Hai, Christian, This looks good, but few small things. Lots of tekst, but i tried to make it as clear as possible.
1) > $ cat /etc/hosts > 127.0.0.1 localhost You did setup with DHCP, so you remove 127.0.1.1 sambawb, is possible, but better is. 127.0.0.1 localhost 172.16.0.209 sambawb.work.company sambawb Be very consistant with this on every server and/or turn of dhcp. ( recommended turn of dhcp, use static ips for the servers ) 2) Setup and enable the username map. username map = /etc/samba/samba_usermapping ( needs content : !root = WORK\Administrator WORK\administrator ) Now here its interresting, this tell me something. Jun 07 21:33:18 sambawb sshd[502]: pam_krb5(sshd:auth): authentication failure; logname=domainuser uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.1 ^^ correctly rejected, uid < 1000 ( pam_krb5.so minimum_uid=1000 ) Jun 07 21:33:18 sambawb sshd[502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.1 user=domainuser ^^ Guessing, also correctly rejected, if you did not give root a password at install or your sshd_config has : PermitRootLogin no (or without-password) Most interresting part. Jun 07 21:33:18 sambawb sshd[502]: pam_winbind(sshd:auth): getting password (0x00000388) Jun 07 21:33:18 sambawb sshd[502]: pam_winbind(sshd:auth): pam_get_item returned a password Jun 07 21:33:19 sambawb sshd[502]: pam_winbind(sshd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS_LOGON_FAILURE, Error message was: Logon failure Jun 07 21:33:19 sambawb sshd[502]: pam_winbind(sshd:auth): user 'domainuser' denied access (incorrect password or invalid membership) Jun 07 21:33:20 sambawb sshd[502]: Failed password for invalid user domainuser from 172.16.0.1 port 54474 ssh2 Are you are loggin in as user "root" (id=0) or as "Administrator" here? Or you created a users and assigned id 0, in all cases, this is in my opinion wrong to do. I recommend not enabling root logins on ssh, but thats your choice. You can not, never ever, assign user Administrator an uid, especialy user Adminsitrator. Uid 0 = root and only root, now this is why you need the username mapping. Pam setup should be good, if you did not changed anything after pam-auth-update But if you need logins as root, maybe need to change the minimum_uid. Above log is correct. Uid 0 (that users trying, is correctly rejected. (pam_krb5(sshd:auth): authentication failure; logname=domainuser uid=0) Now remember, >>>> pam_krb5.so minimum_uid=1000 <<<< So, beside the few small things, this is all correct. Now where did it go wrong. You have a few options to check. First, check the time sync on the DC's and the member servers. A common problem with login problems. Check this first. NTP TIP: If the DC's are using the default time servers, lLike : server 0.debian.pool.ntp.org iburst Then this can be a problem. Change all the DC's time servers to a close time server. I look them up here : http://support.ntp.org/bin/view/Servers/StratumOneTimeServers Take a close one in you country. If if you isp has one use that one. Next, In you sshd_config, enable these 2 of not done. You should preffer kerberos auth where is possible. # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials yes And if you use groups member checks in sshd_conf, test if all these groups have GID. Then you can mix local unix groups and windows groups, like : AllowGroups unix-ssh windows-ssh ( getent group "the_windows group" ) To be sure, run : net cache flush And reboot the member server, and login. ( with a user with uid 1000+ ) But your using RID backend so that should be handled. > > # setup the SePrivileges then reboot the server. > I tried to but I didn't really understand. So I think for my problem its not > neccessary. Correct, for you problem not needed, but you need it to setup shares and set rights. To understand that better, read : https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Granting_the_SeDiskOperatorPrivilege_Privilege > I also noticed that in this cases 'wbinfo -u' or 'kinit > domainuser' succeeds, but 'getent passwd' only shows local users. > And yes, libpam-winbind and libnss-winbind are installed and > nsswitch.conf has 'passwd: compat winbind' Yes, this is confusing.. ;-) wbinfo -u shows all you users. getent passwd not, but `getent passwd username`, should show your user. Same for getent group. >From smb.conf, does this path exist. /home/%D/%U ( /home/WORK/username ) If not configure pam mk_homedir in pam or share the users over nfs/cifs etc. ( ps. Even with the homedir you should be able to login ) Now lots of info, but try again and let me know the result. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: Pkg-samba-maint > [mailto:[email protected] > ebian.org] Namens Christian Meyer > Verzonden: woensdag 7 juni 2017 22:56 > Aan: [email protected] > Onderwerp: [Pkg-samba-maint] Bug#862580: Bug #862580: Winbind > crashes on ssh login of a domain user. > > Hello Louis > and thank you for your very long tutorial. > I tried to fix my 'wrong' smb.conf on my existing machine but > that gave trouble. > So I tried to setup a fresh stretch box step by step (had to > change some things but I had a look at > https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member, > too) but after some days and a reboot I see the problem > again, it just appears less often till now. > > CONFIG > ====== > > Setup jessie: > I did stretch. > > # Choose expert install, and at taskselect choose only ssh server. > I did so and used dhcp: > > $ cat /etc/hosts > 127.0.0.1 localhost > # The following lines are desirable for IPv6 capable hosts > ::1 localhost ip6-localhost ip6-loopback > ff02::1 ip6-allnodes > ff02::2 ip6-allrouters > > $ cat /etc/resolv.conf > domain WORK.COMPANY > search WORK.COMPANY > nameserver 172.16.0.2 > > $ cat /etc/network/interfaces. > source /etc/network/interfaces.d/* > # The loopback network interface > auto lo > iface lo inet loopback > # The primary network interface > allow-hotplug enp0s25 > iface enp0s25 inet dhcp > > > > # Check all these. > $ hostname -s > sambawb > $ hostname -d > WORK.COMPANY > $ hostname -f > sambawb.WORK.COMPANY > $ hostname -i > 172.16.0.209 > > > # install samba winbind and needed extras. > > apt-get install samba smbclient samba-dsdb-modules samba-vfs-modules > winbind libpam-winbind libnss-winbind krb5-user ntp bind9-host > libpam-krb5 > I did so. > > > When questions come, fill in : > No questions came. > > # AD DC ipnumbers at ntp questions > added 'server 172.16.0.2 iburst' to /etc/ntp.conf (thats my AD DC > ipnumber) > > # krb5-user fill in your REALM in CAPS. ! CAPS YES ! > $ cat /etc/krb5.conf > [libdefaults] > default_realm = WORK.COMPANY > > > # Change your /etc/nsswitch.conf > $ cat /etc/nsswitch.conf > passwd: compat winbind > group: compat winbind > shadow: compat > gshadow: files > hosts: files dns > networks: files > protocols: db files > services: db files > ethers: db files > rpc: db files > netgroup: nis > > # kinit administrator > worked great. > > > Setup a "correct smb.conf" like this one. > I don't know whats "correct" in your sense. I did: > > ## ---------- START AD MEMBER SMB.CONF --------- ## # > /etc/samba/smb.conf [global] > security = ads > realm = WORK.COMPANY > workgroup = WORK > > netbios name = sambawb > > preferred master = no > domain master = no > host msdfs = no > # speeds up name resolving, (WINS), through dns. > dns proxy = yes > # local master = no > > > # I left out bind interfaces > #bind interfaces only = yes > #interfaces = enp0s25 127.0.0.1 > > > # I've added these, mustly same as the defaults, but this > explains things for others > # if they have auth problems. > # mandatory will still require SMB2 clients to use signing > server signing = mandatory > > # if ntlm and lanman auth are both disabled, then only > NTLMv2 logins will be permited > ntlm auth = no > lanman auth = no > > # TODO: I skipped TLS keys! > > name resolve order = lmhosts host bcast > > idmap config * : backend = tdb > idmap config * : range = 2000-9999 > # https://wiki.samba.org/index.php/Idmap_config_rid > idmap config WORK : backend = rid > idmap config WORK : range = 10000-999999 > > template homedir = /home/%D/%U > template shell = /bin/bash > winbind nss info = template > > # renew the kerberos ticket > winbind refresh tickets = yes > > # Changed to not use winbind trusted domains only > winbind trusted domains only = no > # and to use default domain > winbind use default domain = yes > > winbind enum groups = yes > winbind enum users = yes > > # Enable offline logins, if needed. I don't want it. > winbind offline logon = no > # left out: winbind max domain connections = 10 > > kerberos method = secrets and keytab > dedicated keytab file = /etc/krb5.keytab > > winbind expand groups = 4 > > # User Administrator workaround, without it you are unable to set > # username map = /etc/samba/samba_usermapping > > # disable usershares creating, no log errors. > usershare path = > > # Disable printing completely, no log errors. > > # Disable printing completely, no log errors. > load printers = no > printing = bsd > printcap name = /dev/null > disable spoolss = yes > > # For ACL support on member servers with shares (oblicated member > setting) > vfs objects = acl_xattr > map acl inherit = Yes > store dos attributes = Yes > > # Share Setting Globally > veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/ > hide unreadable = yes > > # From debian default config: > # This tells Samba to use a separate log file for each machine > # that connects > log file = /var/log/samba/log.%m > > # Cap the size of the individual log files (in KiB). > max log size = 1000 > > # Do something sensible when Samba crashes: mail the admin > panic action = /usr/share/samba/panic-action %d ## > ---------- END AD MEMBER SMB.CONF --------- ## > > > net ads join -S hostname-DC.work.company -k > successfull > > > # Setup pam configs for ssh krb5 and winbind, needed for > your ssh logins. > > pam-auth-update --force > > > # setup the SePrivileges then reboot the server. > I tried to but I didn't really understand. So I think for my > problem its not neccessary. > > > net cache flush > > systemctl restart samba > Failed to restart samba.service: Unit samba.service is masked. > > so I did: > systemctl restart nmbd; systemctl restart smbd > > systemctl restart winbind > > > RESULT > ====== > Sometimes. Caught just after a reboot: > FYI: 172.16.0.1 is the ssh tunnel exit point in my companys network. > > Jun 07 21:33:14 sambawb nmbd[469]: STATUS=daemon 'nmbd' > finished starting up and ready to serve connections > ... > Jun 07 21:33:14 sambawb winbindd[519]: STATUS=daemon > 'winbindd' finished starting up and ready to serve connections > Jun 07 21:33:14 sambawb systemd[1]: Started Samba Winbind Daemon. > Jun 07 21:33:14 sambawb systemd[1]: Reached target Multi-User System. > Jun 07 21:33:14 sambawb systemd[1]: Reached target Graphical > Interface. > Jun 07 21:33:14 sambawb systemd[1]: Starting Update UTMP > about System Runlevel Changes... > Jun 07 21:33:14 sambawb systemd[1]: Started Update UTMP about > System Runlevel Changes. > Jun 07 21:33:14 sambawb systemd[1]: Startup finished in > 3.973s (kernel) + 15.752s (userspace) = 19.725s. > Jun 07 21:33:18 sambawb sshd[502]: pam_krb5(sshd:auth): > authentication failure; logname=domainuser uid=0 euid=0 > tty=ssh ruser= rhost=172.16.0.1 Jun 07 21:33:18 sambawb > sshd[502]: pam_unix(sshd:auth): authentication failure; > logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.1 > user=domainuser Jun 07 21:33:18 sambawb sshd[502]: > pam_winbind(sshd:auth): getting password (0x00000388) Jun 07 > 21:33:18 sambawb sshd[502]: pam_winbind(sshd:auth): > pam_get_item returned a password Jun 07 21:33:19 sambawb > sshd[502]: pam_winbind(sshd:auth): request wbcLogonUser > failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), > NTSTATUS_LOGON_FAILURE, Error message was: Logon failure Jun > 07 21:33:19 sambawb sshd[502]: pam_winbind(sshd:auth): user > 'domainuser' denied access (incorrect password or invalid > membership) Jun 07 21:33:20 sambawb sshd[502]: Failed > password for invalid user domainuser from 172.16.0.1 port 54474 ssh2 > > I also noticed that in this cases 'wbinfo -u' or 'kinit > domainuser' succeeds, but 'getent passwd' only shows local users. > And yes, libpam-winbind and libnss-winbind are installed and > nsswitch.conf has 'passwd: compat winbind' > > Interestingly my fresh installed sambawb shows less bugs than > my reconfigured elderly but config updated FAI-Clients. > > What else do you need? sambalog at loglevel xyz? > > Christian > > > > PS: I don't know if it's related but sometimes I see error > messages like: > Jun 07 09:31:58 fai-server winbindd[18389]: [2017/06/07 > 09:31:58.322153, 0] > ../source3/winbindd/winbindd.c:279(winbindd_sig_term_handler) > Jun 07 09:31:58 fai-server winbindd[18389]: Got sig[15] > terminate (is_parent=0) > Jun 07 09:31:58 fai-server winbindd[18387]: [2017/06/07 > 09:31:58.322378, 0] > ../source3/winbindd/winbindd.c:279(winbindd_sig_term_handler) > Jun 07 09:31:58 fai-server winbindd[18387]: Got sig[15] > terminate (is_parent=1) > > _______________________________________________ > Pkg-samba-maint mailing list > [email protected] > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-sa > mba-maint > >
