I am stuck with Samba -Active Directory communication. Trying to bring my SUSE
10.0 to speak with AD Domain.
net rpc testjoin - brings a unable to find suitable server message
net join - kerberos_kinit_password preauthentication failed and ads_connect
preauthentication failed
wbinfo -u works fine
wbinfo -t works fine
getent passwd/group works too
smb is running
nmb is running
winbindd is running
nscd is not running
Here my smb.conf
[global]
workgroup = (netbios name of mydomain)
realm = mydomain.local
netbios name = sambaservername
server string =
security = ads
template shell = /bin/bash
idmap uid = 150000-250000
idmap gid = 150000-250000
idmap backend = ldap://192.168.5.15 ldap://10.0.0.210
winbind use default domain = yes
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
add machine script = /sbin/yast /usr/share/YaST2/data/add_machine.ycp %m$
domain logons = no
domain master = No
ldap admin dn =
ldap delete dn = No
#ldap filter = (uid=%u)
ldap group suffix =
ldap idmap suffix =
ldap machine suffix =
ldap passwd sync = No
ldap replication sleep = 1000
ldap ssl = Start_tls
ldap suffix =
ldap timeout = 5
ldap user suffix =
passdb backend = ldapsam:ldap://192.168.5.15 ldapsam:ldap://10.0.0.210
security = user
debug level = 5
log level = 5
my nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#
# passwd: files nis
# shadow: files nis
# group: files nis
passwd: files ldap
group: files ldap
shadow: files
hosts: files dns
networks: files dns
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files
publickey: files
bootparams: files
automount: files nis
aliases: files
my krb5.conf
[libdefaults]
default_realm = mydomain.local
clockskew = 300
[realms]
mydomain.local = {
kdc = (FQDN of AD Domain Controller)
default_domain = mydomain.local
admin_server = (FQDN of AD Domain Controller)
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
[domain_realm]
.mydomain.local = mydomain.local
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
try_first_pass = true
}
my pam.d/login
#%PAM-1.0
auth required pam_securetty.so
auth sufficient pam_winbind.so use_first_pass_use_authtok
auth sufficient pam_unix2.so
auth required pam_stack.so use_first_pass
auth required pam_nologin.so
auth required pam_mail.so
account sufficient pam_winbind.so use_first_pass use_authtok
account required pam_stack.so service=system-auth
account sufficient pam_unix2.so
password sufficient pam_winbind.so use_first_pass use_authtok
password required pam_pwcheck.so
password sufficient pam_unix2.so
session required pam_stack.so service=system-auth
session optional pam_console.so
session sufficient pam_winbind.so use_first_pass use_authtok
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session sufficient pam_unix2.so
session required pam_limits.so
and finally /etc/ldap.conf
#
# This is the configuration file for the LDAP nameservice
# switch library, the LDAP PAM module and the shadow package.
#
# Your LDAP server. Must be resolvable without using LDAP.
host 192.168.5.15 10.0.0.210
# The distinguished name of the search base.
base dc=mydomain,dc=local
# The LDAP version to use (defaults to 3
# if supported by client library)
ldap_version 3
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
rootbinddn (DN of administrator)
# The credentials to bind with.
# Optional: default is no credential.
bindpw secret
# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
rootbinddn (DN of administrator)
# The port.
# Optional: default is 389.
#port 389
# The search scope.
#scope sub
#scope one
#scope base
# Search timelimit
#timelimit 30
# Bind timelimit
#bind_timelimit 30
# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600
# Filter to AND with uid=%s
#pam_filter objectclass=account
# The user ID attribute (defaults to uid)
#pam_login_attribute uid
# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes
# Check the 'host' attribute for access control
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr yes
# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com
# Group member attribute
#pam_member_attribute uniquemember
# Specify a minium or maximum UID number allowed
#pam_min_uid 0
#pam_max_uid 0
# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody
# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
#pam_password clear
# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service.
pam_password crypt
# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
#pam_password nds
# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad
# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop
# Redirect users to a URL or somesuch on password
# changes.
#pam_password_prohibit_message Please visit http://internal to change your
password.
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
#nss_base_passwd ou=People,dc=padl,dc=com?one
#nss_base_shadow ou=People,dc=padl,dc=com?one
#nss_base_group ou=Group,dc=padl,dc=com?one
#nss_base_hosts ou=Hosts,dc=padl,dc=com?one
#nss_base_services ou=Services,dc=padl,dc=com?one
#nss_base_networks ou=Networks,dc=padl,dc=com?one
#nss_base_protocols ou=Protocols,dc=padl,dc=com?one
#nss_base_rpc ou=Rpc,dc=padl,dc=com?one
#nss_base_ethers ou=Ethers,dc=padl,dc=com?one
#nss_base_netmasks ou=Networks,dc=padl,dc=com?ne
#nss_base_bootparams ou=Ethers,dc=padl,dc=com?one
#nss_base_aliases ou=Aliases,dc=padl,dc=com?one
#nss_base_netgroup ou=Netgroup,dc=padl,dc=com?one
# attribute/objectclass mapping
# Syntax:
#nss_map_attribute rfc2307attribute mapped_attribute
#nss_map_objectclass rfc2307objectclass mapped_objectclass
# configure --enable-nds is no longer supported.
# For NDS now do:
#nss_map_attribute uniqueMember member
# configure --enable-mssfu-schema is no longer supported.
# For MSSFU now do:
#nss_map_objectclass posixAccount User
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad
# configure --enable-authpassword is no longer supported
# For authPassword support, now do:
#nss_map_attribute userPassword authPassword
#pam_password nds
# For IBM SecureWay support, do:
#nss_map_objectclass posixAccount aixAccount
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear
# Netscape SDK LDAPS
#ssl on
# Netscape SDK SSL options
#sslpath /etc/ssl/certs/cert7.db
# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
ssl start_tls
#ssl on
# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is "no"
#tls_checkpeer yes
# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertdir /etc/ssl/certs
# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1
# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key
Any Tips what I am missing out on ????? I am trying to get authentication
working with SAMBA through to AD
Regards
Pashii
_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066
Have you configured kerberos? have a look at http://wiki.samba.org/index.php/Samba_%26_Active_Directory "ads_connect preauthentication failed" means there is something wrong with authenication or the machine account already exists. regards Franz Pashii B wrote:> I am stuck with Samba -Active Directory communication. Trying to bring my > SUSE 10.0 to speak with AD Domain. > > net rpc testjoin - brings a unable to find suitable server message > > net join - kerberos_kinit_password preauthentication failed and > ads_connect preauthentication failed > > wbinfo -u works fine > wbinfo -t works fine > getent passwd/group works too > > smb is running > nmb is running > winbindd is running > nscd is not running > > Here my smb.conf > > [global] > workgroup = (netbios name of mydomain) > realm = mydomain.local > netbios name = sambaservername > server string > security = ads > template shell = /bin/bash > idmap uid = 150000-250000 > idmap gid = 150000-250000 > idmap backend = ldap://192.168.5.15 ldap://10.0.0.210 > winbind use default domain = yes > printing = cups > printcap name = cups > printcap cache time = 750 > cups options = raw > map to guest = Bad User > include = /etc/samba/dhcp.conf > logon path = \\%L\profiles\.msprofile > logon home = \\%L\%U\.9xprofile > logon drive = P: > add machine script = /sbin/yast /usr/share/YaST2/data/add_machine.ycp %m$ > domain logons = no > domain master = No > ldap admin dn > ldap delete dn = No > #ldap filter = (uid=%u) > ldap group suffix > ldap idmap suffix > ldap machine suffix > ldap passwd sync = No > ldap replication sleep = 1000 > ldap ssl = Start_tls > ldap suffix > ldap timeout = 5 > ldap user suffix > passdb backend = ldapsam:ldap://192.168.5.15 ldapsam:ldap://10.0.0.210 > security = user > debug level = 5 > log level = 5 > > > my nsswitch.conf > > # > # /etc/nsswitch.conf > # > # An example Name Service Switch config file. This file should be > # sorted with the most-used services at the beginning. > # > # The entry '[NOTFOUND=return]' means that the search for an > # entry should stop if the search in the previous entry turned > # up nothing. Note that if the search failed due to some other reason > # (like no NIS server responding) then the search continues with the > # next entry. > # > # Legal entries are: > # > # compat Use compatibility setup > # nisplus Use NIS+ (NIS version 3) > # nis Use NIS (NIS version 2), also called YP > # dns Use DNS (Domain Name Service) > # files Use the local files > # [NOTFOUND=return] Stop searching if not found so far > # > # For more information, please read the nsswitch.conf.5 manual page. > # > > # passwd: files nis > # shadow: files nis > # group: files nis > > passwd: files ldap > group: files ldap > shadow: files > > hosts: files dns > networks: files dns > > services: files > protocols: files > rpc: files > ethers: files > netmasks: files > netgroup: files > publickey: files > > bootparams: files > automount: files nis > aliases: files > > > my krb5.conf > > [libdefaults] > default_realm = mydomain.local > clockskew = 300 > > [realms] > mydomain.local = { > kdc = (FQDN of AD Domain Controller) > default_domain = mydomain.local > admin_server = (FQDN of AD Domain Controller) > } > > [logging] > kdc = FILE:/var/log/krb5kdc.log > admin_server = FILE:/var/log/kadmin.log > default = FILE:/var/log/krb5lib.log > > [domain_realm] > .mydomain.local = mydomain.local > [appdefaults] > pam = { > ticket_lifetime = 1d > renew_lifetime = 1d > forwardable = true > proxiable = false > retain_after_close = false > minimum_uid = 0 > try_first_pass = true > } > > > my pam.d/login > > #%PAM-1.0 > auth required pam_securetty.so > auth sufficient pam_winbind.so use_first_pass_use_authtok > auth sufficient pam_unix2.so > auth required pam_stack.so use_first_pass > auth required pam_nologin.so > auth required pam_mail.so > account sufficient pam_winbind.so use_first_pass use_authtok > account required pam_stack.so service=system-auth > account sufficient pam_unix2.so > password sufficient pam_winbind.so use_first_pass use_authtok > password required pam_pwcheck.so > password sufficient pam_unix2.so > session required pam_stack.so service=system-auth > session optional pam_console.so > session sufficient pam_winbind.so use_first_pass use_authtok > session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 > session sufficient pam_unix2.so > session required pam_limits.so > > and finally /etc/ldap.conf > > # > # This is the configuration file for the LDAP nameservice > # switch library, the LDAP PAM module and the shadow package. > # > > # Your LDAP server. Must be resolvable without using LDAP. > host 192.168.5.15 10.0.0.210 > > # The distinguished name of the search base. > base dc=mydomain,dc=local > > # The LDAP version to use (defaults to 3 > # if supported by client library) > ldap_version 3 > > # The distinguished name to bind to the server with. > # Optional: default is to bind anonymously. > rootbinddn (DN of administrator) > > # The credentials to bind with. > # Optional: default is no credential. > bindpw secret > > # The distinguished name to bind to the server with > # if the effective user ID is root. Password is > # stored in /etc/ldap.secret (mode 600) > rootbinddn (DN of administrator) > > # The port. > # Optional: default is 389. > #port 389 > > # The search scope. > #scope sub > #scope one > #scope base > > # Search timelimit > #timelimit 30 > > # Bind timelimit > #bind_timelimit 30 > > # Idle timelimit; client will close connections > # (nss_ldap only) if the server has not been contacted > # for the number of seconds specified below. > #idle_timelimit 3600 > > # Filter to AND with uid=%s > #pam_filter objectclass=account > > # The user ID attribute (defaults to uid) > #pam_login_attribute uid > > # Search the root DSE for the password policy (works > # with Netscape Directory Server) > #pam_lookup_policy yes > > # Check the 'host' attribute for access control > # Default is no; if set to yes, and user has no > # value for the host attribute, and pam_ldap is > # configured for account management (authorization) > # then the user will not be allowed to login. > #pam_check_host_attr yes > > # Group to enforce membership of > #pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com > > # Group member attribute > #pam_member_attribute uniquemember > > # Specify a minium or maximum UID number allowed > #pam_min_uid 0 > #pam_max_uid 0 > > # Template login attribute, default template user > # (can be overriden by value of former attribute > # in user's entry) > #pam_login_attribute userPrincipalName > #pam_template_login_attribute uid > #pam_template_login nobody > > # Do not hash the password at all; presume > # the directory server will do it, if > # necessary. This is the default. > #pam_password clear > > # Hash password locally; required for University of > # Michigan LDAP server, and works with Netscape > # Directory Server if you're using the UNIX-Crypt > # hash mechanism and not using the NT Synchronization > # service. > pam_password crypt > > # Remove old password first, then update in > # cleartext. Necessary for use with Novell > # Directory Services (NDS) > #pam_password nds > > # Update Active Directory password, by > # creating Unicode password and updating > # unicodePwd attribute. > #pam_password ad > > # Use the OpenLDAP password change > # extended operation to update the password. > #pam_password exop > > # Redirect users to a URL or somesuch on password > # changes. > #pam_password_prohibit_message Please visit http://internal to change your > #password. > > # RFC2307bis naming contexts > # Syntax: > # nss_base_XXX base?scope?filter > # where scope is {base,one,sub} > # and filter is a filter to be &'d with the > # default filter. > # You can omit the suffix eg: > # nss_base_passwd ou=People, > # to append the default base DN but this > # may incur a small performance impact. > #nss_base_passwd ou=People,dc=padl,dc=com?one > #nss_base_shadow ou=People,dc=padl,dc=com?one > #nss_base_group ou=Group,dc=padl,dc=com?one > #nss_base_hosts ou=Hosts,dc=padl,dc=com?one > #nss_base_services ou=Services,dc=padl,dc=com?one > #nss_base_networks ou=Networks,dc=padl,dc=com?one > #nss_base_protocols ou=Protocols,dc=padl,dc=com?one > #nss_base_rpc ou=Rpc,dc=padl,dc=com?one > #nss_base_ethers ou=Ethers,dc=padl,dc=com?one > #nss_base_netmasks ou=Networks,dc=padl,dc=com?ne > #nss_base_bootparams ou=Ethers,dc=padl,dc=com?one > #nss_base_aliases ou=Aliases,dc=padl,dc=com?one > #nss_base_netgroup ou=Netgroup,dc=padl,dc=com?one > > # attribute/objectclass mapping > # Syntax: > #nss_map_attribute rfc2307attribute mapped_attribute > #nss_map_objectclass rfc2307objectclass mapped_objectclass > > # configure --enable-nds is no longer supported. > # For NDS now do: > #nss_map_attribute uniqueMember member > > # configure --enable-mssfu-schema is no longer supported. > # For MSSFU now do: > #nss_map_objectclass posixAccount User > #nss_map_attribute uid msSFUName > #nss_map_attribute uniqueMember posixMember > #nss_map_attribute userPassword msSFUPassword > #nss_map_attribute homeDirectory msSFUHomeDirectory > #nss_map_objectclass posixGroup Group > #pam_login_attribute msSFUName > #pam_filter objectclass=User > #pam_password ad > > # configure --enable-authpassword is no longer supported > # For authPassword support, now do: > #nss_map_attribute userPassword authPassword > #pam_password nds > > # For IBM SecureWay support, do: > #nss_map_objectclass posixAccount aixAccount > #nss_map_attribute uid userName > #nss_map_attribute gidNumber gid > #nss_map_attribute uidNumber uid > #nss_map_attribute userPassword passwordChar > #nss_map_objectclass posixGroup aixAccessGroup > #nss_map_attribute cn groupName > #nss_map_attribute uniqueMember member > #pam_login_attribute userName > #pam_filter objectclass=aixAccount > #pam_password clear > > # Netscape SDK LDAPS > #ssl on > > # Netscape SDK SSL options > #sslpath /etc/ssl/certs/cert7.db > > # OpenLDAP SSL mechanism > # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 > ssl start_tls > #ssl on > > # OpenLDAP SSL options > # Require and verify server certificate (yes/no) > # Default is "no" > #tls_checkpeer yes > > # CA certificates for server certificate verification > # At least one of these are required if tls_checkpeer is "yes" > #tls_cacertfile /etc/ssl/ca.cert > #tls_cacertdir /etc/ssl/certs > > # SSL cipher suite > # See man ciphers for syntax > #tls_ciphers TLSv1 > > # Client certificate and key > # Use these, if your server requires client authentication. > #tls_cert > #tls_key > > > > Any Tips what I am missing out on ????? I am trying to get authentication > working with SAMBA through to AD > > Regards > > Pashii > _____________________________________________________________________ > Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! > http://smartsurfer.web.de/?mc=100071&distributionid=000000000066 >