Andrew,
Thanks for your response. This reply is actually not a request for
additional help. After much searching throught the lists and Google
along with a lot of experimentation, I think I've got it (mostly) figure
out. This post is just an effort to help others who might be struggling
with the same issues as I was. I'm sure it's far from perfect and if
anyone has suggestions on improving something, I'd like to hear them.
Server Information:
Redhad 8.0 w/ kernel 2.4.28-18.8.0
Samba 3.0 alpha 21
Just to be sure, I've started at the beginning and double checked
everything to make sure it matches the documentation I have. Also, I
apologize for the wordiness, but hopefully this will help someone else.
Here's what I've done so far:
I successfully joined the domain (actually this shows me re-joining):
# /usr/local/samba/bin/net ads join
[2003/01/30 15:30:04, 0] libads/ldap.c:ads_join_realm(1325)
Host account for lintest already exists - deleting old account
Joined 'LINTEST' to realm 'MYDOMAIN.ORG'
Then to make sure I could actually authenticate up to the w2k ads
server:
# ../bin/smbclient //postoffice/c\$ -k
added interface ip=10.1.46.5 bcast=10.1.47.255 nmask=255.255.240.0
Doing spnego session setup (blob length=113)
Doing kerberos session setup
OS=[Windows 5.0] Server=[Windows 2000 LAN Manager]
smb: \>
At the prompt, I was able to traverse all directories, etc.
In following the winbind documentation, I tried joining the domain again
after configuring my smb.conf file (figuring this wouldn't work since
it's quite a bit different than the 1st join command):
# bin/net rpc join -s PDC -U john.doe
[2003/01/30 16:06:41, 0] param/params.c:OpenConfFile(532)
params.c:OpenConfFile() - Unable to open configuration file "PDC":
No such file or directory
[2003/01/30 16:06:42, 1] utils/net.c:net_find_server(224)
no server to connect to
Unable to find a suitable server
[2003/01/30 16:06:43, 1] utils/net.c:net_find_server(224)
no server to connect to
Unable to find a suitable server
Figuring I've already joined the domain, I proceeded in following the
documentation. I started up winbindd (which shows as running after
issuing "ps ax"), then tried:
# bin/wbinfo -u
MYDMN+Administrator
MYDMN+Guest
MYDMN+krbtgt
MYDMN+john.doe
MYDMN+jane.smith
MYDMN+george
<snip>
Which finally worked. Then I tried:
#wbinfo -g (this worked also)
Then I tried:
#wbinfo -t
got this:
[root@lintest samba]# bin/wbinfo -t
checking the trust secret via RPC calls failed
error code was NT_STATUS_ACCESS_DENIED (0xc0000022)
Could not check secret
Logs show:
[2003/01/31 08:34:05, 1]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(300)
cli_nt_setup_creds: auth2 challenge failed NT_STATUS_ACCESS_DENIED
[2003/01/31 08:34:05, 0] nsswitch/winbindd_cm.c:cm_get_netlogon_cli(936)
error connecting to domain password server: NT_STATUS_ACCESS_DENIED
Windows event viewer shows this:
The session setup from the computer LINTEST failed to authenticate. The
name of the account referenced in the security database is LINTEST$.
The following error occurred:
Access is denied.
I finally found a fix for this. My nsswitch.conf file had the shadow
line incorrect. It was:
=============================## nsswitch.conf
## created by Rick
passwd: files winbind
shadow: files winbind
group: files winbind
=============================
It is now:
=============================## nsswitch.conf
## created by Rick
passwd: files winbind
shadow: files
group: files winbind
============================
Amazing how such a small oversight can effect things.
Now this works:
[root@lintest samba]# bin/wbinfo -t
checking the trust secret via RPC calls succeeded
Since this fix, my log now show:
[2003/01/31 09:23:52, 1]
nsswitch/winbindd_util.c:add_trusted_domain(140)
Added domain MYDMN
[2003/01/31 09:24:02, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:24:12, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:24:22, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:24:34, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:24:44, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:24:54, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:25:06, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
[2003/01/31 09:25:16, 1] nsswitch/winbindd_util.c:init_domain_list(220)
Retrying startup domain sid fetch for MYDMN
<snip>
As you can see, this continues about every 10 seconds.
I changed my smb.conf file back (I had been experimenting with the
difference in the security = domain vs. = ADS and password = * vs. <server
name>). I am now able to connect to the samba server from the
domain logged in w2k workstation (without asking for a password).
Yahoo!!!
BUT - then it occurred to me that the user I'm using is in the
/etc/passwd file (but not in the smbpasswd file). I commented this user
out (using #). After this, the user could not connect to the samba
server. In the documentation, it appears that I need to use "getent
passwd" and "getent group" to pull down the user list and groups
from
the server. This doesn't seem to work. Here's what I get:
#getent passwd
This seemed to only list the current contents of my /etc/passwd file.
It's my understanding that it should list this and then follow it with
the domain users with their new uids, gids, home direcoties and default
shells. All I got was the /etc/passwd file.
Log shows:
[2003/01/31 11:22:35, 0] nsswitch/winbindd.c:process_loop(620)
process_loop: Invalid request size from pid 10640: 1304 bytes sent,
should be
1564
[2003/01/31 11:22:35, 0] nsswitch/winbindd.c:process_loop(620)
process_loop: Invalid request size from pid 10640: 1304 bytes sent,
should be
1564
As I would expect, "getent group" works the same.
I found a posting from 2002-05-06 with a similar error in which you
thought the winbindd libraries did not match. I'm using the version
that came with the alpha21 package (I thought).
Then I found a posting that showed the libnss_winbind.so libraries are
not created by make (although it didn't say how to do that). Found a
posting via Google
(http://samba.cadcamlab.org/lists/samba-technical/Apr2002/00059.html)
which also indicated that the libnsswitch_winbind.so library is not
created by make. Followed his instructions "make
nsswitch/libnss_winbind.so" from the source directory, then copied it to
/lib and another problem resolved. No more "Invalid request size...."
errors.
#getent passwd (now works)
#getent group (now works)
Now my workstation will successfully login to samba server without
asking for a password and without a user/passwd in /etc/passwd or
smbpasswd. However, no other machine can seem to log in (even when
using the same account). No errors or logs on the samba box or the dc.
This seemed odd, so I relogged into my w2k workstation, and now it will
not log in either. Interesting.
Then I noticed this in the logs:
[2003/01/31 13:10:12, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(127)
user 'IP-RSEGEBE50172$' does not exist
However, I have found that this does not seem to matter. What mattered
were the directory permissions (right now I only have [homes] shared
out). By using getent group, I was able to find the group number of a
group that my user belonged to. All I have to do is chown and chmod the
directory to which I want that share available to and it works.
Here's an example:
In my ADS, I have group called IT. Using "getent group|grep IT" I
find
my group number is 12345. I create a directory on my samba box called
"it_dudes", then issue the following commands as root:
#chown 12345 it_dudes
#chmod 770 it_dudes
If you do an ls -l, you'll see a pretty cool listing, like this:
drwxrwx--- 2 root DOMAIN+IT 4096 Dec 16 10:39 it_dudes
Now everyone in the "it_dudes" group has full permission to whatever
is
there.
Of course, the above directory has to be shared out appropriately in
smb.conf. My configs (below) only show basic configurations, but you
really should add to it such entries as the umask, default permissions
(of the share that is), etc.
Notes:
1) My Windows 2000 ADS domain name is MYDOMAIN.ORG, however my NT domain
name is MYDMN. Anything that shows ADS listings (such as getent group)
always shows the NT domain name.
2) I did all of my work via telnet windows (actually ssh). It was
helpful to have one of the windows open with "tail -f log.winbindd
|more" running as I could see cause and effect related problems and
successes. Also, my ssh session has a nice big buffer so I can scroll
back and see things I might have missed.
3) Somewhere in all of this, I added root to the smbpasswd file. I know
it helped, but now I don't remember what it was.
4) There is a smb startup/stop/restart script at the end of this also.
Very helpful with all the restarts I had to do when making changes.
5) If I think of or discover anything else, I will post it.
Here's my config files:
*********smb.conf*****************
[global]
workgroup = MYDMN
netbios name = LINTEST
realm = MYDOMAIN.ORG
ads server = 10.1.30.39
server string = %L running Samba %v
security = ADS
password server = postoffice
passwd program = /usr/bin/passwd %u
encrypt passwords = yes
unix password sync = Yes
log file = /var/log/samba/log.%m
preferred master = No
local master = No
#added 1/31/03
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
domain master = No
dns proxy = no
ldap ssl = no
# Winbind stuff
winbind separator = +
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = No
template homedir = /home/%U
template shell = /bin/bash
[homes]
guest ok = no
read only = no
[users]
path=/home
guest ok = no
read only = no
***********krb5.conf************
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
default_realm = MYDOMAIN.ORG
dns_lookup_realm = false
dns_lookup_kdc = false
[realms]
MYDOMAIN.ORG = {
kdc = 10.1.30.39
default_domain = mydomain.org
}
# admin_server = postoffice.mydomain.org
[domain_realm]
.mydomain.org = MYDOMAIN.ORG
mydomain.org = MYDOMAIN.ORG
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
*******nsswitch.conf************
## nsswitch.conf
## created by Rick
passwd: files winbind
shadow: files
group: files winbind
********ldap.conf (condensed to show only what I changed or
added)**************
# @(#)$Id: ldap.conf,v 1.24 2001/09/20 14:12:26 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# PADL Software
# http://www.padl.com
#
# Your LDAP server. Must be resolvable without using LDAP.
host 10.1.30.39
# The distinguished name of the search base.
base dc=mydomain,dc=org
<snip>
# The port.
# Optional: default is 389.
#port 389
# The search scope.
scope sub
#scope one
#scope base
# Search timelimit
#timelimit 30
<snip>
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
nss_base_passwd dc=mydomain,dc=org?sub
nss_base_shadow dc=mydomain,dc=org?sub
nss_base_group dc=mydomain,dc=org?sub
#nss_base_passwd ou=People,dc=example,dc=com?one
#nss_base_shadow ou=People,dc=example,dc=com?one
#nss_base_group ou=Group,dc=example,dc=com?one
#nss_base_hosts ou=Hosts,dc=example,dc=com?one
#nss_base_services ou=Services,dc=example,dc=com?one
#nss_base_networks ou=Networks,dc=example,dc=com?one
#nss_base_protocols ou=Protocols,dc=example,dc=com?one
#nss_base_rpc ou=Rpc,dc=example,dc=com?one
#nss_base_ethers ou=Ethers,dc=example,dc=com?one
#nss_base_netmasks ou=Networks,dc=example,dc=com?ne
#nss_base_bootparams ou=Ethers,dc=example,dc=com?one
#nss_base_aliases ou=Aliases,dc=example,dc=com?one
#nss_base_netgroup ou=Netgroup,dc=example,dc=com?one
<snip>
******* smb startup file ***********
#!/bin/bash
#start/stop/restart samba
samba_start() {
echo "starting smbd"
/usr/local/samba/sbin/smbd -D:
echo "starting nmbd"
/usr/local/samba/sbin/nmbd -D
echo "starting winbind"
/etc/init.d/winbind.init start
}
samba_stop() {
echo "stopping smbd nmbd"
killall smbd nmbd
echo "stopping winbind"
killall winbindd
}
samba_restart() {
samba_stop
sleep 1
samba_start
}
case "$1" in
'start')
samba_start
;;
'stop')
samba_stop
;;
'restart')
samba_restart
;;
*)
echo "usage $0 start|stop|restart"
esac
********************************
I hope this helps someone somewhere.
Rick Segeberg
Provo Site Manager, IT Department
The Waterford Institute
rick.segeberg@waterford.org
-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@samba.org]
Sent: Wednesday, January 29, 2003 3:04 AM
To: Rick Segeberg
Cc: samba@lists.samba.org
Subject: Re: [Samba] Samba 3 & ADS current capabilities [adr]
On Wed, 2003-01-29 at 07:39, Rick Segeberg wrote:> I have been working to get a Samba 3 (alpha 21) on Red Hat 8.0 to work
> with our current Windows 2000 ADS. This is "pure" ADS (ie. no
compatibility > mode). Our desire is to have various samba servers join the domain
> and use the domain to authenticate users to the samba servers. It's
> my understanding that winbind is necessary.
>
> I've followed lots of HOWTO's and various articles as well as
search
the > list archives and have not gotten it to work and have not found quite
what > I am looking for (although much has still been very helpful). I was
able to > successfully have the samba server join the domain (it shows up in
> ADS), and I can authenticate to the w2k box from the samba box just
> fine. But, I cannot authenticate back to samba box from a windows
> workstation (which is logged into the domain) unless I also have the
> login name and password in the smbpasswd file. Also, when I try any
> of the wbinfo tests, they fail.
Which tests - and what exactly do you mean by 'fail'. Are you really
sure you correctly joined the domain?
> I understand it's still in alpha and just to make sure I'm not
trying
> something that's not available/working yet, I need to know if this is
> possible. So the question is:
>
> Can a workstation in the ADS domain be authenticated to a samba 3
server > via W2K ADS (with no compatibility mode)?
Yes - shipping products are based on exactly this functionality.
You are going to need to give some more info on the join, and any
particular errors in the logs.
Andrew Bartlett
--
Andrew Bartlett abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team abartlet@samba.org
Student Network Administrator, Hawker College abartlet@hawkerc.net
http://samba.org http://build.samba.org http://hawkerc.net
*************************************
This email may contain privileged or confidential material intended for the
named recipient only.
If you are not the named recipient, delete this message and all attachments.
Any review, copying, printing, disclosure or other use is prohibited.
We reserve the right to monitor email sent through our network.
*************************************