https://github.com/lldap/lldap logo
Powered by
jmcgee - Opening a thread in regards to Domain ...
# troubleshooting
p
Opening a thread in regards to Domain Groups and samba: https://github.com/lldap/lldap/issues/599
n
Alright, let's get started! I may not always be available for quick replies but I'll do my best. Did you get it set up so samba is talking to LLDAP? And did you read the samba docs? (Link?)
p
n
Hmm, I don't know how far we'll be able to go 😄 I see fairly quickly that we need a custom objectClass for ssh keys... Maybe it's not checked and it works without? Anyway, you'll need a string list user attribute "sshPublicKey"
p
to be fair.. i would absolutely be ok with adding ssh keys to lldap 🙂
are there any examples of adding user attributes in lldap?
n
If you check out lldap-cli (mentioned in the issue) it's fairly straightforward
p
i do have that on my server that has the container
reminds me a bit of freeipas cli tool
n
For now it's a huge bash script, but eventually we'd like to make it a nicely integrated rust tool
The more I read the documentation, the more I'm afraid...
It looks like it requires a fully featured LDAP server, I don't know to what extent we'll be able to work around the requirements
I don't know what the samba interface looks like: we may have to apply ldif files in samba as well? It's not clear
Ah wait, no, all of that is for active directory if you want to do custom stuff
I see uidNumber, gidNumber, memberUID, sambaSID, sambaPrimaryGroupSID and sambaDomainName as listed attributes
They talk a lot about replication and sync, but I don't know to what extent that's necessary. I don't know samba well (or at all), so I don't know what's part of samba or what they helpfully recommend to get a production-grade openLdap working
p
ya i am at a loss as well.
so can we add custom attributes to a user with lldap-cli , like sshkeys, uidnumber and gidnumber and they become usable?
forgive my n00b questions on this matter...
n
Yep
You have to populate them but yes
p
interesting.
that would be cool if the ui picked up on user created attributes and allowed editing. but that is neithe here or there.
n
Yeah, it's a WIP
PixelRazor is working on it
That's in part why it's not in a stable release
Actually you should be able to create user attributes from the UI right now
(not group attributes though)
Looks like a more straightforward guide: https://ubuntu.com/server/docs/samba-openldap-backend
Could you show me the file /usr/share/doc/samba/examples/LDAP/samba.ldif ?
p
sure
n
Erf, they want a separate OU for computers and idmap, whatever that is
p
im thinknig of just adding the bare minimal to alleviate the errors 🙂
n
I'm getting more and more skeptical...
They essentially store their config in LDAP, in a special entry called "cn=config"
LLDAP is a simplified LDAP server, so it only has concepts of users and groups
You could make the entry a user, in which case you'd have to add all the configuration options as attributes to every user
Like, you could have a user called "sambaConfig" with lots of attributes that don't make sense for users, that are just the configuration for samba
It's ugly
Are you planning on running samba on windows or Linux? For Linux, it seems you first need to get SSSD configured
p
im just using it to share out some shares for linux clients
and various other clients, like my iphone
the main issue i am having, is i moved samba to a container, so i am unable to utilize local accounts any longer
hence how i came across your project
n
I see
Yeah, samba looks... Complicated
It'll take someone who knows samba better than us to get it working, I fear
All the tools don't describe the changes they make, but they expect to be able to do a lot of things through LDAP, more than are implemented in LLDAP
So it'll be more a question of reverse engineering and seeing what are the required attributes
If you want to do that, let's start by setting samba to the most verbose logging they have, set LLDAP to verbose, and start up samba to see what it requests from LLDAP
Another way to do it is to see what are the requests sent by the tools like 
sudo smbldap-useradd -a -P -m username
But that'll list all the attributes, probably. The question remains which ones we can ignore
p
i suppose step one will be learnign about adding attributres to lldap in the first place. 🙂
n
You should be able to do that in the UI
For users
That's the simple part 😄
p
in the ui?
n
Yeah, if you have the very latest image
p
im using stable.
n
Oh, then you don't have custom attributes at all
p
ahhh
n
Nothing will work!
p
hah
fair enough
j
Samba always needs local accounts
thats the complicated part with Samba, it wants to be like windows but for the filesystem it needs to be linux
And it needs both, local accounts for the filesystem as well as something in its own database (tdb-files, ldap, both, ...) for authentication
I cannot check the docs right now, but I cannot remember samba saving config in ldap. It is saving indeed users, groups, computers and id mappings (the last two maybe only while being an NT style PDC), but if you run it only as a file server, I could imagine that it could work with less config
I might find the time to take a look when the custom attributes get released, dont have time now for a test build.
But yeah, samba is a rock solid old software, that sometimes feels a bit clunky. Used it at work as a fileserver, NT style PDC as well as now as an Active Directory with its own ldap server
n
Here we're trying to make it work to provide user logins. I hope it's not too complicated but honestly I'm a bit lost 😄
j
I wouldn't hold my breath, you would certainly need not only samba auth via ldap, the same useraccounts (at least names) would need to exist on the system as well. But I'll happily take a look after the next release.
p
I was under the impression we could use either local users or ldap/ad. now granted, ive only ever used it for local users.
j
But for local users you had to add smb users with 
smbpasswd
, didn't you?
p
yes that is correct
and i believe that is the case with ldap users as well
you still have to add smbpasswd, correct?
i really dont know, so im speculating here.
j
no, ldap replaces the smbpasswd step, if the user has all the correct attributes. Local users are still necessary, though they could come from ldap as well, independently from samba
p
ahhh
ok
ya that makes putting samba in a container a pita. 🙂
j
But the more I think about it, the more complicated it gets. IIRC biggest problem with our old setup (samba3 as NT style DC) was to find a decent management interface to fill all the attributes correctly. Maybe with the CLI-scripts from smb
Never tried that
p
so wait.. even if a linux fileserver were to have all accounts accesable, by say, sssd.... it would STILL need to have the accounts that samba access available in /etc/passwd?
j
no, sssd (AFAIR what it does) and winbind work as well. I guess anything that allows you to 
chown ldap_user file
would work
p
hmm ok
i'll have to come back to this after work.
j
yeah. I'll see to carve out some time for this as well in coming weeks
p
awesome. i will keep this thread updated.
hopefully we come up with something 🙂
n
Can't we do something with samba + SSSD + LLDAP without local accounts?
j
sure. The problem with having to support many fields for samba will probably stay though. Some arent simple text fields, so its messy to manage them without proper tools.
n
(populating the attributes correctly could be made easier with a plugin. API to come)
j
(This info might be outdated though, didn't do anything new with samba+ldap in about 10 years now)
p
i am now on latest, fwiw
j
I may be completely wrong on this. But the last time I checked up on it, I think the direction of Samba is that you need to use their LDAP implementation (basicly their AD solution). Maybe worth googling a bit for some discussion on how firmly they mean that. My recollection is, that to use another LDAP implementation, and not be asking for trouble, you'd need to use an older version of Samba (which is probably also asking for trouble...)
Would be interested in a ping, if you reach a different conclusion and get it working 🙂
n
@jensen that's the recommended way to do it, yeah. But they also have the deprecated way that can connect to an open LDAP instance
j
Yeah. My impression was just, that they mean it with that deprecated stamp, and intend to drop support entirely for that at some point. It's been a while, so maybe I don't remember it correctly 🙂
j
My understanding is that you cannot use an external LDAP as it was possible with samba 3 (NT style PCD) as an AD. If you are happy with 
security = user
, this should still work
They had plans for Samba4-AD to be able to use an external openLDAP, but AFAIK that never got into a stable stage
n
j
Right, that makes sense. Wasn't aware it would still be possible with security = user - thanks!
j
I dont think that its feasable to use lldap with Samba in an PDC or AD setup
j
That was also my impression. But weren't aware there were other options.
n
PDC ?
j
Primary Domain Controller, iirc
j
PDC is a primary domain controller, its a term from NT4 style domains. (BDC would be a backup domain controller.) Active Directory, the current system for domains in the windows world uses DCs (domain controllers), which have certain roles, that can be switched around. There isn't a single "primary" DC. But all that isn't important IMHO. It might be interesting to use LLDAP as userbackend for linux and samba on a VM or a container, but I don't think its the right tool if you want to have a domain/active directory.
p
my personal goal would be just to have it handle logins for user shares. nothing fancy.
b
i'm happy this thread is here... i'm hoping to do some testing with this also
b
i just managed to integrate lldap into a sssd setup and wanted to continue to add samba but after some searching it seems there are a lot of different opinions how this is done best. sssd + winbind, just winbind, sssd/kerberos,...
n
I thought sssd required a modification timestamp in the user?
b
for me it seems the most headache will be to find the correct combination of those things, the lldap part looks to me as the easy part LOL
at the moment i added uidnumber and gidnumber attributes to the user. also gidnumber attribute to the group and a objectclass "posixGroup"
n
Yep, that matches my understanding of required fields
b
but yeah... i found the mentioned "timestamp" related problems in the discord here
n
How did you work around the timestamps?
b
at the moment i didnt
n
At, it might be only with some operations
b
yes i think so, my lldap users will be redirected into a container immediately.
but i grepped on the modifyTimestamp in the logs and those warnings are appearing on my system too
j
I need to look into this at some point, where we need to move a bunch of employees at a clients place to thin network booted linux desktops instead of Windows. I've never tried Kerberos, but everything I've heard makes me think staying away from it will be best 🙂 Im considering providing network mounts over WebDAV with https instead of samba, that can also be mounted as a network drive in windows. Havent tested if theres any performance issues with that, but I think that will broaden the available options quite a bit.
If you do go with samba+lldap, I wouldn't mind to get an update on your experience with it 🙂
7 Views
PreviousNext
Powered by