Edward Wissner wrote:
What did you change in your smb.conf file?
Well, I managed to get samba to authenticate, however, continued
winbindd problems make the setup worthless. Group searches fail, or are
incomplete. Domain users and groups list without domain id. net
groupmap fails. Attempts to re-join via "net ads join" fail.
If your interested, I have copied all the relevant config files here:
_*smb.conf:*_
workgroup = FSK
realm = FSKLAW.NET
server string = SSERVER
netbios name = SSERVER
security = ADS
client schannel = Yes
server schannel = Yes
passdb backend = ldapsam:ldap://w2000.fsklaw.net
socket options = TCP_NODELAY
dns proxy = No
ldap admin dn = cn=Administrator,cn=users,DC=fsklaw,DC=net
ldap suffix = DC=fsklaw,DC=net
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind separator = /
winbind enum users = No
winbind enum groups = No
winbind use default domain = Yes
dos filemode = Yes
acl compatibility = win2k
inherit acls = yes
inherit permissions = yes
[FSK]
path = /home/FSK
public = yes
only guest = no
browseable = yes
writeable = yes
printable = no
create mask = 0777
force create mode = 0777
force directory mode = 0777
directory security mask = 0777
_*ldap.conf:
*_
host w2000.fsklaw.net
base dc=fsklaw,dc=net
ldap_version 3
URI ldaps:w2000.fsklaw.net
scope sub
pam_login_attribute Administrator
pam_password md5
idle_timelimit 3600
nss_base_passwd cn=Users,dc=fsklaw,dc=net?one
nss_base_group cn=Users,dc=fsklaw,dc=net?one
ssl on
TLS_CACERT /etc/CA/fsk.pem
tls_ciphers TLSv1
sasl_secprops maxssf=0
krb5_ccname FILE:/tmp/krb5cc_0
_*nsswitch.conf:
*_
passwd: files winbind
shadow: files winbind
group: files winbind
hosts: dns winbind ldap files nis
automount: files winbind ldap nisplus
aliases: files winbind ldap nisplus
_*krb5.conf:*_
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
default_realm = FSKLAW.NET
dns_lookup_realm = false
dns_lookup_kdc = false
default_etypes = des-cbc-crc des-cbc-md5
default_etypes_des = des-cbc-crc des-cbc-md5
default_keytab-name = FILE:/etc/krb5.keytab
[realms]
FSKLAW.NET = {
kdc = KERBEROS.FSKLAW.NET
admin_server = w2000.fsklaw.net
default_domain= fsklaw.net
}
[domain_realm]
.fsklaw.net = FSKLAW.NET
fsklaw.net = FSKLAW.NET
.FSKLAW.NET = FSKLAW.NET
.kerberos.server = KERBEROS.FSKLAW.NET
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
_*pam.d/login:
*_
#
# $FreeBSD: src/etc/pam.d/login,v 1.16 2003/06/14 12:35:05 des Exp $
#
# PAM configuration for the "login" service
#
# auth
auth required pam_nologin.so no_warn
auth sufficient pam_self.so no_warn
auth include system
auth sufficient /usr/local/lib/pam_winbind.so
# account
account requisite pam_securetty.so
account include system
account sufficient /usr/local/lib/pam_winbind.so
# session
session include system
# password
password include system
-----Original Message-----
From: Tom Skeren [mailto:[EMAIL PROTECTED]
Sent: Tuesday, December 07, 2004 4:04 PM
To: Jeremy Allison
Cc: samba
Subject: Re: [Samba] ADS Authentication
Jeremy Allison wrote:
It was an smb.conf issue. Authentication against ADS is now
functioning. Now it's time to wrestle with ACLs. Thanks for the help.
TMS III
On Mon, Dec 06, 2004 at 02:29:29PM -0800, Tom Skeren wrote:
I'm about ready to smash my head through a wall...I could use a few
answers.
1. When using security = ads, and completing net ads join, it was my
understanding that samba authenticated username/pword against ads, and
local posix accounts were nolonger needed, is this true?
Yes, so long as you have nsswitch and pam set up correctly. It sounds
like you don't.
Jeremy.
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
