doing wrong? I don't think this was a problem before I upgraded to ESXi 6.5

Please help! It's driving me crazy...

Edit: Updated to ESXi 6.5a Build 4887370 - it did not fix the problem.

New info and answer:

Unfortunately the link provided in the answer below did not explain the steps required to increase scheduled memory to the VM in ESXi 6.5, since it was written before the new HTML5 interface and the procedure has changed.

However, it did get me on the right track. I realized that I had overlooked a "down arrow" underneath the memory settings when I was editing the VM's Virtual Hardware.

Memory setting and reservation must be the same for VM to function with PCI passthrough to avoid the sched.mem.min error and power on the VM. VMs regularly work without reserving memory, but apparently this is an additional step required for PCI passthrough functionality.

Here are the steps I took to reserve the proper amount of memory for the VM in ESXi 6.5 without vSphere:

1) Click Edit

2) Click arrow underneath memory to expand memory options

3) Enter same amount of memory for VM in "Reservation" field (e.g. if Memory is 2048MB, enter 2048 in Reservation)

4) Save settings. VM should function with PCI passthrough device now.

Note: Memory does not have to be locked for VM to function

Hopefully this will help someone else that is having the same problem that I was.

I am setting up an LXC container on a fresh install of Proxmox 4.4. My network setup is analagous to the one described in this post: network configuration (bridging) proxmox

However, I still cannot access the container from the local network, and the container cannot ping to the outside. The container and the host can both ping each other fine.

Here's the host /etc/network/interfaces

auto lo
iface lo inet loopback

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
     address 192.168.1.45
     netmask 255.255.255.0
     gateway 192.168.1.1
     bridge_ports eth0
     bridge_stp off
     bridge_fd 0

and the container's /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
     address 192.168.1.78
     netmask 255.255.255.0
     gateway 192.168.1.1

iface eth0 inet6 dhcp

I'm really not sure what I'm doing wrong. I thought this was about as simple a network setup as one could have with Proxmox. Can anybody help me?

Full disclosure: I am previewing this as a VM in ESXi 6.5, but it does not seem as if that should matter in this situation.

Thanks!

Edit: I figured out what the problem was and wanted to post it here so it could help if anyone else had the same problem.

In ESXi, promiscuous mode needs to be configured at the vSwitch. This allows nested VMs and containers to use bridging. Please see this article for further information: https://egustafson.github.io/esxi-nested-virtualbox.html