2:13 a.m.
Many years ago I built a server on Fedora 8 which became my core network
server running all the network servers (DNS etc) as well as a host of custom
services over inetd, However it's main purpose was to service Samba shares.
That server is now failing so I've just spent a week building a new F20 server
and converting everything from F8 to F20 - amazing number of changes needed
but also an amazing number of things are still the same.
Last of the things to move because the old server is still live and serving is
SAMBA. This is where I need the help.
All of my servers run the same type of setup and it's all based
around "security = share". Why is this so universally declared as bad??
I know when I built some F16 servers it said that "security = share" was
depreciated but it still let me use it. Now with F20 it just refuses.
The problem is that security = share did *exactly* what I wanted and now I
can't seem to achieve the same effect any other way.
Very simply, I use the [homes] section and have about 10 users defined on the
server - service, parts, admin etc.
Then for each user PC (approx 120 - 150) I then map a network drive to each
service that is required. Many only have one or two but some people such as
admin have access to sales, accounts, wages and admin.
All very simple and faultless for 8 years.
Now, when I try some of the examples found online, client PCs seem to be able
to connect to the first share ok but then whenever I try to connect a second
share it complains about having to log out of the first share first.
Can anyone please help me here. If I can't get it working I'll have to scrap
my week's work and install F16 on this box.
Fingers crossed
11:54 a.m.
On Fri, 23 Jan 2015, Gary Stainburn wrote:
On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
> I'm now installing Fedora 16 on my server and am going to re-do the last 4
> days work
Of course, my next problem is that yum no longer works, presumably because
there are no repositories left. Is this true, or are there still some out
there that I can use?
Of course this should never be used in production or exposed to the
internet, but there is a repository you can use:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everythi...
For help adding the repository to that version of Fedora, see
http://docs.fedoraproject.org/en-US/Fedora/16/html/System_Administrators_...
9:59 a.m.
On Friday 23 January 2015 15:24:44 Tom Horsley wrote:
On Fri, 23 Jan 2015 08:29:46 -0600
Dave Ihnat wrote:
> But a better solution would be to use the approach suggested here:
>
> http://ubuntuforums.org/showthread.php?t=1962617
I'm pretty sure I spent most of about 3 days trying to get
the "Bad User" gimmick to work and something I needed to do
always didn't work right, which is why I gave up and hard
coded the password in a script. Maybe it works better these
days than it did when I tried it.
My problem with the suggestions made is that it removes the password
protection from the shares, which is not acceptible. I know the users just
have to walk up to someone else's PC to acces their shares but that's a lot
more obvious than just everyone being able to access every share from any PC
The problem with installing startup scripts is that I would have to visit
every site and update up around 120 PCs.
I'm now installing Fedora 16 on my server and am going to re-do the last 4
days work
6:49 a.m.
On 23.01.2015 12:24, Gary Stainburn wrote:
...
If someone comes up with a strong argument as to why I need to
re-design
everything, or at least gives me some idea of how I can do it easily I can't
se any alternative
General questions regarding Samba
https://lists.samba.org/mailman/listinfo/samba
I saw a few Gary there.
What do you say, to join them and so to talk about the problem there? ;)
5:18 a.m.
On Fri, 23 Jan 2015 08:13:22 +0000
Gary Stainburn wrote:
The problem is that security = share did *exactly* what I wanted and
now I
can't seem to achieve the same effect any other way.
Absurd, right? There is one other way: Use user and password based security, then
make scripts for all the machines that mount the filesystems which hard
code the user and password and set them up to run at login.
Exactly the same level of security as share :-).
I love the way samba advertises itself as replicating windows shares
for linux, but windows hasn't made security = share go away.
7:22 a.m.
On Friday 30 January 2015 13:11:07 Tom H wrote:
You probably need to point to the F17 archives:
http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/17/Fedo
ra/x86_64/os/
I did try that Tom, but it still complained about the metadata being missing,
or something similar.
I've now changed tack again and in the short term I've stablised the original
F8 server and it appears to be behaving itself now. My hope is that it
survives until after I retire, or at least until I come up with something
better.
In the long term, I've installed CentOS 7 on the server that was to replace
it, and I'm going to experiment with security = user to see if I can get a
working setup with that.
7:11 a.m.
On Mon, Jan 26, 2015 at 6:59 AM, Gary Stainburn
<gary.stainburn(a)ringways.co.uk> wrote:
On Friday 23 January 2015 17:54:26 Philip Keogh wrote:
> On Fri, 23 Jan 2015, Gary Stainburn wrote:
>> On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
>>>
>>> I'm now installing Fedora 16 on my server and am going to re-do the last
>>> 4 days work
>>
>> Of course, my next problem is that yum no longer works, presumably
>> because there are no repositories left. Is this true, or are there still
>> some out there that I can use?
>
> Of course this should never be used in production or exposed to the
> internet, but there is a repository you can use:
> http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everything
>/x86_64/os/
>
> For help adding the repository to that version of Fedora, see
> http://docs.fedoraproject.org/en-US/Fedora/16/html/System_Administrators_Gu
>ide/sec-Managing_Yum_Repositories.html
I've updated my server to F17 and then tried to do a yum update. This has also
failed, so I've tried your suggestion, replacing 16 with 17. I then added the
public key, but I still cannot do yum updates:
Can anyone suggest what to do next to get updates working?
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new ~]# yum-config-manager --add-repo
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
Loaded plugins: langpacks, presto, refresh-packagekit
adding repo from:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
[dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_]
name=added from:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
baseurl=http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/...
enabled=1
You probably need to point to the F17 archives:
http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/17/Fe...
7:40 a.m.
On 01/26/2015 04:49 AM, Gary Stainburn wrote:
On Friday 23 January 2015 21:17:55 Pete Travis wrote:
> No, please don't do this. Be honest with yourself about how frequently
> you are willing to upgrade this server, and compare that to Fedora's
> release cycle. It doesn't match up. I'm all for using Fedora, even in
> apparently mission-critical situations like yours - but only if the
> admin is willing to work with it as the relatively rapid release cycle
> distribution that it is.
>
> An appropriate methodology could be:
> +0 months - Upgrade to Fedora 21 now.
> +4 months - When Fedora 22 is released, begin migration planning and
> testing +10 months - By the time Fedora 23 is released, you should be ready
> to migrate to F22, or you should have already done so.
> +10 months - Begin migration testing and planning for F23
> +16 months - Complete migration to F23
>
> If your workflow or circumstances can't accomodate more than a one year
> lag, consider a distribution that has support cycles longer than one
> year. CentOS comes to mind, most of your knowledge will translate well.
>
> --Pete
Pete,
In an ideal world I agree with everything you say. However, this isn't an
ideal world.
Bear in mind that I'm replacing a Fedora 8 server. This is how often I update
my servers. These are non-public facing servers, and perform internal
services.
The whole point of installing F16 (I'm now installing F17 as it's still got
mirrors working and still supports what I need) is because SAMBA have
discontinued the feature that I need. I will never be upgrading this server.
The reason I'm using Fedora is that I know Fedora and can use Fedora (even
with all the changes between F8 and F17).
I would have to interject here to state
that I believe Pete to be
correct. You could switch over to CEntOS and not miss a beat when it
comes to administering your server. The same commands you use in Fedora
are the same commands you'd use in CEntOS, yum....dnf....plus you can
tweak it to your heart's content.....and you could eliminate having to
worry about its upgrade cycle since its a bit less frenetic as
Fedora's.......just my two cents...
EGO II
5:59 a.m.
On Friday 23 January 2015 17:54:26 Philip Keogh wrote:
On Fri, 23 Jan 2015, Gary Stainburn wrote:
> On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
>> I'm now installing Fedora 16 on my server and am going to re-do the last
>> 4 days work
>
> Of course, my next problem is that yum no longer works, presumably
> because there are no repositories left. Is this true, or are there still
> some out there that I can use?
Of course this should never be used in production or exposed to the
internet, but there is a repository you can use:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everything
/x86_64/os/
For help adding the repository to that version of Fedora, see
http://docs.fedoraproject.org/en-US/Fedora/16/html/System_Administrators_Gu
ide/sec-Managing_Yum_Repositories.html
I've updated my server to F17 and then tried to do a yum update. This has also
failed, so I've tried your suggestion, replacing 16 with 17. I then added the
public key, but I still cannot do yum updates:
Can anyone suggest what to do next to get updates working?
Cheers
Gary
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new ~]# yum-config-manager --add-repo
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
Loaded plugins: langpacks, presto, refresh-packagekit
adding repo from:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
[dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_]
name=added from:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/Everythi...
baseurl=http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/17/...
enabled=1
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
You have enabled checking of packages via GPG keys. This is a good thing.
However, you do not have any GPG public keys installed. You need to download
the keys for packages you wish to install and install them.
You can do that by running the command:
rpm --import public.gpg.key
Alternatively you can specify the url to the key you would like to use
for a repository in the 'gpgkey' option in a repository section and yum
will install it for you.
For more information contact your distribution or package provider.
Problem repository:
dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_
[root@eddie-new ~]# wget
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everythi...
--2015-01-26 11:52:29--
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everythi...
Resolving dl.fedoraproject.org... 209.132.181.24, 209.132.181.25,
209.132.181.26, ...
Connecting to dl.fedoraproject.org|209.132.181.24|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1653 (1.6K)
Saving to: `RPM-GPG-KEY-fedora-x86_64'
100%[===================================================================================================================>]
1,653 --.-K/s in 0s
2015-01-26 11:52:29 (217 MB/s) - `RPM-GPG-KEY-fedora-x86_64' saved [1653/1653]
[root@eddie-new ~]# rpm --import RPM-GPG-KEY-fedora-x86_64
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_
|
4.2 kB 00:00
dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_/primary_db
|
14 MB 00:13
dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_/group_gz
|
434 kB 00:00
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new ~]# yum update
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new ~]# cd /etc/yum.repos.d/
[root@eddie-new yum.repos.d]# ll
total 16
-rw-r--r--. 1 root root 293 Jan 26 11:50
dl.fedoraproject.org_pub_archive_fedora_linux_releases_17_Everything_x86_64_os_.repo
-rw-r--r--. 1 root root 1144 May 4 2012 fedora.repo
-rw-r--r--. 1 root root 1105 May 4 2012 fedora-updates.repo
-rw-r--r--. 1 root root 1163 May 4 2012 fedora-updates-testing.repo
[root@eddie-new yum.repos.d]# yum update ca-certificates
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new yum.repos.d]# yum reinstall ca-certificates
Loaded plugins: langpacks, presto, refresh-packagekit
Error: Cannot retrieve metalink for repository: fedora. Please verify its path
and try again
[root@eddie-new yum.repos.d]#
4:23 a.m.
On Mon, 2015-01-26 at 09:49 +0000, Gary Stainburn wrote:
Bear in mind that I'm replacing a Fedora 8 server. This is how
often I
update my servers. These are non-public facing servers, and perform
internal services.
I've still got a Fedora Core 4 server running as the LAN's file server.
It does what I want, it'd be a major pain to update it, and I have my
doubts that I could run a newer OS on it (they want a lot more RAM).
--
tim@localhost ~]$ uname -rsvp
Linux 3.17.8-200.fc20.i686 #1 SMP Fri Jan 9 00:01:03 UTC 2015 i686
All mail to my mailbox is automatically deleted, there is no point trying
to privately email me, I will only read messages posted to the public lists.
George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.
3:49 a.m.
On Friday 23 January 2015 21:17:55 Pete Travis wrote:
No, please don't do this. Be honest with yourself about how
frequently
you are willing to upgrade this server, and compare that to Fedora's
release cycle. It doesn't match up. I'm all for using Fedora, even in
apparently mission-critical situations like yours - but only if the
admin is willing to work with it as the relatively rapid release cycle
distribution that it is.
An appropriate methodology could be:
+0 months - Upgrade to Fedora 21 now.
+4 months - When Fedora 22 is released, begin migration planning and
testing +10 months - By the time Fedora 23 is released, you should be ready
to migrate to F22, or you should have already done so.
+10 months - Begin migration testing and planning for F23
+16 months - Complete migration to F23
If your workflow or circumstances can't accomodate more than a one year
lag, consider a distribution that has support cycles longer than one
year. CentOS comes to mind, most of your knowledge will translate well.
--Pete
Pete,
In an ideal world I agree with everything you say. However, this isn't an
ideal world.
Bear in mind that I'm replacing a Fedora 8 server. This is how often I update
my servers. These are non-public facing servers, and perform internal
services.
The whole point of installing F16 (I'm now installing F17 as it's still got
mirrors working and still supports what I need) is because SAMBA have
discontinued the feature that I need. I will never be upgrading this server.
The reason I'm using Fedora is that I know Fedora and can use Fedora (even
with all the changes between F8 and F17).
4:21 p.m.
On Fri, 23 Jan 2015 13:21:39 -0800
Joe Zeff wrote:
Either that, or plan on using only the even (or odd) releases and
migrating slightly before End Of Life.
Or stick with new fedora, but build samba3 from source in a
nice separate directory tree that doesn't conflict with anything.
3:21 p.m.
On 01/23/2015 01:17 PM, Pete Travis wrote:
If your workflow or circumstances can't accomodate more than a
one year
lag, consider a distribution that has support cycles longer than one
year. CentOS comes to mind, most of your knowledge will translate well.
Either that, or plan on using only the even (or odd) releases and
migrating slightly before End Of Life.
3:17 p.m.
On Fri, Jan 23, 2015 at 09:54:26AM -0800, Philip Keogh wrote:
On Fri, 23 Jan 2015, Gary Stainburn wrote:
>On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
>>I'm now installing Fedora 16 on my server and am going to re-do the last 4
>>days work
>Of course, my next problem is that yum no longer works, presumably because
>there are no repositories left. Is this true, or are there still some out
>there that I can use?
>
Of course this should never be used in production or exposed to the
internet, but there is a repository you can use:
http://dl.fedoraproject.org/pub/archive/fedora/linux/releases/16/Everythi...
For help adding the repository to that version of Fedora, see
http://docs.fedoraproject.org/en-US/Fedora/16/html/System_Administrators_...
--
No, please don't do this. Be honest with yourself about how frequently
you are willing to upgrade this server, and compare that to Fedora's
release cycle. It doesn't match up. I'm all for using Fedora, even in
apparently mission-critical situations like yours - but only if the
admin is willing to work with it as the relatively rapid release cycle
distribution that it is.
An appropriate methodology could be:
+0 months - Upgrade to Fedora 21 now.
+4 months - When Fedora 22 is released, begin migration planning and testing
+10 months - By the time Fedora 23 is released, you should be ready to migrate to
F22, or you should have already done so.
+10 months - Begin migration testing and planning for F23
+16 months - Complete migration to F23
If your workflow or circumstances can't accomodate more than a one year
lag, consider a distribution that has support cycles longer than one
year. CentOS comes to mind, most of your knowledge will translate well.
--Pete
2:40 p.m.
On 01/23/2015 12:13 AM, Gary Stainburn wrote:
All of my servers run the same type of setup and it's all based
around "security = share". Why is this so universally declared as bad??
Well, consider how it worked:
https://www.samba.org/samba/docs/man/Samba3-HOWTO/ServerType.html#id2559439
The client requests a share, and sends a password but no user. The
server has to search through all of the users defined to see if the
password matches any of them.
So now you have a server that significantly reduces the cost of brute
forcing a password, because you can ask it if a given password is valid
for the entire user database. That's bad.
Now, when I try some of the examples found online, client PCs seem to
be able
to connect to the first share ok but then whenever I try to connect a second
share it complains about having to log out of the first share first.
I suspect you're trying to connect to the second share with a different
username and password than the first? That isn't going to work with
Samba 4. You'll have to use Samba 3. I'm pretty sure you can use old
samba 3 RPMs from a previous Fedora release. At least that way you
won't sacrifice security on the rest of the system.
But realistically, you should be doing security=user or security=domain.
In that case, you just need to use group membership to effectively
govern share access, so that users connect with one username/password
instead of several.
It's hard to give you good advice with as little information as you
provided. Consider sending your configuration file or posting it
somewhere we can read it (pastebin?)
11:31 a.m.
On 01/23/2015 11:37 AM, Gary Stainburn wrote:
On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
> I'm now installing Fedora 16 on my server and am going to re-do the last 4
> days work
Of course, my next problem is that yum no longer works, presumably because
there are no repositories left. Is this true, or are there still some out
there that I can use?
You might have to remove using mirrors and access the baseurl directly,
or, you might have to fix the pathnames if Fedora has moved the old
directories. I'm fairly certain that they still exist online (they are
no longer getting updates, but they should be complete as to the last
set of updates).
When I tried to visit the F14 directories, I found the following:
ATTENTION
======================================
The contents of this directory have been moved to our archives available at:
http://archives.fedoraproject.org/pub/archive/fedora/
If you are having troubles finding something there please stop by #fedora-admin on
irc.freenode.net
I was able to access the directory trees at the new location, so you
probably have to update the URLs for your repositories.
--
Kevin J. Cummings
kjchome(a)verizon.net
cummings(a)kjchome.homeip.net
cummings(a)kjc386.framingham.ma.us
Registered Linux User #1232 (http://www.linuxcounter.net/)
10:37 a.m.
On Friday 23 January 2015 15:59:48 Gary Stainburn wrote:
I'm now installing Fedora 16 on my server and am going to re-do
the last 4
days work
Of course, my next problem is that yum no longer works, presumably because
there are no repositories left. Is this true, or are there still some out
there that I can use?
9:24 a.m.
On Fri, 23 Jan 2015 08:29:46 -0600
Dave Ihnat wrote:
But a better solution would be to use the approach suggested here:
http://ubuntuforums.org/showthread.php?t=1962617
I'm pretty sure I spent most of about 3 days trying to get
the "Bad User" gimmick to work and something I needed to do
always didn't work right, which is why I gave up and hard
coded the password in a script. Maybe it works better these
days than it did when I tried it.
8:29 a.m.
On Fri, Jan 23, 2015 at 11:24:07AM +0000, Gary Stainburn wrote:
I don't really understand this. How would making startup scripts
per PC work?
My issue is that I can only connect each client to one samba share. Once I
try to connect the same client to a second share is throws be out with
credentials errors.
This is behavior is annoying, but what he's suggesting is to change the
Samba config to use passworded security. Then you'd use the Windows
gpedit.msc to create a login script under "User Configuration", "Windows
Settings", "Scripts (Logon/Logoff)". Do something like
net use Z: \\server\share <password> /USER:domainname\lusername
But a better solution would be to use the approach suggested here:
http://ubuntuforums.org/showthread.php?t=1962617
I'd also suggest you consider using Webmin to manage Samba--if not
indefinitely, at least to help you configure it then examine the resultant
config files to see how it does things.
I might also suggest just doing a google before checking here. This was
the first hit I got when I searched for "Samba security=share deprecated".
I realise that going back to Fedora 16 will only give me problems
down the
line, ...
No, you don't want to do that.
Cheers,
--
Dave Ihnat
dihnat(a)dminet.com
5:24 a.m.
On Friday 23 January 2015 11:18:50 Tom Horsley wrote:
On Fri, 23 Jan 2015 08:13:22 +0000
Gary Stainburn wrote:
> The problem is that security = share did *exactly* what I wanted and now
> I can't seem to achieve the same effect any other way.
Absurd, right? There is one other way: Use user and password based
security, then make scripts for all the machines that mount the filesystems
which hard code the user and password and set them up to run at login.
Exactly the same level of security as share :-).
I love the way samba advertises itself as replicating windows shares
for linux, but windows hasn't made security = share go away.
I don't really understand this. How would making startup scripts per PC work?
My issue is that I can only connect each client to one samba share. Once I try
to connect the same client to a second share is throws be out with
credentials errors.
I realise that going back to Fedora 16 will only give me problems down the
line, but at the moment it seems as the only option - I can't go round
updating 120+ PC very easily.
If someone comes up with a strong argument as to why I need to re-design
everything, or at least gives me some idea of how I can do it easily I can't
se any alternative
3380
days inactive
3387
days old
19 comments
12 participants
participants (12)
-
Dave Ihnat -
EGO-II.1 -
Gary Stainburn -
Gordon Messmer -
Joe Zeff -
Kevin Cummings -
Pete Travis -
Philip Keogh -
poma -
Tim -
Tom H -
Tom Horsley