Greetings! I am having a bit of an issue using Ubuntu 9.10 and AD 2003.
AD domain = dacrib.local
AD server = dim-2300.dacrib.local
IP = 10.0.0.60
Samba server = workhorse.dacrib.local
IP = 10.0.0.20
I have been following
<https://help.ubuntu.com/community/Samba/Kerberos>, and my Kerberos
seems set up properly, as I can get a ticket.
r...@workhorse:/etc/samba# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
03/27/10 18:36:58 03/28/10 04:37:05 krbtgt/[email protected]
renew until 03/28/10 18:36:58
Then, following
<https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto>
I set up my Samba server, and was able to join it to the domain.
r...@workhorse:/etc/samba# net ads info
LDAP server: 10.0.0.60
LDAP server name: dim-win2300.DaCrib.local
Realm: DACRIB.LOCAL
Bind Path: dc=DACRIB,dc=LOCAL
LDAP port: 389
Server time: Sat, 27 Mar 2010 19:09:28 EDT
KDC server: 10.0.0.60
Server time offset: 0
I can see my server in AD. Other domain members can browse to
\\10.0.0.20, and see the defined shares, and access the files in there.
So it appears to be properly joined to the domain, and sharing.
What's not working is winbind. I do *not* see any domain users or
groups, from "wbinfo -u" or "wbinfo -g". "wbinfo --all-domains" does
know about the AD domain, however:
r...@workhorse:/etc/samba# wbinfo --all-domains
BUILTIN
WORKHORSE
DACRIB
I did edit nsswitch.conf:
r...@workhorse:/etc/samba# more /etc/nsswitch.conf
# /etc/nsswitch.conf
passwd: compat winbind
group: compat winbind
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
At this point, I'm a bit lost. My eventual goal is to have any Linux
user authenticate against the AD domain, but before I can get that far,
I need winbind to work.
Any thoughts? Where do I go from here, to troubleshoot winbind not
returning any users or groups?
smb.conf:
[global]
workgroup = DACRIB
realm = DACRIB.LOCAL
server string = %h server (Samba)
security = ADS
map to guest = Bad User
client use spnego = true
client ntlmv2 auth = yes
eventlog list = Application System Security SyslogLinux
# PAM AUTH
encrypt passwords = Yes
obey pam restrictions = Yes
pam password change = true
password server = dim-win2300.DaCrib.local
passdb backend = tdbsam
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n
*Retype\snew\s*\spassword:* %n\n
*password\supdated\ssuccessfully* .
unix password sync = Yes
log level = 2
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
preferred master = No
domain master = No
local master = No
os level = 31
browse list = Yes
dns proxy = No
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
# WINBIND
idmap backend = ad
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nested groups = Yes
winbind refresh tickets = true
winbind nss info = rfc2307
invalid users = root
create mask = 0700
directory mask = 0775
writable = Yes
enable privileges = Yes
restrict anonymous = 2
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[OldHome]
comment = The Old Home Folder
read only = No
path = /OldHome
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
