Does "getent group" and "getent passwd" return the users and groups? If
it doesn't I'm guessing that you didn't copy the libnss_winbind.so to
your /lib directory and then create a symbolic link, ln -s
/lib/libnss_winbind.so /lib/libnss_winbind.so.x, where x is the version
of nss you use...I think. I put 2 and it works but you can try 0,1, or
2 I think. Hope this helps
[EMAIL PROTECTED] wrote:
I have problems with SID to UID mapping using winbind on a FreeBSD 5.2/Samba
3.0.4
as a member server of a Win2k domain controller. I use heimdal-0.6.1 for
kerberos.
I would like my XP machines in the domain to use the share with the user
accounts
defined in Active Directory.
At a first glance it seems to work: the connection to the share succeeds
without a
prompt for a password. Users may create, read, modify and delete files or
folders.
But the ACLs do not show domain accounts but local accounts: those accounts have
the SAME NAME as the domain account BUT they bear the name of the SAMBA machine
instead of the name of the domain.
Here are my conf files:
----- smb.conf -----
[global]
security = ADS
realm = windom
netbios name = SAMBA
workgroup = WINDOM
encrypt passwords=yes
password server = *
obey pam restrictions = yes
winbind cache time = 120
template shell = /sbin/nologin
template homedir = /none
idmap uid = 10000-19999
idmap gid = 10000-19999
winbind nested groups = yes
winbind separator = +
[theshare]
path=/smbroot/theshare
read only=no
-----------------------
------ nsswitch.conf ---
passwd: files winbind
group: files winbind
------------------------
------ pam.d/samba ----
auth required pam_winbind.so debug
account required pam_winbind.so
-----------------------
pam_winbind.so is only present in pam.d/samba
wbinfo -u
wbinfo -g
work fine
pw user show -a # this lists all the user account in a passwd format
shows all local and domain accounts (WINDOM+domuser:*:10021:10010:...)
Then I log into an XP machine as [EMAIL PROTECTED]
I open the network location: \\samba\theshare
I create some file, and I edit its properties I find in the ACL and as the owner
of the file:
domuser(SAMBA\domuser)
Then I log on the console of the Samba server as root, and
$ ls -ln /smbroot/theshare/dummyfile.txt
gives a UID of 10034 as the owner
pw user show -u 10034
returns:
domuser:*:10034:65534::0:0:domuser:/none/:/sbin/nologin
again I type: pw user show -a
all the domain users are present but domuser:*:10034 does not
appear in the list
When I turn on: winbind trusted domains only = yes
I get a login screen when I want to connect to the share
and log.smbd tells:
smbd/sesssetup.c:reply_spnego_kerberos(248)
Username WINDOM+domuser is invalid on this system
while log.winbind says:
nsswitch/winbindd_acct.c:winbindd_create_user(884)
winbindd_create_user: Refusing to create user that already exists
(domuser)
It is not clear to me if it is a kerberos or a winbind problem.
Has someone a clue?
Thanks
FX
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
