NSS_LDAP timeout towards Active Directory

Suffering from LDAP timeouts on Unix, where it thought it had a TCP connection to Active Directory LDAP - but it didn't really?

ie:
"nss_ldap: reconnected to LDAP server ldap://ad.in.company.com/"
or...
"nscd: nss_ldap: could not search LDAP server - Server is unavailable"

Here's one possible solution: increase the idle timeout in the Active Directory LDAP policies. By default it is 900 seconds.
(ref: http://support.microsoft.com/kb/315071)

> ntdsutil.exe
: LDAP Policies
: connections
: connect to server ad.in.company.com
: q
: Show Values
: set MaxConnIdleTime to 129600
: Show Values
: Commit Changes
: Show Values
: q
: q

This effects all DC's (as far as I can tell).


Now create a cron job in Unix to query the Active Directory (i.e. getent passwd) at an interval of less than MaxConnIdleTime.

Samba / Winbind auth to ADS 2008 R2

I'd been having problems connecting CentOS 5.5 to a Active Directory 2008 R2 domain.

1) use the samba3x packages

Winbind would refuse to show entries in getent passwd, and Samba would not allow domain users access to shares. There were problems observable in a packet trace... for example Wireshark would decode STATUS_LOGON_FAILURE in SMB transactions.

Anyway, it turns out that you MUST specify a "idmap config " for the domain! Otherwise UID/GID mappings fail and then users cannot login.

2) use idmap config configuration options

Resulting configuration looks like this:

[global]
log level = 0

workgroup = ad
password server = ad-box-1.ad.local ad-box-2.ad.local
realm = AD.LOCAL
security = ads
encrypt passwords = yes

idmap uid = 1500-999999
idmap gid = 1500-999999
idmap backend = ad

idmap config AD : backend = ad
idmap config AD : range = 1500-999999

template shell = /bin/bash

ldap ssl ads = no

preferred master = no
local master = no
domain master = no

winbind use default domain = true
winbind offline logon = true
winbind nss info = rfc2307
winbind enum users = yes
winbind enum groups = yes
winbind separator = +

server string = File server


[temp]
comment = samba test server tmp directory
path = /tmp
valid users = @AD+Administrators
read only = No
writeable = Yes
guest ok = No
browseable = Yes

openSUSE distribution upgrades

To go from openSUSE 10.3 -> 11.0 -> 11.1 -> 11.2 -> 11.3 etc. you can use zypper. This does it all from the Internet, so it's nice and easy (in theory).

At a very high level this is the procedure:

(for 11.1 -> 11.2)

zypper ar http://download.opensuse.org/distribution/11.2/repo/oss/ openSUSE-11.2-oss
zypper ar http://download.opensuse.org/distribution/11.2/repo/non-oss/ openSUSE-11.2-nonoss
zypper ar http://download.opensuse.org/source/distribution/11.2/repo/oss/ openSUSE-11.2-srcoss
zypper ar http://download.opensuse.org/update/11.2/ openSUSE-11.2-update


I generally upgrade the tools before doing the "dup" command, as I had a range of issues doing 10.2 to 10.3 upgrades:

zypper in zypper rpm

Then I go forth and:

zypper dup


I did have tonnes of problems going from 10.2 to 10.3 due to changes in libzypper. I ended up force installing a whole bunch of rpm's to make it work. Messy, but got there in the end.