[Samba] Samba4 AD DC using s3fs an OpenIndiana/Illumos/Solaris

[Henner Gratz]

Hello!

I've just built my first samba4 (4.0.5) on an OpenIndiana machine
without any problems.
But when it comes to the provision step the problems begin. Everything
is fine, if I
call samba-tool with the --use-ntvfs option. But I want to use samba4
with s3fs because
of the support for newer SMB protocol versions.

But when I call samba-tool without --use-ntvfs option I got the following:


root@openindiana:~# /usr/local/samba/bin/samba-tool domain provision
Realm: domain.local
Domain [domain]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE)
[SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding)
[134.102.20.20]: none
Administrator password:
Retype password:
ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed -
ProvisioningError: guess_names: 'realm=WIWI.LOCAL' in DOMAIN.LOCAL must
match chosen realm '/usr/local/samba/etc/smb.conf'! Please remove the
smb.conf file and let provision generate it
File
"/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/domain.py",
line 398, in run
use_rfc2307=use_rfc2307, skip_sysvolacl=False)
File
"/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py",
line 1978, in provision
sitename=sitename, rootdn=rootdn)
File
"/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py",
line 597, in guess_names
raise ProvisioningError("guess_names: 'realm=%s' in %s must match
chosen realm '%s'! Please remove the smb.conf file and let provision
generate it" % (lp.get("realm").upper(), realm, lp.configfile))


I know that samba uses POSIX ACLs while OpenIndiana/ZFS uses NFSv4 ACLs,
but I hoped
that there is a way to configure samba4 to work with s3fs on Solaris
machines as well.
Unfortunately I wasn't able to find anything about this topic with
google and friends.
Does somebody on this list know more about it?

Thank you very much for any advice in advance!

Regards,

Henner



--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Rowland Penny]

Hi, did you provision it first with --use-ntvfs ? if you did, do you
have /usr/local/samba/etc/smb.conf ?
If you do, then do what the error message is telling you, remove or
rename smb.conf and try provisioning again.

Rowland


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[Henner Gratz]

> On 11/04/13 12:10, Henner Gratz wrote:

> >/ Hello!
/> >/
/> >/ I've just built my first samba4 (4.0.5) on an OpenIndiana machine
/> >/ without any problems.
/> >/ But when it comes to the provision step the problems begin. Everything
/> >/ is fine, if I
/> >/ call samba-tool with the --use-ntvfs option. But I want to use samba4
/> >/ with s3fs because
/> >/ of the support for newer SMB protocol versions.
/> >/
/> >/ But when I call samba-tool without --use-ntvfs option I got the
/> >/ following:
/> >/
/> >/
/> >/ root at openindiana <https://lists.samba.org/mailman/listinfo/samba>:~# /usr/local/samba/bin/samba-tool domain provision
/> >/ Realm: domain.local
/> >/ Domain [domain]:
/> >/ Server Role (dc, member, standalone) [dc]:
/> >/ DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE)
/> >/ [SAMBA_INTERNAL]:
/> >/ DNS forwarder IP address (write 'none' to disable forwarding)
/> >/ [134.102.20.20]: none
/> >/ Administrator password:
/> >/ Retype password:
/> >/ ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed -
/> >/ ProvisioningError: guess_names: 'realm=WIWI.LOCAL' in DOMAIN.LOCAL
/> >/ must match chosen realm '/usr/local/samba/etc/smb.conf'! Please
/> >/ remove the smb.conf file and let provision generate it
/> >/ File
/> >/ "/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/domain.py",
/> >/ line 398, in run
/> >/ use_rfc2307=use_rfc2307, skip_sysvolacl=False)
/> >/ File
/> >/ "/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py",
/> >/ line 1978, in provision
/> >/ sitename=sitename, rootdn=rootdn)
/> >/ File
/> >/ "/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py",
/> >/ line 597, in guess_names
/> >/ raise ProvisioningError("guess_names: 'realm=%s' in %s must match
/> >/ chosen realm '%s'! Please remove the smb.conf file and let provision
/> >/ generate it" % (lp.get("realm").upper(), realm, lp.configfile))
/> >/
/> >/
/> >/ I know that samba uses POSIX ACLs while OpenIndiana/ZFS uses NFSv4
/> >/ ACLs, but I hoped
/> >/ that there is a way to configure samba4 to work with s3fs on Solaris
/> >/ machines as well.
/> >/ Unfortunately I wasn't able to find anything about this topic with
/> >/ google and friends.
/> >/ Does somebody on this list know more about it?
/> >/
/> >/ Thank you very much for any advice in advance!
/> >/
/> >/ Regards,
/> >/
/> >/ Henner
/> >/
/> >/
/> >/
/> Hi, did you provision it first with --use-ntvfs ? if you did, do you

> have /usr/local/samba/etc/smb.conf ?
> If you do, then do what the error message is telling you, remove or
> rename smb.conf and try provisioning again.
>
> Rowland

Mea culpa!

I'm very sorry. I pasted the wrong error message... You guessed right.
I did another provisioning before. But removing smb.conf doesn't help
to solve my (real) problem. Here comes the correct error message:

root@openindiana:/usr/local/samba/etc# !512

/usr/local/samba/bin/samba-tool domain provision
Realm: domain.local
Domain [domain]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [134.102.20.20]: none
Administrator password:
Retype password:

Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
set_nt_acl_no_snum: fset_nt_acl returned zero.
ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed - ProvisioningError: Samba was compiled without the posix ACL support that s3fs requires. Try installing libacl1-dev or libacl-devel, then re-run configure and make.

File "/usr/local/samba/lib/python2.6/site-packages/samba/netcmd/domain.py", line 398, in run
use_rfc2307=use_rfc2307, skip_sysvolacl=False)

File "/usr/local/samba/lib/python2.6/site-packages/samba/provision/__init__.py", line 2040, in provision
raise ProvisioningError("Samba was compiled without the posix ACL support that s3fs requires. Try installing libacl1-dev or libacl-devel, then re-run configure and make.")


As OpenIndiana is not Linux the hints in the message are not helpful.

Regards,

Henner

[Rowland Penny]

On 11/04/13 14:17, Henner Gratz wrote:
> Try installing libacl1-dev or libacl-devel

I think that you either need ACL support adding to your filesystem in
fstab or you need to find the openindiana variant of libacl-devel and
re-compile or possibly both.

Rowland

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[Andrew Bartlett]

On Thu, 2013-04-11 at 14:54 +0100, Rowland Penny wrote:
> On 11/04/13 14:17, Henner Gratz wrote:
> > Try installing libacl1-dev or libacl-devel
>
> I think that you either need ACL support adding to your filesystem in
> fstab or you need to find the openindiana variant of libacl-devel and
> re-compile or possibly both.

Currently the Samba 4.0 AD DC is hard-coded to use only a POSIX ACL
based filesystem. OpenIndiana supports this, but you won't be able to
deploy this on ZFS, which uses NFSv4 ACLs.

Also, be very aware of:

https://www.illumos.org/issues/3691 as this 16 group bug will severely
hobble any Samba installation on OpenIndiana until fixed. (And was
totally insane to chase down).

Andrew Bartlett

--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org