[Samba] Change user SID on Samba 4.1
Daniel Carrasco Marín
pdbedit -U newSID -u user
pdbedit -u user -U newSID
pdbedit --'user SID'=newSID -u user
but it shows the user infor without change anything.
Thanks!!
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Andrew Bartlett
> Hi, Is there any way to change the SID of an user on Samba 4.1?. I've tried:
>
> pdbedit -U newSID -u user
> pdbedit -u user -U newSID
> pdbedit --'user SID'=newSID -u user
>
> but it shows the user infor without change anything.
Changing a user's sid is a really bad idea, so in the AD DC (at least)
is is made quite difficult.
In particular, it is critical that it remain unique, and be removed from
the RID pool. When we do a classicupgrade, we take care to ensure all
RID pools start above the users we import. That is really the only time
it is safe to force a RID.
Why do you need to change it?
--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba
Daniel Carrasco Marín
new AD (for now works perfect). I want to keep the same SID of the old AD
to avoid to move all users profiles.
Greetings!!
Rowland Penny
Never used it myself, but there is the provision option
'--domain-sid=SID' . I assume that you can use this to set the domain
SID when you provision a new domain.
Rowland
Daniel Carrasco Marín
change the domain, then the Domain SID must be different. Anyway is not
hard, i only have to move the user profile on domain change, but of course
is faster if i don't need to do it.
Greetings!!
Marc Muehlfeld
> Never used it myself, but there is the provision option
> '--domain-sid=SID' . I assume that you can use this to set the domain
> SID when you provision a new domain.
getting new RIDs, what make them different, if they are linked
somewhere. And keeping the RIDs still require to keep them out of the
RID pool. See Andrews mail.
Regards,
Marc
Rowland Penny
> Am 28.04.2015 um 13:58 schrieb Rowland Penny:
>> Never used it myself, but there is the provision option
>> '--domain-sid=SID' . I assume that you can use this to set the domain
>> SID when you provision a new domain.
>
>
> This won't help, because it just keep the domain SID and users still
> getting new RIDs, what make them different, if they are linked
> somewhere. And keeping the RIDs still require to keep them out of the
> RID pool. See Andrews mail.
>
>
> Regards,
> Marc
Rowland
Andrey Repin
>>> Hi, Is there any way to change the SID of an user on Samba 4.1?. I've
>>> tried:
>>>
>>> pdbedit -U newSID -u user
>>> pdbedit -u user -U newSID
>>> pdbedit --'user SID'=newSID -u user
>>>
>>> but it shows the user infor without change anything.
>>
>> Changing a user's sid is a really bad idea, so in the AD DC (at least)
>> is is made quite difficult.
> new AD (for now works perfect). I want to keep the same SID of the old AD
> to avoid to move all users profiles.
So far, I haven't seen anything that couldn't be solved with a little thinking
and a good deal of creativity.
P.S.
I would also appreciate, if you don't top-post.
Putting answer above question makes messages unnecessarily hard to read and
understand.
--
With best regards,
Andrey Repin
Tuesday, April 28, 2015 22:33:57
Sorry for my terrible english...
Daniel Carrasco Marín
Sorry, my Gmail is configured to top-post by default.
My problem with upgrades was with member servers. The upgrade process was
fine and I can join the AD with any Windows machine, but when I try to join
that AD with a Linux machine then it fails. I've created a new AD with same
versions and configurations and I can join that AD with same servers that
fails with upgraded AD.
Greetings!!
Marc Muehlfeld
Am 28.04.2015 um 21:58 schrieb Daniel Carrasco Marín:
> My problem with upgrades was with member servers. The upgrade process was
> fine and I can join the AD with any Windows machine, but when I try to join
> that AD with a Linux machine then it fails. I've created a new AD with same
> versions and configurations and I can join that AD with same servers that
> fails with upgraded AD.
How do you join the Linux machines? And what was the problem/error?
Regards,
Marc
Daniel Carrasco Marín
> Hello Daniel,
>
> Am 28.04.2015 um 21:58 schrieb Daniel Carrasco Marín:
>
>> My problem with upgrades was with member servers. The upgrade process was
>> fine and I can join the AD with any Windows machine, but when I try to
>> join
>> that AD with a Linux machine then it fails. I've created a new AD with
>> same
>> versions and configurations and I can join that AD with same servers that
>> fails with upgraded AD.
>>
>
>
> How do you join the Linux machines? And what was the problem/error?
>
>
> Regards,
> Marc
>
>
I don't know if you have some mails from list called "I can't join the new
AD server with Samba4". Here's where i explain my problem.
Greetings!!
Steve Ankeny
> 2015-04-28 22:25 GMT+02:00 Marc Muehlfeld <mmueh...@samba.org>:
>
>> Hello Daniel,
>>
>> Am 28.04.2015 um 21:58 schrieb Daniel Carrasco Marín:
>>
>>> My problem with upgrades was with member servers. The upgrade process was
>>> fine and I can join the AD with any Windows machine, but when I try to
>>> join
>>> that AD with a Linux machine then it fails. I've created a new AD with
>>> same
>>> versions and configurations and I can join that AD with same servers that
>>> fails with upgraded AD.
>>>
>>
>> How do you join the Linux machines? And what was the problem/error?
>>
>>
>> Regards,
>> Marc
>>
>>
> I don't know if you have some mails from list called "I can't join the new
> AD server with Samba4". Here's where i explain my problem.
>
> Greetings!!
https://lists.samba.org/archive/samba/2015-April/191269.html
Andrey Repin
> My problem with upgrades was with member servers. The upgrade process was
> fine and I can join the AD with any Windows machine, but when I try to join
> that AD with a Linux machine then it fails. I've created a new AD with same
> versions and configurations and I can join that AD with same servers that
> fails with upgraded AD.
Please make sure you followed instructions in
https://wiki.samba.org/index.php/Setup_a_Samba_AD_Member_Server and that your
Samba and Kerberos client configuration on a member server is correct.
Post contents of /etc/krb5.conf and the results of `samba-tool testparm` if
you did not manage to join the domain despite all your attempts.
--
With best regards,
Andrey Repin
Sorry for my terrible english...
Rowland Penny
> On 04/28/2015 04:37 PM, Daniel Carrasco Marín wrote:
>> 2015-04-28 22:25 GMT+02:00 Marc Muehlfeld <mmueh...@samba.org>:
>>
>>> Hello Daniel,
>>>
>>> Am 28.04.2015 um 21:58 schrieb Daniel Carrasco Marín:
>>>
>>>> process was
>>>> fine and I can join the AD with any Windows machine, but when I try to
>>>> join
>>>> that AD with a Linux machine then it fails. I've created a new AD with
>>>> same
>>>> versions and configurations and I can join that AD with same
>>>> servers that
>>>> fails with upgraded AD.
>>>>
>>>
>>>
>>>
>>> Regards,
>>> Marc
>>>
>>>
>> I don't know if you have some mails from list called "I can't join
>> the new
>> AD server with Samba4". Here's where i explain my problem.
>>
>> Greetings!!
> Looks like the thread starts here --
>
> https://lists.samba.org/archive/samba/2015-April/191269.html
>
>
It actually starts a couple of posts earlier, but you can ignore them,
the OP posted wrong info. Everything seemed to be OK, but he says that
he cannot join a member server to the domain, for what appears to be an
authentication problem for Administrator.
See if you can see anything I missed, or suggest anything else the OP
can try.
Rowland
Andrey Repin
>> Looks like the thread starts here --
>>
>> https://lists.samba.org/archive/samba/2015-April/191269.html
>>
>>
> It actually starts a couple of posts earlier, but you can ignore them,
> the OP posted wrong info. Everything seemed to be OK, but he says that
> he cannot join a member server to the domain, for what appears to be an
> authentication problem for Administrator.
'Domain Admins' group.
> See if you can see anything I missed, or suggest anything else the OP
> can try.
With best regards,
Andrey Repin
Sorry for my terrible english...
Daniel Carrasco Marín
> Greetings, Rowland Penny!
>
> >> Looks like the thread starts here --
> >>
> >> https://lists.samba.org/archive/samba/2015-April/191269.html
> >>
> >>
>
> > It actually starts a couple of posts earlier, but you can ignore them,
> > the OP posted wrong info. Everything seemed to be OK, but he says that
> > he cannot join a member server to the domain, for what appears to be an
> > authentication problem for Administrator.
>
> If that is indeed a problem, I would suggest trying another member of
> 'Domain Admins' group.
>
Tomorrow i will try to migrate again the old domain. Maybe i'll try to
compile the latest version or sernet packages instead the 4.1 of Wheezy
Backports.
Greetings!!
Daniel Carrasco Marín
>
>
> 2015-04-29 0:11 GMT+02:00 Andrey Repin <anrd...@yandex.ru>:
>
>> Greetings, Rowland Penny!
>>
>> >> Looks like the thread starts here --
>> >>
>> >> https://lists.samba.org/archive/samba/2015-April/191269.html
>> >>
>> >>
>>
>> > It actually starts a couple of posts earlier, but you can ignore them,
>> > the OP posted wrong info. Everything seemed to be OK, but he says that
>> > he cannot join a member server to the domain, for what appears to be an
>> > authentication problem for Administrator.
>>
>> If that is indeed a problem, I would suggest trying another member of
>> 'Domain Admins' group.
>>
>
> Tried, but it fails too.
> Tomorrow i will try to migrate again the old domain. Maybe i'll try to
> compile the latest version or sernet packages instead the 4.1 of Wheezy
> Backports.
>
> Greetings!!
>
Impossible... I've tried with Sernet packages and compiling the latest
version from git and I can't make it work. I've followed the full upgrade
manual from the wiki two times and in both versions I've got an error
"NT_STATUS_OBJECT_NAME_NOT_FOUND" when i try to run the "smbclient -L
localhost -U%" command to check if works (at least with wheezy backports
v4.1 this works). Finally I preffer to still with the new working domain
instead keep trying to upgrade the old domain. Maybe is damaged or have any
wrong configurations and the best way is to create a new clean domain.
Thanks anyway for your help.
Andrew Bartlett
There really isn't much difference between a 'new' domain and your old
domain. That is, what we do at the start of the classicupgrade is
provision a new domain, with the correct name and SID, then add the
users. So I really think you should try and understand what the issue
actually is. You will need to post the logs, level 10 if need be, of
the server, and the client, to get any useful assistance.
Andrew Bartlett
--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba
Daniel Carrasco Marín
users/groups, some GPO and some services vinculed to that AD, and i don't
want to change all again. Even I can migrate the user computers gradually
because the actual services works with new domain without change anything.
Thanks again and greetings!!