I've been successfully running Samba 3.0 under FreeBSD 5 attached to a 2003
Domain for awhile now. As of about a week ago, I could no longer get most
users to authenticate to the Samba server. It happened at roughly the same
time I upgraded to FreeBSD 5.4.
I'm using heimdal 0.6.3, samba 3.0.14 and FreeBSD 5.4. I had the error
running samba 3.0.11 and 3.0.12 from the FreeBSD ports collection. I've
since deinstalled those and rebuilt from source manually. I've also
reinstall the heimdal port from the ports collection.
I've removed the server from the Domain and am now just trying to get it
readded. Kinit signs me in just fine, but using most of the "net ads"
commands fails. Smbclient -k fails as well. I've tried several variations
on my krb5.conf and smb.conf. Any help would be appreciated.
Running "net ads testjoin" returns:
[2005/05/19 16:53:56, 0] libads/kerberos.c:ads_kinit_password(146)
kerberos_kinit_password SATURN$@FBFGUNS.COM failed: Unknown error
-1765328378
[2005/05/19 16:53:56, 0] libads/kerberos.c:ads_kinit_password(146)
kerberos_kinit_password SATURN$@FBFGUNS.COM failed: Unknown error
-1765328378
[2005/05/19 16:53:56, 0] utils/net_ads.c:ads_startup(191)
ads_connect: Unknown error -1765328378
Join to domain is not valid
Running "net ads join -Ujb" returns:
[2005/05/19 16:55:19, 0] utils/net_ads.c:ads_startup(191)
ads_connect: Unknown error -1765328332
Krb5.conf:
[libdefaults]
default_realm = FBFGUNS.COM
[realms]
FBFGUNS.COM = {
kdc = mercury.fbfguns.com
default_domain = fbfguns.com
admin_server = mercury.fbfguns.com
}
[domain_realm]
.fbfguns.com = FBFGUNS.COM
fbfguns.com = FBFGUNS.COM
.FBFGUNS.COM = FBFGUNS.COM
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
Smb.conf:
[global]
client use spnego = Yes
client schannel = Yes
server schannel = Yes
dns proxy = No
allow trusted domains = no
workgroup = FBF
realm = FBFGUNS.COM
interfaces = 172.22.2.1, 127.0.0.1
security = ADS
auth methods = winbind
update encrypted = Yes
password server = mercury.fbfguns.com
pam password change = Yes
unix password sync = Yes
max log size = 50
time server = Yes
server signing = auto
add user script = /usr/local/sbin/smb-add-user %u
delete user script = /usr/local/sbin/smb-rm-user %u
add group script = /usr/local/sbin/smb-add-group %g
delete group script = /usr/local/sbin/smb-rm-group %g
add user to group script = /usr/local/sbin/smb-add-user-group %u %g
delete user from group script = /usr/local/sbin/smb-rm-user-group %u
%g
add machine script = /usr/local/sbin/smb-add-machine %u
preferred master = No
local master = No
wins server = 172.22.2.2
ldap admin dn = cn=Administrator,cn=users,DC=fbfguns,DC=com
ldap suffix = DC=fbfguns,DC=com
idmap uid = 15000-20000
idmap gid = 15000-20000
template homedir = /home/%U
winbind use default domain = Yes
winbind trusted domains only = Yes
winbind enum users = No
winbind enum groups = No
force create mode = 0664
force directory mode = 0775
admin users = jb, jason, jr
hide unreadable = Yes
store dos attributes = Yes
dos filemode = Yes
Jason Burgess
jason@fenux.net
