thr3ads.net - samba - [Samba] getent passwd cannot list win2k ADS users [Dec 2003]

If this information is useful, please help other people find it:
Share via:

maorui

2003-Dec-01 09:24 UTC

[Samba] getent passwd cannot list win2k ADS users

I'm using RH9, and install Samba 3.0.0 by using rpm package.



I use following configure files.



/etc/samba/smb.conf:

    [global]
            workgroup = DOMAIN
            realm = DOMAIN.COM
            server string = Demo Samba Server
            security = ADS
            username map = /etc/samba/smbusers
            log file = /var/log/samba/log.%m
            max log size = 50
            socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
            preferred master = No
            local master = No
            domain master = No
            dns proxy = No
            idmap uid = 10000-20000
            idmap gid = 10000-20000
            template homedir = /home/windomain/%D/%U
            template shell = /bin/bash
            winbind separator = +


/etc/krb5.conf:

    [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log



    [libdefaults]
     ticket_lifetime = 24000
     default_realm = DOMAIN.COM
     dns_lookup_realm = false
     dns_lookup_kdc = false



    [realms]
     DOMAIN.COM = {
      kdc = server.domain.com:88
      admin_server = server.domain.com:749
      default_domain = domain.com
     }



    [domain_realm]
     .domain.com = DOMAIN.COM
     domain.com = DOMAIN.COM



    [kdc]
     profile = /var/kerberos/krb5kdc/kdc.conf



    [appdefaults]
     pam = {
       debug = false
       ticket_lifetime = 36000
       renew_lifetime = 36000
       forwardable = true
       krb4_convert = false
     }



/etc/nsswitch.conf:

    passwd:     files winbind
    shadow:     files
    group:      files winbind

    hosts:      files dns

    bootparams: nisplus [NOTFOUND=return] files

    ethers:     files
    netmasks:   files
    networks:   files
    protocols:  files
    rpc:        files
    services:   files

    netgroup:   files

    publickey:  nisplus

    automount:  files
    aliases:    files nisplus

And I update MIT Kerberos package by following steps:

    1.
./configure --prefix=/usr/kerberos --localstatedir=/var/kerberos --enable-dn
s

    2. make

    3. make install



I entered command 'kinit administrator', and got no error message.



'klist -5' returned:

Ticket cache: FILE:/tmp/krb5cc_0
    Default principal: maor@DOMAIN.COM



    Valid starting     Expires            Service principal
    12/01/03 15:37:13  12/02/03 01:37:13  krbtgt/DOMAIN.COM@DOMAIN.COM
    12/01/03 15:50:33  12/02/03 01:37:13  server-file$@DOMAIN.COM

And commands

    net ads join -S server.domain.com -U administrator

    net rpc join -S server.domain.com -U administrator

worked fine.



I started winbindd. 'wbinfo -u' & 'wbinfo -g' can get all
users & groups
from domain.







But the command 'getent passwd' could only show local accounts, without
any
domain mapped accounts inside.

And /home had no any home directory created.



Who can tell me which step I made a mistake?





--------------- Logs -----------------

/var/log/samba/log.winbindd:

[2003/12/01 15:48:45, 1] nsswitch/winbindd.c:main(832)
  winbindd version 3.0.0 started.
  Copyright The Samba Team 2000-2003
[2003/12/01 15:48:46, 1] nsswitch/winbindd_util.c:add_trusted_domain(149)
  Added domain DOMAIN.COM
[2003/12/01 15:48:46, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 15:48:46, 1] nsswitch/winbindd_ads.c:ads_cached_connection(64)
  ads_connect for domain DOMAIN.COM failed: Operations error
[2003/12/01 15:48:46, 1] nsswitch/winbindd_util.c:init_domain_list(284)
  Could not fetch sid for our domain DOMAIN.COM
[2003/12/01 15:48:46, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 15:48:46, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 15:49:07, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 15:49:07, 1] nsswitch/winbindd_ads.c:ads_cached_connection(64)
  ads_connect for domain DOMAIN.COM failed: Operations error
[2003/12/01 16:16:36, 1] nsswitch/winbindd.c:main(832)
  winbindd version 3.0.0 started.
  Copyright The Samba Team 2000-2003
[2003/12/01 16:16:36, 1] nsswitch/winbindd_util.c:add_trusted_domain(149)
  Added domain DOMAIN.COM
[2003/12/01 16:16:36, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 16:16:36, 1] nsswitch/winbindd_ads.c:ads_cached_connection(64)
  ads_connect for domain DOMAIN.COM failed: Operations error
[2003/12/01 16:16:36, 1] nsswitch/winbindd_util.c:init_domain_list(284)
  Could not fetch sid for our domain DOMAIN.COM
[2003/12/01 16:16:36, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:16:36, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 16:16:46, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 16:16:46, 1] nsswitch/winbindd_ads.c:ads_cached_connection(64)
  ads_connect for domain DOMAIN.COM failed: Operations error
[2003/12/01 16:21:46, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:21:46, 0] libsmb/cliconnect.c:cli_session_setup_spnego(683)
  Kinit failed: Malformed representation of principal
[2003/12/01 16:25:18, 1] nsswitch/winbindd.c:main(832)
  winbindd version 3.0.0 started.
  Copyright The Samba Team 2000-2003
[2003/12/01 16:25:18, 1] nsswitch/winbindd_util.c:add_trusted_domain(149)
  Added domain DOMAIN DOMAIN.COM
[2003/12/01 16:25:18, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 16:25:18, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:25:18, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:30:45, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:35:46, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:38:29, 1] nsswitch/winbindd.c:main(832)
  winbindd version 3.0.0 started.
  Copyright The Samba Team 2000-2003
[2003/12/01 16:38:29, 1] nsswitch/winbindd_util.c:add_trusted_domain(149)
  Added domain DOMAIN DOMAIN.COM
[2003/12/01 16:38:29, 1] libsmb/clikrb5.c:ads_krb5_mk_req(269)
  krb5_cc_get_principal failed (No credentials cache found)
[2003/12/01 16:38:29, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:38:29, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:43:34, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:48:34, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:53:34, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list
[2003/12/01 16:58:48, 1] nsswitch/winbindd_util.c:add_trusted_domains(206)
  scanning trusted domain list

Embery, Nathan

2003-Dec-11 15:32 UTC

head link

[Samba] getent passwd cannot list win2k ADS users

try a 
# truss getent passwd

and look for where it's looking for libnss_winbind.so

you probably need to make a link to libnss_winbind.so.2 or 1
On Solaris it need just nss_winbind.so.1 to be linked to libnss_winbind.so
for example.

truss will tell you what you need.
Hope that helps

Nate

Possibly Parallel Threads

Search for more possibly parallel threads

samba - Dec 2003 - getent passwd cannot list win2k ADS users

[Samba] getent passwd cannot list win2k ADS users

[Samba] getent passwd cannot list win2k ADS users

Possibly Parallel Threads