Having issues adapting our 3.4 configuration that worked very well using idmap
rid in 3.3.
It seems like winbind does not cache the credentials despite all of the settings
being present. I can set winbind offline via smbcontrol and have it work, but if
I reboot the machine (important for my laptops) off the network winbind
complains that it can't find the logon server.
When disconnected and booted cold off the network, logon reports no logon
server.
Testing with wbinfo -K while offline:
wbinfo -K bry47927
Enter bry47927's password:
plaintext kerberos password authentication for [bry47927] succeeded (requesting
cctype: FILE)
user_flgs: NETLOGON_CACHED_ACCOUNT
no credentials cached
Not sure why this works but regular logon does not.
Samba config:
This configuration works fine connected to the LAN. But, having to digest more
than a year's worth of changes and updates I'm not sure if the idmap
settings are really correct.
[global]
workgroup = AES
realm = AES.DE.ITTIND.COM
server string = Samba Server Version %v
security = ADS
password server = 2008dc
log file = /var/log/samba/log.%m
max log size = 50
enable core files = No
idmap backend = tdb
idmap uid = 800 - 9999
idmap gid = 800 - 9999
# idmap domains = BUILTIN, AES
# idmap config AES: default = yes
idmap config AES: backend = rid
template shell = /bin/bash
winbind use default domain = Yes
winbind offline logon = Yes
idmap config AES : range = 100000 - 900000
cups options = raw
pam settings:
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_krb5.so use_first_pass
auth sufficient pam_winbind.so cached_login use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account [default=bad success=ok user_unknown=ignore] pam_winbind.so
cached_login
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 minlen=12
dcredit=1 ucredit=1 lcredit=1 ocredit=1
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password sufficient pam_krb5.so use_authtok
password sufficient pam_winbind.so cached_login use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session required pam_unix.so
session optional pam_krb5.so
pam_winbind.conf:
[global]
# turn on debugging
;debug = no
# turn on extended PAM state debugging
;debug_state = no
# request a cached login if possible
# (needs "winbind offline logon = yes" in smb.conf)
cached_login = yes
# authenticate using kerberos
;krb5_auth = yes
# when using kerberos, request a "FILE" krb5 credential cache type
# (leave empty to just do krb5 authentication but not have a ticket
# afterwards)
;krb5_ccache_type = file
Nsswitch.conf:
passwd: files winbind
shadow: files winbind
group: files winbind
Phillip Bryant - ABQ IT Site Lead
5901 Indian School Rd NE
ph# 505-889-7016
cell# 505-385-8668
RHCT/RHCE RHEL 5 ID#805009017938113
MCSE NT4.0, 2000, 2003, 2008 MCP ID#1150956
MCTS Windows 7, Windows Server 2008 Enterprise
MCP+I
MCP
________________________________
This e-mail and any files transmitted with it may be proprietary and are
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those
of the author and do not necessarily represent those of ITT Corporation. The
recipient should check this e-mail and any attachments for the presence of
viruses. ITT accepts no liability for any damage caused by any virus transmitted
by this e-mail.
Did you check the release notes for 3.4? I have the same config(cached_login) as you and works fine on 3.2. On Fri, Apr 16, 2010 at 5:17 PM, Bryant, Phillip - IS < Phillip.Bryant at itt.com> wrote:> Having issues adapting our 3.4 configuration that worked very well using > idmap rid in 3.3. > > It seems like winbind does not cache the credentials despite all of the > settings being present. I can set winbind offline via smbcontrol and have it > work, but if I reboot the machine (important for my laptops) off the network > winbind complains that it can't find the logon server. > > When disconnected and booted cold off the network, logon reports no logon > server. > > Testing with wbinfo -K while offline: > wbinfo -K bry47927 > Enter bry47927's password: > plaintext kerberos password authentication for [bry47927] succeeded > (requesting cctype: FILE) > user_flgs: NETLOGON_CACHED_ACCOUNT > no credentials cached > > Not sure why this works but regular logon does not. > > Samba config: > This configuration works fine connected to the LAN. But, having to digest > more than a year's worth of changes and updates I'm not sure if the idmap > settings are really correct. > [global] > workgroup = AES > realm = AES.DE.ITTIND.COM > server string = Samba Server Version %v > security = ADS > password server = 2008dc > log file = /var/log/samba/log.%m > max log size = 50 > enable core files = No > idmap backend = tdb > idmap uid = 800 - 9999 > idmap gid = 800 - 9999 > # idmap domains = BUILTIN, AES > # idmap config AES: default = yes > idmap config AES: backend = rid > template shell = /bin/bash > winbind use default domain = Yes > winbind offline logon = Yes > idmap config AES : range = 100000 - 900000 > cups options = raw > > pam settings: > > auth required pam_env.so > auth sufficient pam_fprintd.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 500 quiet > auth sufficient pam_krb5.so use_first_pass > auth sufficient pam_winbind.so cached_login use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_localuser.so > account sufficient pam_succeed_if.so uid < 500 quiet > account [default=bad success=ok user_unknown=ignore] pam_krb5.so > account [default=bad success=ok user_unknown=ignore] pam_winbind.so > cached_login > account required pam_permit.so > > password requisite pam_cracklib.so try_first_pass retry=3 minlen=12 > dcredit=1 ucredit=1 lcredit=1 ocredit=1 > password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_krb5.so use_authtok > password sufficient pam_winbind.so cached_login use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > session optional pam_mkhomedir.so > session [success=1 default=ignore] pam_succeed_if.so service in crond > quiet use_uid > session required pam_unix.so > session optional pam_krb5.so > > pam_winbind.conf: > > [global] > > # turn on debugging > ;debug = no > > # turn on extended PAM state debugging > ;debug_state = no > > # request a cached login if possible > # (needs "winbind offline logon = yes" in smb.conf) > cached_login = yes > > # authenticate using kerberos > ;krb5_auth = yes > > # when using kerberos, request a "FILE" krb5 credential cache type > # (leave empty to just do krb5 authentication but not have a ticket > # afterwards) > ;krb5_ccache_type = file > > Nsswitch.conf: > > passwd: files winbind > shadow: files winbind > group: files winbind > > > > Phillip Bryant - ABQ IT Site Lead > 5901 Indian School Rd NE > ph# 505-889-7016 > cell# 505-385-8668 > RHCT/RHCE RHEL 5 ID#805009017938113 > MCSE NT4.0, 2000, 2003, 2008 MCP ID#1150956 > MCTS Windows 7, Windows Server 2008 Enterprise > MCP+I > MCP > > > ________________________________ > This e-mail and any files transmitted with it may be proprietary and are > intended solely for the use of the individual or entity to whom they are > addressed. If you have received this e-mail in error please notify the > sender. > Please note that any views or opinions presented in this e-mail are solely > those of the author and do not necessarily represent those of ITT > Corporation. The recipient should check this e-mail and any attachments for > the presence of viruses. ITT accepts no liability for any damage caused by > any virus transmitted by this e-mail. > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >
Maybe Matching Threads
- {Samba4] Problem with Joining Samba3 to Samba4 AD Domain
- ssh not connecting to Active Directory in Fedora 25 workstation, wbinfo -u works; child_read_request: read_data failed: NT_STATUS_CONNECTION_RESET
- kerberos ticket on login problem
- winbind pam error
- kerberos ticket on login problem