Prev: Failed to join domain: failed to set machine spn: Constraint violation
Next: Question re: samba 4 feature set
From: Guenther Deschner on 12 Dec 2008 05:30
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Green wrote:
> Anyone?.... any ideas?

Can you open a bug on this and upload a network trace as well ?

Thanks,
Guenther

- --
G�nther Deschner GPG-ID: 8EE11688
Red Hat gdeschner(a)redhat.com
Samba Team gd(a)samba.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAklCO+cACgkQSOk3aI7hFoiTLgCeJkjEOkx13ob9j7glt663YmJp
Pr0An2flu3aPZvFeFlfjdDtYQpaFrPHm
=Iz61
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
From: Gerald (Jerry) Carter on 15 Dec 2008 12:00
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Green wrote:
> Found the issue:
>
> Validate Write for DNS and SPN were not set.
>
> However it now fails on DNS Update; I'm presuming
> this is because we're not using AD Integrated DNS (MS-DNS).
> Could this not be an option flag to disable DNS updates
> in this scenario?

Those attributes and perms have nothing to do with DNS. You
need full access rights to the computer object to join a machine
with a DNS name outside of the AD realm name. That's what the
"validated write" means.





cheers, jerry
- --
=====================================================================
Samba ------- http://www.samba.org
Likewise Software --------- http://www.likewisesoftware.com
"What man is a man who does not make the world better?" --Balian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJRoS5IR7qMdg1EfYRAq/nAKDa3GwgMI1SzbyuU6UBAKR/r2X/7ACdFAaj
Y5yzmHfOBD89pu0YXA5Y3fg=
=J1Lb
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
From: Gerald (Jerry) Carter on 15 Dec 2008 13:20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Green wrote:
> Hey Jerry,
>
> I'm aware of that. Due the restrictions placed within our AD
> environment, even users who have access to create computer
> objects don't have access to update the SPN or the
> host DNS name (AD record).
>
> Additionally, my point was more; would it be possible to turn
> off the DNS update process by means of flag, rather than
> compile time option.

Youu confused me by saying "DNS update". Assuming now you mean
just updating the dNSHostName and SPN attributes. This is always
required in order to support Krb5 authentication. This is exactly
what Windows XP does.

The DDNS update you are asking about (i.e. the--with-dnsupdate option)
has nothing to do with setting the attributes. If the DDNS update fails,
it is not fatal. You only get a warning.






cheers, jerry
- --
=====================================================================
Samba ------- http://www.samba.org
Likewise Software --------- http://www.likewisesoftware.com
"What man is a man who does not make the world better?" --Balian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJRp7FIR7qMdg1EfYRAp/rAKC5IVsTNBNzIxE62FL5QaYfqMKzWQCfQxW8
GxpmNokZm3stFwqgHrFiC8g=
=SEGF
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
From: Gerald (Jerry) Carter on 15 Dec 2008 13:50
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Green wrote:
> :)... it's this non-fatal error that our uses are getting
> confused about and it's this that I was asking for the cli
> option for...

For the DDNS update we can add a disable run time option.
For setting the attributes, failing is the right thing to do I believe.

What version of Samba are you running?




cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJRqXTIR7qMdg1EfYRAjlhAKDxjq2msUYQG6o4lKET78J55XpmpgCdFS9K
Ttlu3rVaEVLz4AYEO1nqltA=
=2cVK
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
From: Gerald (Jerry) Carter on 16 Dec 2008 07:40
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex,

> 3.0.28 and 3.0.32 - Native OS version shipped by Novell(Linux) and Sun(Solaris)
>
> Failing is the right thing to do in an MS-DNS/AD-Integrated
> environment, however for non-MS DNS environments disabling is
> going to be cleaner.

Failing is the right thing to do period because without setting
the attributes you can't do Krb5 auth. Maybe you should be using
"security = domain" instead.







cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJR6DIIR7qMdg1EfYRAgIMAKC6kaIxLU+v7jwWKK4UEOF/CS+dSgCg2qTh
a2Ni1L3EkpPweglM5p1gG2g=
=ifuH
-----END PGP SIGNATURE-----
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
 |  Next  |  Last
Pages: 1 2
Prev: Failed to join domain: failed to set machine spn: Constraint violation
Next: Question re: samba 4 feature set