RE: samba help

> I'm trying to advertise shares from a RHEL3 box to an m$ domain. > > I gather one must first get the box to join the domain. The account

1) I do join my nix boxes to the AD because I want single sign on and
have need for basic user group permission sets. However if you want read
or write to the world or if you don't mind managing multiple
authentication schemes or if you get you AD to be subservient to you
nix's then you do not need to do this.
    a. I use straight up Kerberos and the account you use to proxy
the tickets must have administrative rights or you must set up an
account with access to authenticate to and read all accounts in the AD
node in question.  I personally use the default Admin account because I
deal with the Windows SBS server and it is just to funky to mess with.
Also, as we all know, I am incredibly cavalier.
    b. You must change the password of the account on the windows
server at least once or else AD will not issue you a ticket via krb.  It
is a security "feature" that is only reasonably well documented by MS.
    c. I use winbind to get all of my user and group listings from
Windows.  I have seen it work with LDAP but never were and AD server was
not the primary LDAP server.  Even then you have to have pretty open
trust relationships pushed through the forest or else it chokes up on
you.  This is just my experience, your mileage may very.
    d. If you are using winbind and samba, do not use any of the
GUI's to join the server to the domain (I am sure this is not a problem
for you ;) as you must issue a clean ADS join command or else it will
join like some legacy win98 system and your domain permissions will not
work correctly

This message is part of the following thread:
	the complete thread tree sorted by date
	Jeremy C. Reed at
	Dan Lund at