Help, I've posted this before, but had no responses. In reading the
archives, I'm not seeing anyone else with this issue.
Our problem:
------------
Samba will not enumerate Domain local groups in our Win2008 Active Directory.
Our Setup:
----------
# cat /etc/SuSE-release
SUSE Linux Enterprise Server 10 (x86_64)
VERSION = 10
PATCHLEVEL = 2
# rpm -qa | grep -E '(samba3)|(smb)|(krb)|(wbclient)' | grep -v pam
krb5-32bit-1.4.3-19.35
libsmbclient-32bit-3.0.32-0.8
samba3-3.3.6-39.suse101
samba3-client-3.3.6-39.suse101
krb5-1.4.3-19.35
libsmbclient0-3.3.6-39.suse101
samba3-winbind-3.3.6-39.suse101
krb5-client-1.4.3-19.34
libwbclient0-3.3.6-39.suse101
# cat /etc/samba/smb.conf
[global]
server string = "Main Linux File Server"
security = ADS
realm = SOME.DOMAIN
workgroup = SOME
encrypt passwords = yes
unix extensions = yes
log level = 1 winbind:3
username map = /etc/samba/user-map
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind expand groups = 4
winbind nested groups = Yes
winbind separator = \
idmap uid = 10000-11000
idmap gid = 10000-11000
[testing]
path = /tmp/test
write list = @SOME\file1_shr_adm_f
# cat /etc/krb5.conf
[libdefaults]
default_realm = SOME.DOMAIN
clockskew = 300
[realms]
ENT.CML.LIB.OH.US = {
kdc = adserver.some.domain
}
[domain_realm]
.kerberos.server = SOME.DOMAIN
[logging]
default = SYSLOG:NOTICE:DAEMON
kdc = FILE:/var/log/kdc.log
kadmind = FILE:/var/log/kadmind.log
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
debug = false
}
Ad Server: Windows 2008 server with up to date patches.
The problem explained:
----------------------
We put AD users into global groups, then global groups into domain local groups
(as dictated best practices). Domain local groups are used for access control.
Samba will not enumerate users in the groups. It only works when the user
account is directly used in "write list". The symptom is Windows
clients return "NT Access Denied".
wbinfo -g is able to list the groups.
Unrelated:
----------
I've also discovered AD user accounts cannot contain hyphens '-'s
and work with Samba.
Any help would be appreciated. Thanks.
-Travis Sidelinger
