Anthony Chavez
2006-Mar-06 21:58 UTC
[Samba] Cannot join domain: "The user name could not be found"
Hello!
I'm trying to join a Windows XP (64 bit version) machine to a Samba
3.0.21a domain via smbldap-tools 0.9.1 on FreeBSD 6.0-RELEASE-p4 and I'm
continually getting the message "The user name could not be found."
I am attempting to join using members of the Domain Admins group (mapped
to Unix group 515), and I'm noticing in the logs (below) that even
though the machine successfully authenticates as that user, it tries the
domain Administrator account anyhow.
When attempting to join using the domain Administrator account, it fails
with the same error.
I have included my smb.conf as well as the smbtools.conf below as well,
and would greatly appreciate any assistance that I could get with this.
Thanks!
--
Anthony Chavez http://anthonychavez.org/
mailto:acc@anthonychavez.org jabber:acc@jabber.anthonychavez.org
--8<---------------cut here---------------start------------->8---
[2006/03/06 14:49:45, 2] lib/smbldap.c:smbldap_open_connection(722)
smbldap_open_connection: connection opened
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640)
init_sam_from_ldap: Entry found for user: acc
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_group_from_ldap(2199)
init_group_from_ldap: Entry found for group: 512
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_group_from_ldap(2199)
init_group_from_ldap: Entry found for group: 544
[2006/03/06 14:49:45, 2] auth/auth.c:check_ntlm_password(307)
check_ntlm_password: authentication for user [acc] -> [acc] -> [acc]
succeeded
[2006/03/06 14:49:45, 0] lib/debug.c:reopen_logs(597)
Unable to open new log file /var/log/samba/log.myhost: Permission denied
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640)
init_sam_from_ldap: Entry found for user: Administrator
[2006/03/06 14:49:45, 2] auth/auth.c:check_ntlm_password(307)
check_ntlm_password: authentication for user [Administrator] ->
[Administrator] -> [Administrator] succeeded
[2006/03/06 14:49:45, 2] smbd/server.c:exit_server(614)
Closing connections
[2006/03/06 14:49:45, 2] lib/smbldap.c:smbldap_open_connection(722)
smbldap_open_connection: connection opened
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640)
init_sam_from_ldap: Entry found for user: acc
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_group_from_ldap(2199)
init_group_from_ldap: Entry found for group: 512
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_group_from_ldap(2199)
init_group_from_ldap: Entry found for group: 544
[2006/03/06 14:49:45, 2] auth/auth.c:check_ntlm_password(307)
check_ntlm_password: authentication for user [acc] -> [acc] -> [acc]
succeeded
[2006/03/06 14:49:45, 0] lib/debug.c:reopen_logs(597)
Unable to open new log file /var/log/samba/log.myhost: Permission denied
[2006/03/06 14:49:45, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640)
init_sam_from_ldap: Entry found for user: Administrator
[2006/03/06 14:49:45, 2] auth/auth.c:check_ntlm_password(307)
check_ntlm_password: authentication for user [Administrator] ->
[Administrator] -> [Administrator] succeeded
[2006/03/06 14:49:45, 2] rpc_server/srv_samr_nt.c:_samr_lookup_domain(2610)
Returning domain sid for domain MYDOMAIN -> S-MYSID
[2006/03/06 14:49:46, 2] smbd/server.c:exit_server(614)
Closing connections
--8<---------------cut here---------------end--------------->8---
--8<---------------cut here---------------start------------->8---
# Global parameters
[global]
workgroup = MYDOMAIN
server string = MYDOMAIN Master Server
interfaces = lo0, fxp0
bind interfaces only = Yes
socket options = TCP_NODELAY
log level = 2
log file = /var/log/samba/log.%m
max log size = 50
logon drive = Z:
logon home = \\%N\%U
logon path = \\%N\profiles\%U
logon script = %U.bat
domain logons = Yes
wins support = Yes
os level = 34
time server = Yes
printing = cups
printcap name = cups
show add printer wizard = No
idmap backend = ldap:ldapi://%2fvar%2frun%2fopenldap%2fldapi/
idmap uid = 64512-65532
idmap gid = 64512-65532
### winbind nested groups = Yes
### winbind use default domain = Yes
enable privileges = Yes
template homedir = /home/%U
template shell = /usr/sbin/nologin
passdb backend = ldapsam:ldapi://%2fvar%2frun%2fopenldap%2fldapi/
ldap passwd sync = Yes
ldap suffix = dc=mydomain,dc=com
ldap machine suffix = ou=Users
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=Manager,dc=mydomain,dc=com
ldap timeout = 5
add user script = /usr/local/sbin/smbldap-useradd -m "%u"
delete user script = /usr/local/sbin/smbldap-userdel "%u"
add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/local/sbin/smbldap-groupdel "%g"
add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/local/sbin/smbldap-groupmod -x
"%u" "%g"
set primary group script = /usr/local/sbin/smbldap-usermod -g "%g"
"%u"
add machine script = /usr/local/sbin/smbldap-useradd -w "%m"
[netlogon]
comment = Network logon service
path = /home/samba/netlogon
guest ok = Yes
browseable = No
[profiles]
comment = Profile share
path = /home/samba/profiles
read only = No
profile acls = Yes
[homes]
comment = Home directory
username = %S
read only = No
browseable = No
vfs objects = vscan-clamav
vscan-clamav:config-file = /usr/local/etc/samba-vscan/vscan-clamav.conf
[public]
comment = MYDOMAIN public share
path = /home/samba/public
guest ok = Yes
force create mode = 0020
force directory mode = 0020
read only = No
vfs objects = vscan-clamav
vscan-clamav:config-file = /usr/local/etc/samba-vscan/vscan-clamav.conf
[infected]
comment = Infected file share
path = /home/samba/infected
guest ok = Yes
read only = No
[accounting]
comment = MYDOMAIN accounting share
path = /home/samba/accounting
valid users = @accounting @domadmins
force create mode = 0020
force directory mode = 0020
read only = No
vfs objects = vscan-clamav
vscan-clamav:config-file = /usr/local/etc/samba-vscan/vscan-clamav.conf
[companies]
comment = MYDOMAIN companies share
path = /home/samba/companies
valid users = @auditors @domadmins
write list = @auditors @domadmins
force create mode = 0020
force directory mode = 0020
vfs objects = vscan-clamav
vscan-clamav:config-file = /usr/local/etc/samba-vscan/vscan-clamav.conf
[partners]
comment = MYDOMAIN partners share
path = /home/samba/partners
valid users = @partners @domadmins
force create mode = 0020
force directory mode = 0020
read only = No
vfs objects = vscan-clamav
vscan-clamav:config-file = /usr/local/etc/samba-vscan/vscan-clamav.conf
[print$]
comment = Print driver share
path = /home/samba/printdrivers
guest ok = No
write list = @domadmins
read only = Yes
browseable = No
[printers]
comment = Print spool
path = /var/spool/samba
guest ok = Yes
printable = Yes
browseable = No
--8<---------------cut here---------------end--------------->8---
--8<---------------cut here---------------start------------->8---
# $Source: /opt/cvs/samba/smbldap-tools/smbldap.conf,v $
# $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $
#
# smbldap-tools.conf : Q & D configuration file for smbldap-tools
# This code was developped by IDEALX (http://IDEALX.org/) and
# contributors (their names can be found in the CONTRIBUTORS file).
#
# Copyright (C) 2001-2002 IDEALX
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
# USA.
# Purpose :
# . be the configuration file for all smbldap-tools scripts
##############################################################################
#
# General Configuration
#
##############################################################################
# Put your own SID. To obtain this number do: "net getlocalsid".
# If not defined, parameter is taking from "net getlocalsid" return
SID="S-MYSID"
# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain="IDEALX-NT"
### sambaDomain="IDEALX-NT"
##############################################################################
#
# LDAP Configuration
#
##############################################################################
# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
# (typically a replication directory)
# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
slaveLDAP="127.0.0.1"
# Slave LDAP port
# If not defined, parameter is set to "389"
slavePort="389"
# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
masterLDAP="127.0.0.1"
# Master LDAP port
# If not defined, parameter is set to "389"
masterPort="389"
# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "1"
ldapTLS="0"
# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"
# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/ssl/cacert.org/root.crt"
# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/opt/IDEALX/smbldap-tools/smbldap-tools.pem"
# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/opt/IDEALX/smbldap-tools/smbldap-tools.key"
# LDAP Suffix
# Ex: suffix=dc=IDEALX,dc=ORG
suffix="dc=mydomain,dc=com"
# Where are stored Users
# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for
usersdn
usersdn="ou=People,ou=Users,${suffix}"
# Where are stored Computers
# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for
computersdn
computersdn="ou=Machines,ou=Users,${suffix}"
# Where are stored Groups
# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for
groupsdn
groupsdn="ou=Groups,${suffix}"
# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for
idmapdn
idmapdn="ou=Idmap,${suffix}"
# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
sambaUnixIdPooldn="sambaDomainName=MYDOMAIN,${suffix}"
# Default scope Used
scope="sub"
# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
hash_encrypt="SSHA"
# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
crypt_salt_format="%s"
##############################################################################
#
# Unix Accounts Configuration
#
##############################################################################
# Login defs
# Default Login Shell
# Ex: userLoginShell="/bin/bash"
userLoginShell="/usr/sbin/nologin"
# Home directory
# Ex: userHome="/home/%U"
userHome="/home/%U"
# Default mode used for user homeDirectory
userHomeDirectoryMode="700"
# Gecos
userGecos="User"
# Default User (POSIX and Samba) GID
defaultUserGid="513"
# Default Computer (Samba) GID
defaultComputerGid="515"
# Skel dir
skeletonDir="/etc/skel"
# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="45"
##############################################################################
#
# SAMBA Configuration
#
##############################################################################
# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon
home'
# directive and/or disable roaming profiles
# Ex: userSmbHome="\\PDC-SMB3\%U"
userSmbHome=""
# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon
path'
# directive and/or disable roaming profiles
# Ex: userProfile="\\PDC-SMB3\profiles\%U"
userProfile=""
# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive="H:"
userHomeDrive=""
# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript="startup.cmd" # make sure script file is edited under
dos
userScript="%U.bat"
# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain="idealx.com"
mailDomain="mydomain.com"
##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################
# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/local/bin/smbpasswd"
# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/local/sbin/slappasswd"
# comment out the following line to get rid of the default banner
# no_banner="1"
--8<---------------cut here---------------end--------------->8---
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 477 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20060306/922bbeec/attachment.bin