Rebuild OD, Kerberos, Samba PDC

[withayanda]

Without getting into the ugly details, our OD master server came crashing down a few months ago because an inexperienced sysadmin changed the IP through Sys Prefs (and destroyed our ASR backup image). He brought it back up but Kerberos has been broken ever since. And I just noticed when trying to add some new WinXP machines to the Samba PDC today that I couldn’t, getting authentication errors. Oh, this is 10.4.8.
I would like to fix this over the weekend and need some advice. I would prefer not wiping the server clean and starting over. Looking in Workgroup Manager, I see that all of my users have both SASL Password Server & Kerberos passwords. Looking at my principals in kadmin.local, I see only my users and machines listed.
I’m thinking that I should probably rebuild Kerberos by following all of the instructions in Part 2 of the excellent Kerberos guide here. Do you think that will solve my Samba PDC problem, too? Or should I demote it to a standalone and back to a PDC, also, and if so, I’m assuming that I would do that after fixing Kerberos?
BTW…what’s the easiest way to map my Directory Admins to the Samba Domain Admins group? Should I just do so in my smb.conf file? I guess that I had always thought it was already mapped, but apparently not.
Any help is greatly appreciated.

[withayanda]

Now that you mention it, that doesn’t make sense. It’s authenticating against the SASL Password Server. Mea culpa.
So I really do have 2 separate issues here: needing to rebuild Kerberos and needing to redo Samba. Yes, I need to rebuild Kerberos because there aren’t any service principals, most of the configuration files are now absent, and I would like to go back to using Kerberos for the Macs here.
Would the rest of my thought process be true with that one exception?

[Author]

Posts