Cleanup the mail a bit, so its more readable. > > Hello Louis, > > > 1) $ cat /etc/hosts > >> 127.0.0.1 localhost > >You did setup with DHCP, so you remove 127.0.1.1 sambawb, is > possible, > >but better is. > This is because > https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member > tells: "On debian related systems you wil see 127.0.1.1 > hostname also in /etc/hosts remove it before you install samba." > > >172.16.0.209 sambawb.work.company sambawb > I had it in /etc/hosts before and removed it following wiki.samba.org. > I will put it back. Yes, the wiki show a few other things then whats i.m.o. preffered for a good samba setup. With the hostname correct defince, you rely less for that server on dns and is safer this way. So every server has the correct ip's base on hostnames even when there is no network. Its not incorrect but this way you are avoiding more (possible) problems.
> > > ( recommended turn of dhcp, use static ips for the servers ) > I will think about it. > But just to be clear: what exactly do you mean with 'server'? > My debian machines are only 'domain members' and are not > providing any shares or printers to the network. I think > 'server' is samba terminology meaning that it is providing > services e.g. to PAM on the local machine. Right? With the server i did mean the member server itself. This is not incorrect but again, to avoid problems set it to static ip, or Lock the ip's by mac adres in the dhcp pool. > No comment on the remove part all ok. > > Okay, I think that is the point: > When it fails I see: > Jun 10 22:21:50 COMPUTERXY sshd[3207]: Invalid user domainuser from > 172.16.0.235 > Jun 10 22:21:50 COMPUTERXY sshd[3207]: > input_userauth_request: invalid user domainuser [preauth] Jun > 10 22:21:52 COMPUTERXY sshd[3207]: pam_krb5(sshd:auth): > authentication failure; logname=domainuser uid=0 euid=0 > tty=ssh ruser= rhost=computer.work.company > > and on success it is (same machine, same user, just some time > later, e.g. after a local user logged in): > Jun 10 23:23:22 COMPUTERXY sshd[9459]: pam_krb5(sshd:auth): > user domainuser authenticated as [email protected] Jun > 10 23:23:22 COMPUTERXY pam-script[9459]: can not stat > /usr/share/libpam-script/pam_script_acct > Jun 10 23:23:22 COMPUTERXY sshd[9459]: Accepted password for > domainuser from 172.16.0.1 port 43841 ssh2 > > I will have a look at it with changed username mapping. Ok, for this, you could test also without that script since it errors also > Jun 10 23:23:22 COMPUTERXY pam-script[9459]: can not stat > /usr/share/libpam-script/pam_script_acct > > > > Now where did it go wrong. You have a few options to check. > > First, check the time sync on the DC's and the member servers. > > A common problem with login problems. Check this first. > # net ads info -P > LDAP server: 172.16.0.2 > LDAP server name: ADDC.WORK.company > Realm: WORK.COMPANY > Bind Path: dc=WORK,dc=COMPANY > LDAP port: 389 > Server time: Sa, 10 Jun 2017 23:37:11 CEST KDC server: > 172.16.0.2 Server time offset: 0 Login on the DC's and members Start with a DC, run : ntpdate Your.timeserer Now do the members : ntpdate your.DOMAINCONTROLLER. > > # grep server /etc/ntp.conf > server 172.16.0.2 iburst Again for a AD DC, point to a close (or stratum 1) ntp server for a stable time source. For the members, point to you DC's. If you have more DC, just put them in there. > > # grep GSS /etc/ssh/sshd_config > # GSSAPI options > #GSSAPIAuthentication no > #GSSAPICleanupCredentials yes > > I will change it to: > GSSAPIAuthentication yes > GSSAPICleanupCredentials yes > > > And if you use groups member checks in sshd_conf, test if all these > groups have GID. > # grep -i group /etc/ssh/sshd_config > <nothing> Ok so no group restrictions in sshd_config, possible yet. Test also with, getent passwd username getent passwd "Group Name" id username wbinfo -u wbinfo -g > > > >> I also noticed that in this cases 'wbinfo -u' or 'kinit > domainuser' > >> succeeds, but 'getent passwd' only shows local users. > >> And yes, libpam-winbind and libnss-winbind are installed and > >> nsswitch.conf has 'passwd: compat winbind' > > Yes, this is confusing.. ;-) > > wbinfo -u shows all you users. > >getent passwd not, but `getent passwd username`, should show your user. > No, it isn't. 'getent passwd' shows domainusers, too, but I > tested 'getent passwd domainuser' as well: > I'm logged in as root and testing 'getent passwd' or 'getent > passwd domainuser'. > When 'getent passwd' (or 'getent passwd domainuser') shows > 'domainuser' > then I can log in as domainuser, too. > When 'getent passwd' (or 'getent passwd domainuser') does not > show 'domainuser' then I can't log in as domainuser. > When 'getent passwd' (or 'getent passwd domainuser') shows > 'domainuser' > then I can log in as domainuser, too. ^^^^^so if you user has an UID you can login, if not not, thats totaly correct. A bit more clarification; On a samba DC: getent passwd , never shows any users on the DC, uid assigned or not. getent passwd username, does show that one user, but only with uid assigned. getent group , never shows any groups on the DC, uid assigned or not. getent passwd username, does show that one group, but only with uid assigned. On a samba member, getent passwd , shows all users with an uid. getent passwd username, does show that one user with uid getent group , never shows any groups on the DC getent passwd username, does show that one group. Now, above all depends on you how you setup your samba. That starts here: ( DC's first ) https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller#Provisioning_a_Samba_Active_Directory First you need --use-rfc2307 if you want you samba users to be available in linux. So you did you provision with or without --use-rfc2307 ? If it was enabled at provsioning you should have "idmap_ldb:use rfc2307 = yes" in you smb.conf Something to check, i recommend to always use --use-rfc2307 when provisioning. If its not, read : https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD if you need uid/gid resolving on a DC, also read https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC For the members, Start here : https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member#Configuring_Samba And look what matches best to your environment. I preffer AD for my member servers "with" file shares etc. If an authentication server only you can set RID. Manly because of the Advantages and Disadvantages. Backend AD on a member, IDs are not stored in a local database that can corrupt and thus file ownerships are not lost. So consistant with with ID resolving. Backend RID on a member, IDs are stored in a local database that can corrupt and thus file ownerships are lost. I use RID on my proxy servers for example. > > Thank you for your help, > > Christian > Now with above you should be able to get you server running. You missing UID's on some users, or you have a mismatch in the backend setups. Your welkom, Louis
