- This topic has 1 reply, 1 voice, and was last updated 18 years, 11 months ago by
.
-
Posts
-
Hello. Here’s my situation…
I have a 10.4.10 server which acts as my OD master and PDC.
On my network, I have a 2K3 box that has ISA Serer(RRAS) implemented to facilitate client PPTP VPN connections to the network.
When I have the 2K3 box set to it’s own workgroup, VPN users can authenticate without issue.
When I have the 2K3 box bound to the OSX Domain, my users can’t authenticate, RRAS is setup on the 2K3 box to permit the specific group I setup in OD, however this doesn’t seem enough.
I do see this error in the logs:
2007/12/01 15:56:42, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setup_new_vc_session(662)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2007/12/01 15:56:42, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setup_new_vc_session(662)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2007/12/01 15:56:42, 0] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_pipe.c:api_pipe_bind_req(993)
api_pipe_bind_req: unknown auth type 1 requested.
[2007/12/01 15:56:43, 1] auth_ods.c:opendirectory_smb_pwd_check_ntlmv1(387)
opendirectory_smb_pwd_check_ntlmv1: [0]opendirectory_user_auth_and_session_key key_length(16)
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [20]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1028]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1026]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [80]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1025]
[2007/12/01 15:56:43, 2] /SourceCache/samba/samba-100.7/samba/source/auth/auth.c:check_ntlm_password(360)
check_ntlm_password: authentication for user [user] -> [user] -> [user] succeeded
[2007/12/01 15:56:51, 2] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_samr_nt.c:access_check_samr_function(154)
_samr_lookup_domain: ACCESS DENIED (granted: 0x00000020; required: 0x00000010)
[2007/12/01 15:56:51, 2] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_samr_nt.c:access_check_samr_function(154)
_samr_lookup_domain: ACCESS DENIED (granted: 0x00000020; required: 0x00000010)Any ideas? I’m pulling my hair out on the one….
Thanks…
I found something online about Samba’s PDC implementation not allowing computers to be added to the domain?
On the surface, this appears to make sense. I also know that editing the smb.conf file is tricky since the UI rewrites is constantly.
Could this be a solution? And if so, what is the best way to modify the file? I saw a posting the under Leo Server, there is a separate SMB.CONF file that is avail for user modification that lives separately from the main one in the /run directory? I’m on 10.4.11 however…
Please advise.
—-
The solution:
add this to smb.conf:
enable privileges = yes
This allows you to grant special privileges to users (see man smb.conf
for more detail)reload the samba config:
$ smbcontrol smbd reload-config
and grant the necessary rights to Administrator:
$ net -U Administrator rpc rights list
SeMachineAccountPrivilege Add machines to domain
SePrintOperatorPrivilege Manage printers
SeAddUsersPrivilege Add users and groups to the domain
SeRemoteShutdownPrivilege Force shutdown from a remote system
SeDiskOperatorPrivilege Manage disk shares$ net -U Administrator rpc rights list Administrator
$ net -U Administrator rpc rights grant Administrator SeMachineAccountPrivilege
Successfully granted rights.Now one can add machines to the domain. Better yet, the
administrator account does _not_ have to have a uid of 0!
- You must be logged in to reply to this topic.