samba - Dec 2001 - Desperate -- I'll even pay -- winbind/samba -- challenge/response password authentication failed

No kidding folks, I need to get this working and am willing to pay money
for useful help!

I'm having problems getting "challenge/response password authentication
failed" with the command "wbinfo -a DOM+W2kusername%password".  I
presume this will prevent me from using my Windows usernames and
passwords to log into my Linux box.

My environment is a newly configured Redhat 7.2 server running samba
2.2.2 with winbind installed (smbd, nmbd, and winbindd are running).  I
need my authentication and logins to come from the Windows 2000 side.
Even though my Windows 2000 domain is native mode, my computer account
for the samba server is checked with "pre-2000 compatible".

I get good results with "wbinfo -u", "wbinfo -g",
"wbinfo -m", and
"wbinfo -t".  I was previously having problems with "Secret is
bad", but
got that fixed by making my one of my DC's the operations master (PDC
emulator) to reside in the same subnet as my samba server.

I also have positive results with all the samba tests in DIAGNOSIS.txt.

I can successfully execute "smbclient -L SAMBASERVER -U
W2kusername%password".  The username/password pair seems to be
successfully verified from my Windows side since this command works.  As
expected, it fails if I type the password wrong or if I unplug the
network cable.

I've tried deleting the computer account and recreating many times on my
Windows 2000 Domain Controller.  I then use the "smbpasswd -j DOM"
command to join my domain.  

Here is a copy of the failed command:

$ wbinfo -a DOM+W2kusername%password
plaintext password authentication succeeded
challenge/response password authentication failed
Could not authenticate user DOM+W2kusername%password with
challenge/response

The samba logs don't really tell me anything at all.

My smb.conf file is shown below.

I've also modified samba in /etc/pam.d per instructions.  Does that
really matter at this point anyway?

My ultimate goal is to login to my Redhat box with Windows usernames
(like DOM+W2kusername) and passwords that are authenticated from my
Windows 2000 domain controllers.  Hence my use of Winbind, which seems
written exactly for this purpose...

I've found similar postings on google, but no solutions!  I feel I'm so
close.  Please help!

James Hammond
Winthrop University




smb.conf file follows:

[global]

   workgroup = DOM
   netbios name = SAMBASERVER
   winbind separator = +
   winbind uid = 10000-20000
   winbind gid = 10000-20000
   winbind enum users = yes
   winbind enum groups = yes
   template shell = /bin/bash
   server string = Cool AA2 Samba Server

# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
;   hosts allow = 192.168.1. 192.168.2. 127.

# if you want to automatically load your printer list rather
# than setting them up individually then you'll need this
   printcap name = /etc/printcap
   load printers = yes

# It should not be necessary to spell out the print system type unless
# yours is non-standard. Currently supported print systems include:
# bsd, sysv, plp, lprng, aix, hpux, qnx
;   printing = bsd

# Uncomment this if you want a guest account, you must add this to
/etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest

# this tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
   max log size = 50

   security = domain
# "antony" is my W2k domain controller - it is listed in samba's
lmhosts
   password server = antony

# Password Level allows matching of _n_ characters of the password for
# all combinations of upper and lower case.
;  password level = 8
;  username level = 8

# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
  encrypt passwords = yes
  smb passwd file = /etc/samba/smbpasswd

# The following are needed to allow password changing from Windows to
# update the Linux sytsem password also.
# NOTE: Use these with 'encrypt passwords' and 'smb passwd file'
above.
# NOTE2: You do NOT need these to allow workstations to change only
#        the encrypted SMB passwords. They allow the Unix password
#        to be kept in sync with the SMB password.
;  unix password sync = Yes
;  passwd program = /usr/bin/passwd %u
;  passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password*
%n\n *passwd:*all*authentication*tokens*updated*successfully*

# Unix users can map to different SMB User names
;  username map = /etc/samba/smbusers

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /etc/samba/smb.conf.%m

# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
;   interfaces = 192.168.12.2/24 192.168.13.2/24 

# Configure remote browse list synchronisation here
#  request announcement to, or browse list sync from:
#	a specific host or from / to a whole subnet (see below)
;   remote browse sync = 192.168.3.25 192.168.5.255
# Cause this host to announce itself to local subnets here
;   remote announce = 192.168.1.255 192.168.2.44

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
;   local master = no

# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
;   os level = 33

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
;   domain master = yes 

# Preferred Master causes Samba to force a local browser election on
startup
# and gives it a slightly higher chance of winning the election
;   preferred master = yes

# Use only if you have an NT server on your network that has been
# configured at install time to be a primary domain controller.
;   domain controller = print.win.winthrop.edu

# Enable this if you want Samba to be a domain logon server for 
# Windows95 workstations. 
;   domain logons = yes

# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
;   logon script = %m.bat
# run a specific logon batch file per username
;   logon script = %U.bat

# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
;   logon path = \\%L\Profiles\%U

# All NetBIOS names must be resolved to IP Addresses
# 'Name Resolve Order' allows the named resolution mechanism to be
specified
# the default order is "host lmhosts wins bcast". "host"
means use the
unix
# system gethostbyname() function call that will use either /etc/hosts
OR
# DNS or NIS depending on the settings of /etc/host.config,
/etc/nsswitch.conf
# and the /etc/resolv.conf file. "host" therefore is system
configuration
# dependant. This parameter is most often of use to prevent DNS lookups
# in order to resolve NetBIOS names to IP Addresses. Use with care!
# The example below excludes use of name resolution for machines that
are NOT
# on the local network segment
# - OR - are not deliberately to be known via lmhosts or via WINS.
; name resolve order = wins lmhosts bcast

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS
Server
;   wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#	Note: Samba can be either a WINS Server, or a WINS Client, but
NOT both
;   wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one	WINS Server on the network. The default is NO.
;   wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The built-in default for versions 1.9.17 is yes,
# this has been changed in version 1.9.18 to no.
   dns proxy = no 

# Case Preservation can be handy - system default is _no_
# NOTE: These can be set on a per share basis
;  preserve case = no
;  short preserve case = no
# Default case is normally upper case for all DOS files
;  default case = lower
# Be very careful with case sensitivity - it can break things!
;  case sensitive = no

#============================ Share Definitions
=============================[homes]
   comment = Home Directories
   browseable = yes
   writable = yes

# Un-comment the following and create the netlogon directory for Domain
Logons
; [netlogon]
;   comment = Network Logon Service
;   path = /home/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no


# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
;[Profiles]
;    path = /home/profiles
;    browseable = no
;    guest ok = yes


# NOTE: If you have a BSD-style print system there is no need to 
# specifically define each individual printer
[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
# Set public = yes to allow user 'guest account' to print
   guest ok = no
   writable = no
   printable = yes

# I kept this available to test the basic samba connection
[tmp]
   comment = Temporary file space
   path = /tmp
   read only = no
   public = yes

On Monday 24 December 2001 18:30, Hammond, James T.S.
wrote:
> My ultimate goal is to login to my Redhat box with Windows usernames
> (like DOM+W2kusername) and passwords that are authenticated from my
> Windows 2000 domain controllers.  Hence my use of Winbind, which seems
> written exactly for this purpose...
Well I have this working for me, the problem is:

* winbindd running:
  - I can login as domain.user and get nice shell prompt
  - I can't connect to my samba server from Win boxes or via smbclient
* winbindd killed:
  - I can't login as domain.user and get nice shell prompt
  - I can connect to my samba server from Win boxes or via smbclient

My /etc/pam.d/login:
--------------------
# login via Samba winbind
# winbindd must be running for this to work
# Supplied password must match either /etc/passwd or NT domain password
# You don't have to have UNIX user/group to login!

auth		sufficient	/lib/security/pam_winbind.so
auth		required	/lib/security/pam_unix_auth.so use_first_pass nullok
account		required	/lib/security/pam_winbind.so
password	required	/lib/security/pam_unix_passwd.so
session		required	/lib/security/pam_unix_session.so

My smb.conf is after the sig. It has commented sections which were _verified_ 
_to _work_ too but are unused now.

Samba 2.2.2 compiled from sources.

Are you seriuos about "I'll even pay"? :-)
--
vda

#======================= Global Settings
====================================[global]

# Logging
#0..3 - ERR,WARN,NOTICE,INFO
  log file = /var/log/samba.%m
  max log size = 256
  debug level = 1
  syslog = 1
  syslog only = No

# makes ping <netbios name> work
# Note: 
# /etc/nsswitch: "hosts: files dns wins"
# /lib: libnss_wins.so, libnss_wins.so[.1|2 (glibc 1/2)]
  #name resolve order = lmhosts host wins bcast
  name resolve order = wins
  wins server = 172.16.42.102

# winbindd allows you to have user UID/GID be derived from NT PDC
# and domain users can log in your linux box (shell login, not just SMB 
connect!)
# without twiddling with /etc/passwd|shadow|group!
# PAM usage:
#   auth sufficient pam_winbind.so
#   account required pam_winbind.so
# Note: have to join domain, have to be in domain security mode
  # user syntax: DOMAIN.user
  winbind separator = .
  # Allocate uid/gid range for NT users
  winbind uid = 10000-20000
  winbind gid = 10000-20000
  # Recheck user/group id every N secs
  winbind cache time = 300
  # Home dir: %D:domain %U:user
  template homedir = /home/%D.%U
  template shell = /bin/bash

# Browser elections
  local master = yes
  preferred master = yes
  ;domain master = depands on security model, see below

# Username/passwd handling
  # If username is invalid, treat him as guest
  map to guest = Bad user
  # Allow users with null passwords to connect
  null passwords = yes
  # Allow logins from Win311/95/98 (weaker security)
  lanman auth = yes
  encrypt passwords = yes

;# Authenticate users using given WinNT box
;# - VDA: ok
;  workgroup = PORT
;  encrypt passwords = yes
;  security = server
;  password server = PORT_PDC
;  domain master = no

# Authenticate users using given WinNT domain
# - VDA: ok, but you'll need to create UNIX users for each connecting Win
one
# (same username as found on PDC)
# Update: [2001/12/07] can't make it accept domain users
#         when winbindd is running even if local user exists in /etc/passwd
#
  workgroup = PORT
  encrypt passwords = yes
  security = domain
  password server = *
  domain master = no

;# Authenticate users using local Samba
;# (we are part of a workgroup)
;# - VDA: ok.
;# Set passwords for users via smbpasswd!
;  workgroup = LINUX
;  os level = 33
;  security = share
;  domain logons = no

;# We are PDC for our domain (domain name set by 'workgroup')
;# Have to have [netlogon]
;# TODO: check:maybe we need [profiles] too?
;  workgroup = LINUX
;  os level = 34
;  security = user
;  domain logons = yes
;  domain master = yes # affects browser elections
;  ;# To be executed each time user logs in. Stored in [netlogon]
;  ;logon script = %u.bat
;  # Home dir and drive to map it to
;  # (%L: our server netbios name, %u: final user name)
;  logon home = \\%L\%u\home\%u
;  logon drive = w:
;  # Profiles dir for roaming profiles
;  logon path = \\%L\%u\home\%u\profiles

# Guess what is this?
  client code page = 866
  code page directory = /usr/lib/samba/lib/codepages

# ???
  socket options = TCP_NODELAY 

; TODO: try is this useful
;[global]
;  default service = pub
;
;[pub]
;  path = /%S
;
;!!!
;  preexec = ...
;  postexec = ...

#============================ Default share parameters ======================  #
Map guests to which UNIX user?
  guest account = guest
  # Share is visible by default?
  browseable = yes
  guest ok = yes
  # ???
  #browse list = yes
  read only = yes
  follow symlinks = yes
  create mode = 0644
  force create mode = 0600
  directory mode = 0755
  force directory mode = 0111
  # ???
  deadtime = 10

#============================ Share Definitions
=============================[-pub]
  path = /pub
  read only = yes
  guest ok = yes
  guest only = yes

[-in]
  path = /pub/in
  read only = no
  guest ok = yes
  guest only = yes

# Special share - replaced by username
# Check that this path is actually accessible by users!!!
[homes]
  ;path = /home/%S
  path = /.share
  only user = yes
  user = %S
  ;vda: hoped to allow \\serv\user for win9x. does not work: force user = %S
  guest ok = no
  read only = no
  # This stops [homes] to be visible itself
  # User shares inherit global setting and hence are visible
  browseable = no

;# Special share - replaced by printer name(s)
;[printers]
;  comment = All Printers
;  path = /var/spool/samba
;  browseable = no
;# Set public = yes to allow user 'guest account' to print
;  guest ok = no
;  writable = no
;  printable = yes

# Special share: used for logons if we are PDC
# It stores logon scripts, ??? what else ???
[netlogon]
  path = /var/app/samba-2.2.2/netlogon
  public = no
  writable = no
  browsable = no

# ???
[profiles]
  path = /var/app/samba-2.2.2/profiles
  browseable = no
  guest ok = yes