Plans for separate AD & DNS Domain scenarios

[GJ]

Hi,

So is Infrant going to support different AD & DNS servers for its Domain mode in the future, currently ReadyNAS is very limited given it won't work in a truely big domain environment because of this limitation, even worse the Backup service doesn't support SMB signing, so it is pretty much useless other than restricting to host names which is somewhat of a security hole. If you were to resolve these plus not-enumerate every AD entry in FrontView and provide an Add a user <domain>\user interface we'd buy many many more of these devices.

Thanks !

[Skywalker]

With the P9 release, most of the DNS issues should be resolved. You can now specify the IP address of the domain server you want to use for authentication, and bypass DNS lookups for KRB and LDAP servers.

For the backup manager, in a lot of cases, it's better to do a push backup onto the NAS, instead of a pull. There are a lot of good backup packages out there, with a lot more features than the built-in backup manager. Also, pushing the backup job to the NAS has major performance benefits over pull. The backup manager is a nice convenience for simple backup jobs, but you might find that using a commercial app for doing backups to the NAS to be a better option in a large domain environment.

Can you go into a little more detail on the "Add a user <domain>\user interface"? I don't think I quite understand what you mean.

[GJ]

Sure, its in this thread http://www.infrant.com/forum/viewtopic. ... omain+join , Basically we have over 150,000 user accounts so it'd be hard for a). ReadyNAS to load and display these in the ABC, DEF, categories, b) for a user to simply specify a user. So basically to add a user like Window's Explorer share permissions using an edit field, ie: MYDOMAIN\UserName.

Thanks !

[GJ]

So now whenever I enter all the info including IP address for the DC it just goes off and waits indefinitely with the hourglass page. Is there a way to get/turn-on a event log for you from ReadyNAS so you can take a look at specifically where it is failing?

Thanks !

[yoh-dah]

:( So now whenever I enter all the info including IP address for the DC it just goes off and waits indefinitely with the hourglass page. Is there a way to get/turn-on a event log for you from ReadyNAS so you can take a look at specifically where it is failing?

Thanks !

You can do Download All Logs from Status/Log page and take a look at smbd.log/nmbd.log.

[GJ]

Cool, here's what I have, nothing seems too obvious, any ideas?

Winbind.log

[2006/03/22 11:29:47, 0] lib/util.c:smb_panic2(1562)
BACKTRACE: 1 stack frames:
#0 /usr/sbin/winbindd(secrets_fetch_domain_sid+0) [0x1590f0]
[2006/03/22 11:33:37, 1] nsswitch/winbindd.c:main(978)
winbindd version 3.0.21b started.
Copyright The Samba Team 2000-2004
[2006/03/22 11:33:38, 0] lib/util.c:smb_panic2(1554)
PANIC: Could not fetch our SID - did we join?

[2006/03/22 11:33:38, 0] lib/util.c:smb_panic2(1562)
BACKTRACE: 1 stack frames:
#0 /usr/sbin/winbindd(secrets_fetch_domain_sid+0) [0x1590f0]
[2006/03/22 11:38:23, 1] nsswitch/winbindd.c:main(978)
winbindd version 3.0.21b started.
Copyright The Samba Team 2000-2004
[2006/03/22 11:38:24, 0] lib/util.c:smb_panic2(1554)
PANIC: Could not fetch our SID - did we join?


SMBD.LOG
[2006/03/22 10:43:32, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:43:34, 0] printing/nt_printing.c:nt_printing_init(628)
nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2006/03/22 10:51:48, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:51:50, 0] printing/nt_printing.c:nt_printing_init(628)
nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2006/03/22 11:21:43, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 11:21:44, 0] printing/nt_printing.c:nt_printing_init(628)
nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2006/03/22 11:29:45, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 11:33:36, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 11:38:22, 0] smbd/server.c:main(805)
smbd version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006


NMBD.LOG
[2006/03/22 10:40:37, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:40:41, 0] libsmb/nmblib.c:send_udp(791)
Packet send failed to 172.31.47.255(137) ERRNO=Invalid argument
[2006/03/22 10:40:41, 0] nmbd/nmbd_packets.c:retransmit_or_expire_response_records(1609)
retransmit_or_expire_response_records: Failed to resend packet id 8899 to IP 172.31.47.255 on subnet 172.31.44.189
[2006/03/22 10:40:41, 0] libsmb/nmblib.c:send_udp(791)
Packet send failed to 172.31.47.255(137) ERRNO=Invalid argument
[2006/03/22 10:40:41, 0] nmbd/nmbd_packets.c:retransmit_or_expire_response_records(1609)
retransmit_or_expire_response_records: Failed to resend packet id 8900 to IP 172.31.47.255 on subnet 172.31.44.189
[2006/03/22 10:40:41, 0] libsmb/nmblib.c:send_udp(791)
Packet send failed to 172.31.47.255(137) ERRNO=Invalid argument
[2006/03/22 10:40:41, 0] nmbd/nmbd_packets.c:retransmit_or_expire_response_records(1609)
retransmit_or_expire_response_records: Failed to resend packet id 8901 to IP 172.31.47.255 on subnet 172.31.44.189
[2006/03/22 10:40:41, 0] libsmb/nmblib.c:send_udp(791)
Packet send failed to 172.31.47.255(137) ERRNO=Invalid argument
[2006/03/22 10:40:41, 0] nmbd/nmbd_packets.c:retransmit_or_expire_response_records(1609)
retransmit_or_expire_response_records: Failed to resend packet id 8902 to IP 172.31.47.255 on subnet 172.31.44.189
[2006/03/22 10:40:41, 0] libsmb/nmblib.c:send_udp(791)
Packet send failed to 172.31.47.255(137) ERRNO=Invalid argument
[2006/03/22 10:40:41, 0] nmbd/nmbd_packets.c:retransmit_or_expire_response_records(1609)
retransmit_or_expire_response_records: Failed to resend packet id 8903 to IP 172.31.47.255 on subnet 172.31.44.189
[2006/03/22 10:40:41, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:40:43, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:43:43, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:43:45, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:43:50, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:43:50, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:45:33, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:43:31, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:43:35, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:43:35, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:51:44, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:51:47, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 10:51:51, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 10:51:51, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 11:21:33, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...
[2006/03/22 11:21:42, 0] nmbd/nmbd.c:main(727)
Netbios nameserver version 3.0.21b started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/03/22 11:21:46, 0] nmbd/nmbd.c:terminate(58)
Got SIGTERM: going down...

[Skywalker]

Yeah, nothing too obvious. I'm afraid the ReadyNAS really isn't going to work well in a domain with 150K users and 300K machine accounts. The NAS can only inherit 30K total accounts, and it's kinda at random which accounts will fill up those 30K. We did load up our internal domain with 35K users, and it works reasonably well, other than some occasional slowdowns. But I don't think you'll be happy with the results when you have 450K total accounts in your domain.