samba - Nov 2002 - Winbind basic questions

I have been trying to setup a Samba 2.2.6 server on FreeBSD 4.7. I want to
use my NT4 domain for authentication of users. I am getting confused reading
all the documents as to whether I need PAM or not. I have installed Samba
successfully and  as far as I can tell it looks like it's working:

wbinfo -t returns "Secret is good"
wbinfo -u returns a list of all my domain users
wbinfo -g returns a list of all domain groups
wbinfo -a mydomain+myuser%mypassword returns success for both plaintext and
challenge/response

- Do I have to use PAM if all I want is to access the following Samba share
from my W2K clients?
- Should I install Samba configured using --with-winbind, or
--with-winbind-auth-challenge as well (I have tried both but neither work)
- If I do need PAM, I am reading conflicting info from the
/swat/help/PAM-Authentication-And-Samba.html file. It states "Note that
Samba always ignores PAM for authentication in the case of encrypt passwords
= yes", which I need if I am using security = domain
- If I do not need PAM to authenticate and it "appears" that I have
installed and configured samba / winbind properly as per the wbinfo lines
above, why can't I access the share?
- Do I need to create user accounts on the samba server? (I hope not, I
understand that's what winbind is for)
- Do I need to create any machine accounts? (Other than joining the samba
server to the domain.)


Here's my smb.conf:
# Samba config file created using SWAT
# from 10.110.22.40 (10.110.22.40)
# Date: 2002/11/16 15:19:26

# Global parameters
[global]
	workgroup = MYDOMAIN
	security = DOMAIN
	encrypt passwords = Yes
	password server = *
	winbind uid = 10000-20000
	winbind gid = 10000-20000
	winbind separator = +
	winbind enum users = yes
	winbind enum groups = yes
	log level = 2
	wins server = 192.168.0.7

[work]
	path = /usr/work
	valid users = @"Domain Users"
	read only = No

Here's my log.smbd:
[2002/11/16 15:59:13, 2] param/loadparm.c:do_section(3055)
  Processing section "[work]"
[2002/11/16 15:59:13, 2] lib/interface.c:add_interface(81)
  added interface ip=10.110.22.78 bcast=10.110.23.255 nmask=255.255.254.0
[2002/11/16 15:59:48, 2] smbd/reply.c:reply_special(92)
  netbios connect: name1=EDM-GEO          name2=EDM-02         
[2002/11/16 15:59:48, 2] smbd/reply.c:reply_special(111)
  netbios connect: local=edm-geo remote=edm-02
[2002/11/16 15:59:48, 2] libsmb/namequery.c:name_query(421)
  Got a positive name query response from 10.110.22.7 ( 10.110.22.7 )
[2002/11/16 15:59:48, 2] lib/util_sock.c:open_socket_out(874)
  error connecting to 10.110.22.7:445 (Invalid argument)
[2002/11/16 15:59:54, 2] smbd/service.c:make_connection(331)
  Invalid username/password for work [nobody]
[2002/11/16 15:59:56, 2] smbd/service.c:make_connection(331)
  Invalid username/password for work [nobody]
[2002/11/16 16:00:47, 2] smbd/server.c:exit_server(461)
  Closing connections

> - Do I have to use PAM if all I want is to access the 
> following Samba share from my W2K clients?
Nope.  Should work just fine.
> - Should I install Samba configured using --with-winbind, or 
> --with-winbind-auth-challenge as well (I have tried both but 
> neither work)
It shouldn't matter, but I am not sure.
> - If I do need PAM, I am reading conflicting info from the 
> /swat/help/PAM-Authentication-And-Samba.html file. It states 
> "Note that Samba always ignores PAM for authentication in the 
> case of encrypt passwords = yes", which I need if I am using 
> security = domain
I'm sorry.  Once again, I don't know.  I have found that I can generally
trust the documentation.
> - If I do not need PAM to authenticate and it "appears" that 
> I have installed and configured samba / winbind properly as 
> per the wbinfo lines above, why can't I access the share?
I think the problem is in your smb.conf.  Try removing your valid users line
in the share and see if you can get in without any constraints.  Once you
get connected, then you can tighten up to the proper level.  I would suggest
you try adding your domain in something like:
valid users = @"DOMAIN+Domain Users"
> - Do I need to create user accounts on the samba server? (I 
> hope not, I understand that's what winbind is for)
No.  Your right about what winbind is.
> - Do I need to create any machine accounts? (Other than 
> joining the samba server to the domain.)
You should be golden.

Hope this helps and that I didn't lead you down the wrong path.

Cary

On 18 Nov 2002 at 13:13, Brent Ross (Edm) wrote:
> - Do I have to use PAM if all I want is to access the following Samba share
from
> my W2K clients? 
No.

- Should I install Samba configured using --with-winbind,
or
> --with-winbind-auth-challenge as well (I have tried both but neither work)
- If
It's irrelevant.

> I do need PAM, I am reading conflicting info from the
> /swat/help/PAM-Authentication-And-Samba.html file. It states "Note
that Samba
> always ignores PAM for authentication in the case of encrypt passwords =
yes",
> which I need if I am using security = domain - If I do not need PAM to
you need security=domain.

> Do I need to create user accounts on the samba server? (I hope not, I
understand
> that's what winbind is for) - Do I need to create any machine accounts?
(Other
> than joining the samba server to the domain.)
You need to join the server 
to the domain, yes.
You probably need to 
create local accounts. Try 
with one, try to access it. 
Take out the valid users 
until you can access it 
correctly, then tighten it. :-)

You can't use all of the 
winbind features... I dream 
the day nsswitch is fully 
implemented on freebsd :-)

      
      ...:-=>> The freaking 
Mail Band <<=-:...
                  
hununu@netcabo.pt