Zimbra Pam/Samba trouble

[artimus]

Im following gregs howto() but I'm running into some issues.
I noticed a few things.


1. I can bind to ldap from my zimbra server using the following query:

ldapsearch -H ldap://zimbra.domain.tld/ -v -x -W -D 'uid=myadmin,ou=people,dc=zimbra,dc=domain,dc=tld' -s sub '(objectclass=*)' -LL

If I run this query from another host on the same lan i get the following output:

ldap_initialize( ldap://zimbra.domain.tld/ )
Enter LDAP Password:
filter: (objectclass=*)
requesting: ALL
version: 1

No such object (32)
Matched DN: dc=tld

needless to say, samba and pam are not working

I don't see posixAccount anywhere in my ldapsearch.

[Greg]

OK, here's some troubleshooting/research to do:
- check your slapd.conf and see if the nis.schema and samba.schema are there in the includes (note: you should not have been editing slapd.conf, because it gets overwritten every time ZCS starts)
- check your LDAP log to see if it throws any errors when it loads
- when you are trying to bind log in to the system that is configured to use pam_ldap, pam should make an LDAP query - look into sys log for the query, 1 - see if pam makes the query 2 - what LDAP have to say about it

[Greg]

Originally Posted by artimus

1. I can bind to ldap from my zimbra server using the following query:

ldapsearch -H ldap://zimbra.domain.tld/ -v -x -W -D 'uid=myadmin,ou=people,dc=zimbra,dc=domain,dc=tld' -s sub '(objectclass=*)' -LL

What do you get when you run this query form the same host where LDAP is running?

[artimus]

On the zimbra server I would get nice chunk of ldif from ldap.

From the other box I was succesfully able to bind using uid=zimbra,cn=admins,cn=zimbra.


Unfortunately I need to get this mail server up and running sooner then expected. I have already removed all my samba/posix settings, and will save that for a future project when I have time to test.

It is a little awkward, but It does work. I left off at a point where user and groups were working for a linux box, and users could log into samba from windows and see there home directory.

Another thing that threw me off for a while was that I am using a subdomain for testing. I could see users in posix but not groups. The problem turned out that I had my groups bound to dc=domain,dc=tld, while my users were bound to dc=zimbra,dc=domain,dc=tld. While simple and obvious, it's amazing how many times I can look over that same line I not notice what I did.