S6E20: "Actively Directing Samba"

Posted 2021-11-21 23:59
Modified 2021-11-21 12:10
Comments 0

We talk more about Samba and Active Directory integration.

• Just the Tip
• Notes
• 15 Clams
• Errata
• Music

Just the Tip

• A listener wrote in to remind us that SpinRite is terrible and a sham, and Steve Gibson should be ashamed.
  • I remind listeners to instead grab an image with ddrescue, and then perform data recovery on that image using tools such as TestDisk, PhotoRec, Scalpel, etc.

Notes

Starts at 23m20s.

I was drinking water. Paden was drinking water. Jthan was drinking Boulder vodka.

• Samba and AD integration
  • TL; DR: don’t use realm join --user=<username> AD.DOMAIN when joining a Samba member! Instead, use: realm join --user=<username> --client-software=sssd --membership-software=samba AD.DOMAIN.
    • You’ll also need to install sssd-winbind-idmap on RHEL-like systems.
  • We also discuss use cases for Kerberos.

Here’s a working sssd.conf:

[sssd]
domains = your.ad.domain
config_file_version = 2
services = nss, pam
certificate_verification = no_verification

[pam]
pam_verbosity = 2
pam_account_expired_message = Account is expired.
pam_account_locked_message = Account is locked.

[domain/your.ad.domain]
ad_domain = your.ad.domain
krb5_realm = YOUR.AD.DOMAIN
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
#use_fully_qualified_names = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad

And here’s a working smb.conf:

[global]
    realm = YOUR.AD.DOMAIN
    workgroup = YOUR
    security = ads
    kerberos method = secrets and keytab
    template homedir = /home/%U
    idmap config * : backend = tdb
    idmap config * :  range = 10000-199999
    idmap config YOUR : backend = sss
    idmap config YOUR : range = 200000-2147483647
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes
    machine password timeout = 0

[sharename]
    comment = Share Comment
    path = /opt/shared
    read only = No
    valid users = @"YOUR.AD.DOMAIN\Domain Users" @"YOUR.AD.DOMAIN\Domain Computers"

15 Clams

In this segment, Jthan shares with you a little slice of life. The title is a reference to this video. (2m16s in)

Starts at 36m40s.

Detective Jthan tries to determine if he’s getting throttled for hitting his ISP quota because his Internet connection is terrible.

Errata

• I was thinking of ATP.
• Edita actually cut most of the delays out. THANK GOODNESS.
  • Seriously, it was like 10x worse than it is in the recording.

Music

Author r00t^2
Categories Season Six