GlitchNYC.com

Samba Not Authenticating to Windows Domain?

I've been bashing my head against the keyboard for a few days at work wondering why our intranet, which is running samba to serve files and to check usernames/passwords against the Active Directory server, suddenly stopped working. I'd figured this out a few weeks back, so having it just break suddenly and not cooperate when I did the "fix" again and again was trying to say the least.

Today, I finally stumbled upon the actual culprit. There is some incompatibility between Windows 2000 SP4 SR1 and the newer builds of Samba.

If you've found this article, chances are you were running wbinfo -u and got the error "Error looking up users". If you turn the debugging level on winbind up, which I did, perhaps a bit clumsily, by editing /etc/init.d/winbind, and changing

you'll find the error NT_INSUFFICIENT_RESOURCES

Although I'm not exactly certain of the cause of this, it seems that the samba daemon is somehow confusing the SP4 SR1 windows box, which summarily closes its doors for a bit.

Luckily there's an easy fix. Simply set

in the global section of smb.conf

Link to the forum where I found this fix. Many thanks to Gerald (Jerry) Carter <jerry <at> samba.org>, for the excellent tip!

11:57 pm | permalink | /technology/linux | 0 writebacks |

Problems with Samba Authenticating to Windows 2000 Domain Controller

I've just set up our new intranet at work, and this time I was determined to get samba working better in our Windows network.

Samba lets you share files from a unix box just like you would share a folder in windows. The one hitch is that if you set this up simply, everyone you want to give access to this folder needs to be listed in your smbpasswd file. Synchronizing the passwords between this file and your windows accounts is a headache even with one user, and setting the password to something different requires the user to map the drive with a different username.

Luckily, Samba provides you with a way to ask the domain controllers on the network if a user is authenticated, and what groups they are in. Setting this up is a fairly nontrivial task, but not impossible.

There's a great howto at samba.org which will walk you through setting this up. If that works for you, congratulations.

If you find that you can't log into your samba share after going through those steps, it is quite likely that in the initial setup (before you ran into trouble and found my site through google) that an earlier connection to the domain controller left some improper accounts lying around.

At the end of the day last friday, I knew I have everything configured correctly, and it still wasn't working.

When I initially connected to the domain controller, smb.conf still had the default values for the UID range to use, which was somewhere in the 16 million range. Now that I had specified the range to be between 10000 and 20000, those leftover values were throwing a wrench in things.

After a bit of searching (read: a day of bashing my head) I finally found a solution.

HowTo fix a bad join to an NT domain where winbind is used: (lifted from this linuxquestions thread and cleaned up a bit)

Stop your samba and winbind servers

Delete secrets.tdb and smbpasswd

Add a line to smb.conf to make it easier to get the login info
rejoin the domain
Restart winbind
test to see if domain users were read
You should see a list of users from your Windows machine. This is nice, but we had this part working before.
If this information shows up without the domain, (for example Administrator instead of MYDOMAIN\Administratior, don't panic. It seems that newer versions of samba will drop the domain prefix when they are properly joined to a domain)
Now, lets see if we can get actual login information
This should show not only your local logins on the linux machine, but also from your windows domain
restart samba
Test the login from another computer

For me, I remoted back into my windows box, and accessed \\intranet\public. It let me in without even prompting for a password, because I was already properly authenticated.

Happy Sambaing!

1:05 am | permalink | /technology/linux | 0 writebacks |

Hunting a MythTV Bug

For MythTV users having trouble recording:

See more ...

6:22 pm | permalink | /technology/linux | 0 writebacks |

HowTo: Close Tabs in Firefox with a Middle Click on Linux

This simple little fix saved me a lot of headaches on Linux.

When using Firefox on windows, you open an close tabs with a simple middle click. Once you try it, you'll never go back to regular browsing again.

On Linux, Firefox inherits the default "middleclick" action from the desktop environment for all actions. When you middle-click on the tabs, instead of closing, the "contentLoadURL" action is invoked, causing mild chaos.

To make Firefox behave like it does on Win32, simply go to the advanced options page by entering "about:config" in the URL bar in Firefox.

You'll see more options than you know what to do with. Don't panic. Simply type "middle" in the "Filter" bar under your tabs. Now change middleclick.contentLoadURL to false.

That's it. The tabs should now work just as they do on Windows, closing when you middle click on them, and making your life easy!.

12:36 am | permalink | /technology/linux | 0 writebacks |

Fedora Core 2: Works for me

Many people are bashing Fedora Core 2 (the newest bastard stepchild of Red Hat 9) for having some pretty grievous errors for a full release.

As was the case with Windows ME (hey, it worked great when it didn't break! In fact, it's still running perfectly on some older machines under my watch) I'm going to go against the majority here and sing the praises of this little "community" effort.

See more ...

12:22 am | permalink | /technology/linux | 0 writebacks |

Troubleshooting Linux: Don't forget the obvious

Well I've been pulling my hair out for the past week or so trying to figure out what the heck was wrong with my little MythTV DVR box. I've been getting more and more crashes lately, which I assumed was due to some package incompatibility caused by my incessant "apt-get dist-upgrade" commands that I've been throwing at it in an attempt to keep current. I'd also had the misfortune of allowing my primary HD to fill up while installing packages, which may have corrupted my RPM database.

Last weekend, I did a full fsck (file system check) to make sure the HD was good. Everything checked out OK. Preparing for the worst, I dumped my mysql database out to the HD as an SQL file - or at least, I tried to.

Segmentation fault

See more ...

12:16 am | permalink | /technology/linux | 0 writebacks |

How to Force an Fsck on the Next Reboot

Continuing on my current run of Linux Tech pieces:

I recently needed to do a full filesystem check on my MythTV DVR box, as it was behaving strangely. Doing this from the command line is fairly hard, as you have to switch runlevels and then unmount your drives.

It's also almost impossible to do remotely, as SSH will shutdown when you switch to single user mode.

As a solution, you can reboot and force the check as it comes back online. to do this, run the following:

When it comes back up, it should be clean! That is, of course, unless it finds problems and needs user interaction. Then you're SOL. There's got to be a better way to do this.

Stolen from perturb.org

1:22 pm | permalink | /technology/linux | 0 writebacks |

Note to Self:

There's no undelete in linux.

10:43 pm | permalink | /technology/linux | 1 writebacks |

Admitting Where it Sucks

Like anything, in order for Linux to improve, especially on the desktop, I think we need to look at the areas where it NEEDS to grow in order to be better, not just everything random that's "wrong" with it.

On the desktop, Firefox is well on it's way to rivaling and even beating IE. This is especially true on windows. On Linux, it's flagging for two main reasons.

1) Fonts

I know this has been beaten to death, and you can control the font size within mozilla, but for the life of me, I can't understand why you can't change the "proportional" font. It's The main, default font that firefox uses, and all you can select is "Serif" (aka times) or "Sans-Serif" (aka arial).

See more ...

12:45 am | permalink | /technology/linux | 1 writebacks |

I had a hacker!

Well, it's official, there's been a hacker on Glitchnyc.com. I'm not certain what their intentions were, but I was able to shut down the little "watcher" rootkit they were running at least temporarlily, and had fun dissecting the program to see what it did.

See more ...

12:31 pm | permalink | /technology/linux | 0 writebacks |

The Quiet Jiminy Cricket of Open Source

There's a lot of talk in "the business" right now about open source software. Slowly, it's becoming universally understood that shared software just makes sense when it's stuff that everyone needs, especially when we all need basically the same thing. Web servers - they're pretty much all the same, databases, yup, 98% of what you need is basic, even word processors and spreadsheets are pretty much standard fare. Everyone chips in to write it once, and after a while, it just gets so good you don't remember when it didn't exist.

The other 99% of programs that people use are going to be a bit more of a challenge because they're more about user choice and comfortability than just getting a job done, and that's a big part of the reason that the real guru's don't see Linux on the desktop in the mainstream in the next year, or two, or ten.

See more ...

12:49 am | permalink | /technology/linux | 0 writebacks |

Perseverance Pays Off

Well, it's February, and I've finally figured out how to get this little VIA box working for MythTV. It was a serious pain in the ass, and there was no way I could have gotten it done by Christmas - thank god I had my main PC up and running in time, or this would have been a very delayed Christmas present.

That said, I now have to decide whether or not I want to leave my Desktop PC as the main (always on) MythTV backend server, or switch out this little guy, which runs quieter and at lower power. I'll probably be mulling that one over for at least another month.

Read on for the technical stuff

See more ...

3:27 pm | permalink | /technology/linux | 0 writebacks |

Now Computer Really Equals Frenchfry.

A few months back, my computer decided to eat my "mp3" hard drive which was also home to most of my pictures, and other creative works, alive.

I was not that happy a camper about this, but was able to recover 90% of my stuff, minus some of my photos.

Tonight, the hard drive which I had recoverd that data TO completly and unrecoverably crashed so hard that there is no salvaging anything on it. All I can hope is that I made some backups of the stuff I saved off the old disk last time. but I don't remember doing that.

This is like losing all your photo albums in a fire. You know you can replaced the house, but you can't replace the pictures.

Grrrrr.

UPDATE: I seem to have kept at least a marginally complete backup on CD and randomly scattered around my different systems & servers, so although a pain in the butt to have to do this again, I don't think I permanently lost anything huge.

4:25 am | permalink | /technology/linux | 0 writebacks |

"The Neverending Saga of That F8%$)@! Mini-PC" or "Why Not Sleeping Makes You Legally Insane"

So it was mid-November, and I thought I had Christmas all figured out. As I talked about in the last post, I had pretty much finished all the difficult technical stuff getting MythTV working, and was all set to deliver a home-brew Tivo system to Sara for christmas.

Or so I thought...

See more ...

2:50 am | permalink | /technology/linux | 0 writebacks |

"The Wonders and Horrors of Myth TV" or "How to (and not to) Build Your Own TiVo Box."

I'll keep this entry somewhat short, mostly because there's just too much to pack into one post, but basically here's the Jist. I wanted to get TiVo for Sara for christmas, but was stopped by a few things:

1.) The thing is just too damn expensive. It's OK if you just get the machine, but if you want "service" as well, it's another $15-$20 a month. The lifetime subscription is better, but you have to lay out a few hundred up front for that, and if Tivo folds, you're screwed.

2.) We don't have a landline phone, which is the only way Tivo can download the program guide. (That would be another $33 a month. Suck.)

3.) Although you can hack "DirectTV-Tivo" to work without a phone, it's a pain in the ass, and my landlord won't let me hang a satellite outside the building. Something about if it falls it's his liability. Whatever, he should ban Air Conditioners too then. But I didn't feel like saying that because I like my AC.

See more ...

2:23 pm | permalink | /technology/linux | 1 writebacks |