thr3ads.net - samba - [Samba] cannot login as with domain userid's on AIX [Feb 2005]

If this information is useful, please help other people find it:
Share via:
shaista.bano@iflexsolutions.com
2005-Feb-17 11:16 UTC
[Samba] cannot login as with domain userid's on AIX

Hi 

I am trying to configure Samba with ADS integration on AIX 5.2.

 

I am unable to login to the Aix server using credentials of Domain user.

 

I am able to join to windows Domain and able to fetch list of windows
domain users with the command

/usr/local/samba/bin/wbinfo -u and also the groups with
usr/local/samba/bin/wbinfo -g .

 

I have added the below line methods.cfg

WINBIND

        program = /usr/lib/security/WINBIND

        options = authonly

 

Also included 

Default:

            SYSTEM = "WINBIND or compat" in /etc/security/user file.

 

/usr/local/samba/bin/smbclient -k -U administrator -L
mailsrvr.restore.com  - works fine too

 

Kinit works fine.

Output of klist is : 

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: administrator@RESTORE.COM

 

Valid starting     Expires            Service principal

02/17/05 15:37:01  02/18/05 01:37:04  krbtgt/RESTORE.COM@RESTORE.COM

        renew until 02/18/05 15:37:01

02/17/05 16:07:14  02/18/05 01:37:04  mailsrvr$@RESTORE.COM

        renew until 02/18/05 15:37:01

 

Kerberos 4 ticket cache: /tmp/tkt0

klist: You have no tickets cached

 

The /var/log/samba/winbindd.log has the following: 

 

[2005/02/17 16:30:50, 3] nsswitch/winbindd_ads.c:trusted_domains(832)

  ads: trusted_domains

[2005/02/17 16:30:50, 3] libads/ldap.c:ads_connect(247)

  Connected to LDAP server 10.80.0.120

[2005/02/17 16:30:50, 3] libads/ldap.c:ads_server_info(2432)

  got ldap server name mailsrvr@RESTORE.COM, using bind path:
dc=RESTORE,dc=COM

[2005/02/17 16:30:50, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(109)

  IPC$ connections done anonymously

[2005/02/17 16:30:50, 3] libsmb/cliconnect.c:cli_start_connection(1382)

  Connecting to host=MAILSRVR

[2005/02/17 16:30:50, 3] lib/util_sock.c:open_socket_out(752)

  Connecting to 10.80.0.120 at port 445

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(713)

  Doing spnego session setup (blob length=109)

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 48018 1 2 2

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2 3

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 3 6 1 4 1 311 2 2 10

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(745)

  got principal=mailsrvr$@RESTORE.COM

[2005/02/17 16:30:51, 2]
libsmb/cliconnect.c:cli_session_setup_kerberos(538)

  Doing kerberos session setup

[2005/02/17 16:30:51, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(319)

  Ticket in ccache[MEMORY:cliconnect] expiration Fri, 18 Feb 2005
02:31:08 PAKST

[2005/02/17 16:35:51, 3] nsswitch/winbindd_ads.c:trusted_domains(832)

  ads: trusted_domains

[2005/02/17 16:35:51, 3] libads/ldap.c:ads_connect(247)

  Connected to LDAP server 10.80.0.120

[2005/02/17 16:35:51, 3] libads/ldap.c:ads_server_info(2432)

  got ldap server name mailsrvr@RESTORE.COM, using bind path:
dc=RESTORE,dc=COM

[2005/02/17 16:35:51, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(109)

  IPC$ connections done anonymously

[2005/02/17 16:35:51, 3] libsmb/cliconnect.c:cli_start_connection(1382)

  Connecting to host=MAILSRVR

[2005/02/17 16:35:51, 3] lib/util_sock.c:open_socket_out(752)

  Connecting to 10.80.0.120 at port 445

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(713)

  Doing spnego session setup (blob length=109)

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 48018 1 2 2

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2 3

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 3 6 1 4 1 311 2 2 10

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(745)

  got principal=mailsrvr$@RESTORE.COM

[2005/02/17 16:35:51, 2]
libsmb/cliconnect.c:cli_session_setup_kerberos(538)

  Doing kerberos session setup

[2005/02/17 16:35:51, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(319)

Ticket in ccache[MEMORY:cliconnect] expiration Fri, 18 Feb 2005 02:41:08
PAKST

 

 

I am looking for the steps that need to be followed on the PAM / krb
side to be able to login to AIX

Server with the windows domain user credentials

 

Here are my smb.conf and krb5.

Any help on this would be great.

 

Smb.conf

 

[        workgroup = restore

        server string = Samba Server

        log file = /var/log/samba/%m.log

        log level = 3

        max log size = 50

        security =  ADS

        realm = RESTORE.COM

        use kerberos keytab = Yes

        password server =  10.80.0.120

        winbind separator = #

        idmap uid = 10000-20000

        idmap gid = 10000-20000

        winbind cache time = 15

        winbind enum users = yes

        winbind enum groups = yes

        template homedir = /home/%D/%U

        template shell = /bin/bash

        winbind use default domain = yes

        obey pam restrictions = yes

 

[homes]

        comment = Home Directories

        browseable = no

        writeable = yes

        create mask = 0640

 

krb5.conf

 

[libdefaults]

        default_realm = RESTORE.COM

        ticket_lifetime = 24000

        dns_lookup_realm = true

        dns_lookup_kdc = true

        krb4_config = /usr/krb5-1.3.6/src/config-files/krb.conf

#       krb4_realms = /usr/kerberos/lib/krb.realms

 

[realms]

        RESTORE.COM  = {

                admin_server = mailsrvr.restore.com

                kdc = mailsrvr.restore.com

                default_domain = RESTORE.COM

        }

 

 

[kdc]

 profile = /usr/krb5-1.3.6/src/config-files/kdc.conf

 

[domain_realm]

        .restore.com = RESTORE.COM

         restore.com = RESTORE.COM

 

 

[domain_realm]

        .restore.com = RESTORE.COM

 

 

[logging]

#       kdc = CONSOLE

 default = FILE:/var/log/krb5libs.log

 kdc = FILE:/var/log/krb5kdc.log

 admin_server = FILE:/var/log/kadmind.log

 

[appdefaults]

 pam = {

   debug = true

   ticket_lifetime = 36000

   renew_lifetime = 36000

   forwardable = true

   krb4_convert = false

 }

 

Any help would be greatly appreciated.

Regards,

Shaista 

 



DISCLAIMER:
This message contains privileged and confidential information and is intended
only for the individual named.If you are not the intended recipient you should
not disseminate,distribute,store,print, copy or deliver this message.Please
notify the sender immediately by e-mail if you have received this e-mail by
mistake and delete this e-mail from your system.E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted,corrupted,lost,destroyed,arrive late or incomplete or contain
viruses.The sender therefore does not accept liability for any errors or
omissions in the contents of this message which arise as a result of e-mail
transmission. If verification is required please request a hard-copy version.
Possibly Parallel Threads

Search for more possibly parallel threads
samba - Feb 2005 - cannot login as with domain userid's on AIX

[Samba] cannot login as with domain userid's on AIX

Possibly Parallel Threads

Wisdom of the Ancients
