Samba 3.0.0 Released

Get the doc! by Karamchand · 2003-09-25 00:42 · Score: 4, Informative

..at O'Reilly's Safari Bookshelf!

Congrats to the Samba Team!

Re:Get the doc! by Rudeboy777 · 2003-09-25 04:28 · Score: 2, Interesting

Is anyone here privy to any insider O'Reilly information regarding a release date of Using Samba, 3rd ed.? I was hoping it would follow closely on the tails of Samba 3.0.0's release, and I'm sure many of the other geeks here are interested in buying it as well.

--
From hell's heart I fstab at /dev/hdc

I did not have relations with that server by Anonymous Coward · 2003-09-25 00:43 · Score: 5, Funny

now my linux box has to deny having a relationship the that windows server next door.

Re:I did not have relations with that server by IAR80 · 2003-09-25 02:18 · Score: 2, Funny

Your linux server is in denial. ;)

--
http://ebgp.net/ccc/

Re:Becareful about using this by Brahmastra · 2003-09-25 00:43 · Score: 4, Insightful

There are exploits in every product, opensource or not. It's just a matter of you taking necessary precautions like using a decent firewall and patching regularly.

wonderful! by borgdows · 2003-09-25 00:44 · Score: 5, Funny

...and possibilities to form NT4 trust relationships.

but is it wise to trust a NT4 server?

That's nothing !! by Anonymous Coward · 2003-09-25 00:45 · Score: 5, Funny

We've had Samba in Brazil for centuries...

Amazing how the USA thinks they are ahead of everyone else... ;)

Re:That's nothing !! by glgraca · 2003-09-25 02:52 · Score: 2, Funny

But it's your money that has
men with wigs on it.

Does this ver. solve the WinXP security "features" by HiroProtagonist · 2003-09-25 00:45 · Score: 5, Interesting

I was recently banging my head against the wall when attempting to use a Samba share on an XP box that had worked fine on all my Win2K boxes.

Days & days of hacking the config and attempting to get it to work to no avail. Finally I find that it appears that WinXP has some security "features" added into it that break the use of samaba shares.

This frustration I felt has actually pushed me one more step towards switching all of our machines over to Linux. It may not happen tomorrow, but it will happen.

--
--Remove chicken to e-mail

Best new features by linuxkrn · 2003-09-25 00:45 · Score: 5, Interesting

The author missed one of the bigger points that they have working now. BDC! You can finally, if it works - I haven't tried it, have automated fail over without hacking some scripts and running a few PDCs. Very COOL!

That and it says it will work "out of the box" with Windows Server 2003. I wonder if that means they fixed the "trust" issue with Windows XP trying to auth with it for login without reg hacks....

Re:Best new features by gregarican · 2003-09-25 00:49 · Score: 2, Informative

The BDC functionality has been in Samba for awhile now. I recall working with a beta test of that back before the Y2K. There's a decent amount of tweaking and fine-tuning to be done to get it to work, but once it works it usually works well. Companies who still think they have to run Windoze on the client end due to the application suite folks are supposedly so used to can still migrate the server end to Linux, potentially without anyone noticing any difference.
Re:Best new features by SushiFugu · 2003-09-25 01:22 · Score: 2, Funny

Finally! I was talking with a friend about this just the other day -- the only big thing that Samba is lacking is a working Bullet Drop Compensator!

It really helps when aiming files across long distances :)
Re:Best new features by XSforMe · 2003-09-25 02:50 · Score: 5, Informative

Actually, I think the most important feature is this:
10) Support for migrating from a Windows NT 4.0 domain to a Samba domain and maintaining user, group and domain SIDs.
Why? NT Server is coming to the end of support period (Dec 2003). There are still LOTS of NT4 server out there. Last time I checked, you had to recreate ALL of the groups and users whenever you migrated them from NT4 to any other PDC (there is a little support for automating this activity, but it just saves you from retyping the users and groups names).

--
My other OS is the MCP!
Re:Best new features by Jeremy+Allison+-+Sam · 2003-09-25 05:37 · Score: 2, Interesting

It means we do SMB signing by default now :-).

Jeremy Allison,
Samba Team.
Re:Best new features by propellor_head · 2003-09-25 11:10 · Score: 2, Informative

It is relatively easy to migrate from NT4 to an AD domaing using ADMT.

Vulnerable? by gregarican · 2003-09-25 00:46 · Score: 5, Interesting

Serious question here, not flamebait. Does Samba use similar RPC methods to thje Windoze NT family? If so are there potential exploits? I'm not sure. I've used Samba and Mars_NWE (a Linux emulator of a Novell Netware server) for years now but never thought of potential parallel security holes. I doubt that the code could be that similar, but am curious. I recall back in the day where anonymous RPC sessions on Windoze NT could totally give admin access through that simple sechole.exe exploit.

Aside from that concern I can personally say that Samba rules. I have benchmarked it as being a faster file/print server compared to Windoze on identical hardware. A Linux box that can act as a domain controller, and now participate in cross-domain trust relationships and use AD is a helpful tool for weaning folks away from Micro$loth.

Re:Vulnerable? by gregarican · 2003-09-25 00:59 · Score: 5, Interesting

Here is a footnote of the other side of the coin. I recall back around 1999 working with Samba 2.0.something-or-other. Our company had many sites but centralized Windoze NT domain administration at CHQ. I was interested in trying to sneak a Samba server onto the domain.
Typically in the Windoze NT model in order to add a server to the domain you have to have admin rights. I recall the Samba box added itself to the domain without any authentication necessary. It was funny when an NT admin from CHQ called me to ask me why our site had this new server showing up. He couldn't browse any of the shares (only local Linux accounts were defined in the Samba user file and /etc/passwd file) and was pissed.
I apologized and proceeded to take the box off the network, but found it funny that no authentication was necessary. With all of the inherent flaws in Microsoft's security models I would bet that a Samba box could potentially wreak havok on a pre-Windows 2003 network!
Re:Vulnerable? by davecb · 2003-09-25 01:01 · Score: 5, Informative

Yes, the SMB protocol does use all the NT RPCs, and the Samba team usually find and fix numerous security holes in it with each new release. And report them to MS, and code Samba so it doesn't accidentally trigger NT security problems.
They're really very professional, and a pleasure to work with.
--dave (the Using Samba 3rd author) c-b

--
davecb@spamcop.net
Re:Vulnerable? by Large+Green+Mallard · 2003-09-25 01:27 · Score: 3, Informative

It's a fair enough question.. one that someone asked Tridge at LCA2003.

Basically no.

Buffer overflows in RPC are due to server programming, and since both are entirely different server codebases, they don't share vulnerabilities. But the Samba team have found many of these RPC bugs with windows ;)
Re:Vulnerable? by requim · 2003-09-25 04:25 · Score: 4, Interesting

Sounds to me like what you are describing is just the SAMBA server showing up in the browse list either via a WINS or NETBIOS name resolution. You cannot in fact join an NT domain without administrative rights to grant the machine an account in the domain, whether it be created on the server prior to joining the machine, or in the process of joing the machine to the domain from the joining machine.

This isn't to say that there are not other ways in which a unix box can wreak havoc on an NT/200x network...
Re:Vulnerable? by gregarican · 2003-09-25 04:42 · Score: 3, Interesting

I hear what you are saying, but I mean that the Samba box was on the Server Manager list as a member server. If I would've tried to add an NT Workstation or Server to the domain in this capacity the action wouldn't failed because I wouldn't have known the admin logon to authenticate. AFAIK you can't add another node to the domain in this manner without admin rights. But the Linux box popped right in without a problem.
Re:Vulnerable? by Skweetis · 2003-09-25 05:32 · Score: 2

This reminds me of one of the first times I experimented with Samba. I was using 2.0.something as well. We had a Win9x network at the time. I configured Samba as a client without really reading much of the documentation, and installed one of the GUI clients to play (tksamba, maybe? I don't really remember). I was browsing randomly around the network to test, and discovered I could connect to all the shares on the network without authentication (and there were passwords on most of those shares).
It's amazing how much of the Windows "security" model depends on the client behaving exactly as expected!
Re:Vulnerable? by gregarican · 2003-09-25 05:48 · Score: 2

Exactly. Combining NT security from 5+ years ago with a misbehaving client and things weren't as they should've been. Some other guy on this thread posted that it just *cannot* happen, but I can tell you it did back then. Our CHQ NT "gurus" were going out of their skulls trying to figure out what was happening.
Keeping in mind that back then you could just connect through to the RPC$ share anonymously or attach to the debugger process and immediately get admin rights using a sechole.exe program freely available on the Internet. You could also perform an Internet search for "Microsoft Windows NT 4.0 Option Pack provides enhanced Web, application, and communication" and immediately come up with hundreds of newly-installed (read not locked down) IIS boxes. I just found one right now.
You hit the nail on the head. Combine a misbehaving client with a poor security model and the results could be interesting.
Re:Vulnerable? by requim · 2003-09-25 08:00 · Score: 5, Interesting

I would like to test the scenario for the answer I am about to give just to validate my thinking, but I will give it to you anyway. My understanding of how the Server Manager lists the machines is by how the machine is configured, not necessarily as a member of any particular domain/workgroup/etc. It would appear that it lists the machines that are configured to set their domain/workgroup name via netbios in the same groupings (ie if you have a workgroup named SERVERS and and a domain named SERVERS) machines from both the workgroup and domain will appear in the same listing (if using Explorer or some other tree listing. The NETBIOS protocol uses/stores the machine type used for Domain Master Browser functions for election purposes in specific packets. These packets use a code to determine what type of function/server the machine is setup, so in the Browser elections that take place in each subnet, the machine with the highest setting wins (ie PDC > BDC > Member Server > Workstation (it's really a little bit more complicated, but this should suffice.)).

This being the case, I would have to interpret the samba server appearing in the Server Manager as a result of the code passed in the netbios protocol and it being used to determine machine times when listing the (PDC, BDC, Member Server, etc) I would also imagine that if you were to setup a second NT/200x server as a PDC using the same Domain Name, that that machine would also appear in the Browse List and have a similar effect, though in reality the two domains would not be related except by name (the SID's would be different which would cause many problems that I would rather not go into.).

Re:Becareful about using this by Jugalator · 2003-09-25 00:47 · Score: 3, Funny

as we've seen so many times this week,

opensource != secure

by any stretch of the imagination, in fact there are probably numerous untold exploits available for this software. Its just a matter of time, as with any opensource product.

Yeah, so let's use the alternative.

Windows servers.

Those are more secure I heard. :-P

--
Beware: In C++, your friends can see your privates!

Re:Does this ver. solve the WinXP security "featur by Jellybob · 2003-09-25 00:49 · Score: 4, Informative

I'm not entirely sure what you're talking about. I'm running Samba at home, and my XP boxes can pick up the shares on it just fine.

You may need to add smbpasswd entries for the machines users, but other than that, it should be ok.

Re:Becareful about using this by davejenkins · 2003-09-25 00:53 · Score: 5, Insightful

opensource != secure

Thanks Egan, good safety tip.

by any stretch of the imagination, in fact there are probably numerous untold exploits available for this software. Its just a matter of time, as with any opensource product.

And let`s also remember that _because_ it is open source, we now have thousands of developers who can view the code, find potential exploits, and then propose patches, QUICKLY and WITHOUT BIAS. Unfortunately, for patches to the same styled exploits that would exist in a closed source networking protocol, we would need to depend on a small team of developers under a common management structure (one pointy haired boss = single point of failure).

Open Source != secure
Open Source == better method toward security

--

davejenkins.com |

Re:SMB/OSX question by Anonymous Coward · 2003-09-25 00:53 · Score: 2, Informative

File Locking. You can tune Samba to fix this.

quite impressive by Dreadlord · 2003-09-25 01:02 · Score: 5, Informative

I quite happy with this new release, what I like the most about it is the new Active Directory support, I have been waiting for it since I started to use it in my homenetwork. Another impressive feature is UNICODE support (isn't mentioned in the post), one of my family members needed it badly to deal with non-latin charsets.
And the new "get" command which is similar to windows "net" is useful too.
Keep up the great work SAMBA team!

--
The IT section color scheme sucks.

Re:Does this ver. solve the WinXP security "featur by Large+Green+Mallard · 2003-09-25 01:03 · Score: 5, Informative

Samba 2.2.x + XP + SP1 requires some tweaking to do domain logons for XP clients.

Basic file sharing is fine, but if you're using Samba as a domain controller, you need to set a SignOrSeal reg value off to allow domain logons and also unset a "check profile ownership acls" setting which was introduced by SP1.

-- Someone who uses Samba 2.2.x as domain controller for several hundred XP boxes :)

Re:Does this ver. solve the WinXP security "featur by myz24 · 2003-09-25 01:05 · Score: 2, Informative

Sounds to me like signorseal. You want to edit the following entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ic es\Netlogon\Parameters\requiresignorseal and set it to 0. Reboot and your XP machines will now be able to logon to your samba domain.

Re:well by MrPink2U · 2003-09-25 01:07 · Score: 2, Insightful

That's only because there wasn't a "Very Intersting" selection...

Re:Becareful about using this by weave · 2003-09-25 01:09 · Score: 3, Interesting

in fact there are probably numerous untold exploits available for this software. Its just a matter of time, as with any opensource product.

Didn't quite a few of the Microsoft hotfixes credit the Samba team for finding the weaknesses and bringing it to Microsoft's attention?

Do you mean 'oplocks'? by Anonymous Coward · 2003-09-25 01:10 · Score: 2, Informative

I read a few years ago that Microsoft deliberatly broke the way they handle oplocks in such a way that it looked like a Samba problem.

If you Google "Microsoft SAMBA oplock" you'll see a lot of hits, some of which went away when oplocks were turned off in Samba.

Re:Do you mean 'oplocks'? by Jeremy+Allison+-+Sam · 2003-09-25 05:33 · Score: 5, Insightful

No, they never did this. Oplocks are problematic in that
Windows boxes tend not to respond to oplock break requests
if there are *any* network problems. Most people have cheap
switches/hubs etc. For instance on my home network I can
only reliably ssh transfer a 100mb file over one of my
switches (the gigabit one), the 100Mbit switch will
consistantly corrupt the tcp stream causing ssh to abort.

oplocks need *reliable* networking hardware.

Jeremy Allison,
Samba Team.

rh9 samba lockup by Anonymous Coward · 2003-09-25 01:12 · Score: 5, Informative

I've experienced numerous random lockups using samba v3. The mount point would just hang requiring a samba restart.

After searching for a while, I found that there's a bug in Redhat 9's new thread library which samba somehow triggers. There's a workaround on the net, look for it and avoid hassling the samba team - they're not at fault here!

Slightly OT - Samba Clustering by jACL · 2003-09-25 01:16 · Score: 2, Interesting

We've been waiting for this release as the version to start replacing Windows servers with. We'd like to build the farm clustered, however. From our research, it looks like clustering Samba can only be done with Mission Critical Linux' products. Anyone seen anything else out there that can also do the job?

--
"It remains to be seen if the human brain is powerful enough to solve the problems it has created." Dr. Richard Wallace

Re:Does this ver. solve the WinXP security "featur by HiroProtagonist · 2003-09-25 01:18 · Score: 2, Insightful

Now that's something I haven't seen before.

"unset a 'check profile ownership acls'"

I'll have to look into that.

Thanks!

--
--Remove chicken to e-mail

Flamebait? by HiroProtagonist · 2003-09-25 01:22 · Score: 2, Insightful

I imagine the flamebait was for:

"This frustration I felt has actually pushed me one more step towards switching all of our machines over to Linux. It may not happen tomorrow, but it will happen"

It's not flamebait people, it's actualy how I feel. Other nice /.'s have been attempting to help me solve the problem instead of modding me out of existence. :(

--
--Remove chicken to e-mail

Re:Does this ver. solve the WinXP security "featur by Large+Green+Mallard · 2003-09-25 01:23 · Score: 3, Informative

It's accessable from the MMC on each client machine, or alternatively if you have a recent enough samba, there's a "profile acls = yes" option you can set in the smb.conf

Open source top 5 best contributions by MagicMerlin · 2003-09-25 01:25 · Score: 2, Interesting

Linux/FreeBSD
Apache
Gcc
PostgreSQL
Samba

In that order. Thank you.

Merlin

Re:Open source top 5 best contributions by xchino · 2003-09-25 06:42 · Score: 3, Insightful

How are you going to compile apache without GCC? I think you should reverse that order..

--
Everyone is entitled to their own opinion. It's just that yours is stupid.

Single Sign-On by CromeDome · 2003-09-25 01:28 · Score: 2, Interesting

The promise of single sign-on for the various servers I have around here seems great :) While I know how to get Windows clients to authenticate against a Samba server, and also how to get *nix boxes to connect to a Samba server, is there a way to replace the traditional *nix login/authentication methods and replace it with Samba? Our domain is predominantly NT/2k, with a small scattering of Linux and FreeBSD boxes. Would be great if users could change their NT password and still be able to log in to our *nix boxes for e-mail and such.

Re:Single Sign-On by fodder69 · 2003-09-25 01:44 · Score: 3, Informative

Yes, use pam and the winbind. I can ssh to my samba box and authenticate against Active Directory. There are how tos out there, here are a few links I used. http://www.netadmintools.com/part172.html http://www.flatmtn.com/computer/Linux-Samba3.html http://us1.samba.org/samba/docs/man/winbind.html
Re:Single Sign-On by pirhana · 2003-09-25 01:57 · Score: 3, Informative

Why dont you configure samba as PDC and use LDAP for all the authentication purpose?. I found it a robust solution. The beuty is that you can use it as a back end for any services/servers which requires authentication and can act as a truly single source of authentication. All the requirements you mentioned is possible with this.

--
http://www.nasirudheen.blogspot/

Re:Becareful about using this by RevMike · 2003-09-25 01:30 · Score: 3, Insightful

opensource != secure

Very true.

The advantage of opensource is that you can examine the internals yourself, and fix it yourself.

The more sophisticated the user, the more valuable opensource is. If you're a low level admin who can't do anything more than apply pre-canned patches, opensource may be cheaper but it isn't defacto better. If you can participate in the patch process by either writing your own patches or applying patches from the developers directly or from other users, rather than waiting for a vendor, you can be way ahead of the game.

Multiple workgroups? by sjbe · 2003-09-25 01:30 · Score: 2, Interesting

Can anyone tell me if 3.0 includes an easier way to get computers in more than one workgroup to connect? I know you can do it with by running an extra instance of samba but it's awkward. Any better ideas?

I've got a bunch of laptops that have to connect to different workgroups but I'd like to have them all connect to my samba server. But they have different workgroups and that cannot easily be changed. Samba doesn't deal well with this out of the box, though it works pretty well under Windows proper.

Re:Does this ver. solve the WinXP security "featur by Anonymous Coward · 2003-09-25 01:35 · Score: 2, Insightful

I had a lot of trouble getting xp to read a public samba share with no password - 2k worked fine, but for xp I needed to do (in the command prompt):

net use t: \\linux-box\samba-share * /USER:

(and just press enter for the password)

This maps it to drive t:

Re:Does this ver. solve the WinXP security "featur by FyRE666 · 2003-09-25 01:36 · Score: 2, Insightful

I call bullshit here. I regularly set up Linux Samba servers (file and print) that work fine with Win98, NT, 2K and XP machines. Both standalone and as domain members. I've used both the normal smb password file and LDAP passwords for authentication, and it all works faultlessly.

In fact I'm sitting at an XP machine right now that's mounting from 3 different Samba servers...

--
Code, Hardware, stuff like that.

It's called winbind by buchanmilne · 2003-09-25 01:39 · Score: 3, Informative

You could do this with 2.2.8a if your AD server allowed anonymous authentication. If not, you need 3.0.0.

See how we do it on Mandrake (since 9.0).

I run a Mandrake 8.2 box in production as a mail server in an AD domain, all authentication is via winbind.

Samba 3, Squid and NTLM Authentication - a change! by OneNonly · 2003-09-25 01:50 · Score: 5, Informative

One thing that does change with Samba 3 is the way that you need to configure Squid to use NTLM authentication...

If you upgrade and try using the old authenticators built with squid, you'll be stuck. Samba 3 comes with it's own helper utility (ntlm_auth) to work with other applications such as Squid.

I have written a Samba 3 / Squid Walkthrough that takes users step by step through getting this going.

Find out about it here:
http://itmanagers.net/article-4--0-0.html

Re:How many hidden root exploits in this version? by Tenareth · 2003-09-25 02:06 · Score: 2, Interesting

I'm sure a lot less than in W2K3.

2 so far?

--
This sig is the express property of someone.

Re:NT4 support? Err , what about 2000, XP? by EvilTwinSkippy · 2003-09-25 02:18 · Score: 2, Insightful

In a word yes.

That's exactly what I did 3 years ago when M$ started playing games with Active Directory, and I still had a network full of 98 and NT boxes. We set up a new domain, and moved all the file and print services to it.

Now that we have aged out all of the decrepid hardware and standardized on 2k, ActiveDirectory is a good idea. But that is 3 years, and a $100,000 in hardware later.

Having trust support would have saved me from having to hike to all the machines and add them to the new domain. I can imagine with NT entering M$'s discard pile, there are quite a few NT shops that are looking for a drop in replacement.

Enter the dragon...

--
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming

Re:Does this ver. solve the WinXP security "featur by smooc · 2003-09-25 02:21 · Score: 2, Informative

nope, SignOrSeal is supported now!

--
- In Memoriam: Jeroen de Bruin (1972-2004), bye bro

Re:Does this ver. solve the WinXP security "featur by caseih · 2003-09-25 02:28 · Score: 2, Informative

This is a well-documented problem with XP and 2000 when service pack 4 is installed. Besides setting the registry entry "RequireSignOrSeal" to "0," you must run the "mmc" program, add a "Group Policy" Snap-in, then in there find and option that says something about ignore permissions on roaming profile. Set that to "enabled." I'm not yet at work, but when I get there, I'll get the exact key name and post it here. A quick search of google reveals it's not terribly obvious, although I found this before.

Re:Does this ver. solve the WinXP security "featur by TheMayor · 2003-09-25 02:34 · Score: 5, Informative

There is an easy fix to this for XP:

Settings -> Control Panel -> Admin Tools -> Local Security Policy

Look under Local Policies, then Security Options.

Look for "Domain Member: Digitally encrypt or sign secured channel (always)" and set it to DISABLED.

That should solve some of your problems.

XP only wants to trust other Windows machines when working in a domain environment.

Re:Becareful about using this by Trolling4Dollars · 2003-09-25 02:45 · Score: 2, Informative

The real key is that where there is money involved (ie. a company stands to lose money on good bug hunting and peer review) security is always going to come second to last. With Microsoft, here's the hierarchy:

1. Profit!
2. PR/Spin
3. ???
4. Satisfy customers just enough to keep them
5. Everything else (ie. security, stability, etc...)

Since a lot of OSS projects aren't made in the name of profit, the hierarchy is more like this:

1. Write something useful/cool
2. Share it with everyone and get peer review
3. Patch holes and bugs
4. Wind up with excellent quality software (Emacs, GNU, etc..)
5. Rinse and repeat

With either approach, you have to keep in mind that the cycles are unending because the bars are always being raised. But, which bar is payed more attention varies based on the end goal. For proprietary/non-free software, the only goal is to write software to make money. For free software, the primary goal is to write good software for the sake of writing good software. This approach angers the capitalists because it potentially threatens their system. And in the long run, Emacs is still going to be around long after MS Notepad is gone. Just like classical music has more lasting value than Eminem or Kidd Rock. Someday 25 years from now you can ask a 10 year old who Kidd Rock is, and they'll say, "Who"? But if you ask the same 10 year old who Beethoven is, they'll probably have heard of him.

--
Un-news

Re:Does this ver. solve the WinXP security "featur by batkiwi · 2003-09-25 02:49 · Score: 3, Informative

XP Home does not allow logon to domains, so there's no problem to fix.

you're worried about migrating users, of course by flicman · 2003-09-25 03:05 · Score: 2, Insightful

Of course you're worried about migrating users. If Samba gets easier to use, you'll find people migrating from the biggest user base on the planet - Windows.

And worry about alienating Linux users? Please, where are you going to go to get something better? On a Mac? I know you're not going to stop using Linux (maybe Samba, but who cares, I guess) and go to Windows because your system is operating more and more like Windows.

Unless you're losing functionality, cheer the changes. As more users (like me) migrate to open source, your exclusive club will get better and better. I'll tell you one thing - if Samba gets easier to figure out, I'll certainly start using it to get my systems connected to a single file server.

No. by abulafia · 2003-09-25 03:32 · Score: 3, Funny

It means samba can function as your Bondage and Discipline Cop.

What happens is that if you fail to listen to your Primary Domain Controller, the Bondage and Discipline Cop steps in to beat and humiliate you until you submit creditentials to the proper authorities. Usually, this happens when you're standing in front of many people and attempting to get at Powerpoint slides you left on your client machine.

--
I forget what 8 was for.

Egads a new holy war... by EvilTwinSkippy · 2003-09-25 03:42 · Score: 3, Funny

First it was VI vs. Emacs

Then, Gnome Vs. KDE

Now its MySQL Vs. Postgres

At least we are evolving from text editors and eye-candy to relational databases.

--
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming

Looks like a great leap in the right direction... by NtroP · 2003-09-25 04:23 · Score: 2, Interesting

But...

One of the stumbling blocks I've run into in the past (I am no Samba guru) is dealing with the occasionally complex, nested groupings, permisions, and far more detailed ACLs than the ext2-3 filesystems provide. I know that there are some filesystems (and what? overlays?) that can be applied to ext3 which allow more than OWNER-GROUP-WORLD permissions.

How does this improved AD integration tie in with the various exended-ACL solutions?

I would LOVE to yank most or all of our windows fileservers and replace them with Linux boxes. The increased security and protection from viruses, etc. would be great. But with thousands of users in hundreds of departments in our domain(s) needing to access some of the same resources with different permissions - I've not found a satisfactory Linux solution.

Obviously, I'm missing something. But it would be great to have an out-of-the-box solution that takes the best of NTFS (for what it's worth) and the best of journaled Linux FSs to provide a truly stable, yet flexible fileserver.

Any /.'ers have a solution that's worked for them which you'd be willing to share?

--
"terrorism" and "pedophilia" are the root passwords to the Constitution

Re:Does this ver. solve the WinXP security "featur by Jeremy+Allison+-+Sam · 2003-09-25 05:04 · Score: 3, Informative

Not any more. We implemented sign&seal for Samba 3.0.

If it doesn't work when you remove this please log
a bug at bugzilla.samba.org.

Thanks,

Jeremy Allison,
Samba Team.

Re:Does this ver. solve the WinXP security "featur by Jeremy+Allison+-+Sam · 2003-09-25 05:06 · Score: 3, Informative

It's probably the Web sharing service. Turn off the client
side on the XP box. It tries to contact a port on the Samba
server that isn't open and times out. Sorry, I can't remember
the exact instructions to turn this off (I only use Windows
under VMware to test Samba :-).

Jeremy Allison,
Samba Team.

Re:So Am I Nuts by Jeremy+Allison+-+Sam · 2003-09-25 05:40 · Score: 5, Informative

I wouldn't do it. And I write lots of the Samba code :-).
The protocol is just too complex to be sure any implementation
is safe.

Hopefully that should tell you something. It should also
tell you why we don't want it in the Linux kernel. Microsoft
put it in their kernel - I think that's a mistake.

Jeremy Allison,
Samba Team.

Re:Trust relationships by Jeremy+Allison+-+Sam · 2003-09-25 05:46 · Score: 2, Informative

Yes it works.

Jeremy Allison,
Samba Team.

Re:Couldn't resist. by Bill,+Shooter+of+Bul · 2003-09-25 09:00 · Score: 2, Funny

Someone please explain why my post was moderated as redundant. I looked at all previous posts and did not see a single overlord comment. If the joke isn't funny then it should be rated offtopic, or overated, but not redundant. Unless, maybe the moderators were saying that the joke was getting redundant. I think moderators should provide an explanation for their decisions. That way posters would learn what makes a good post good and a bad post bad.

--
Well.. maybe. Or Maybe not. But Definitely not sort of.

Re:Use XFS as your filesystem by ocelotbob · 2003-09-25 09:15 · Score: 2, Informative

ACLs aren't just limited to XFS. ext2/3 has had ACLs for years, with support being rolled into the kernel proper with 2.6.

--

Marxism is the opiate of dumbasses

68 of 252 comments (clear)