su testuser11
cd /storage/CME/test
No problem. But when I try to access the same directory in windows I get these
entries in my logs....
/var/log/samba/log.smbd
------------------
[2010/01/04 16:08:25, 1] smbd/sesssetup.c:reply_spnego_kerberos(350)
Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
log.winbindd reports no errors so it seems that the SIU/UID mapping seems to be
working correctly.
I know this because the minute I give access to this share to testgroup9 the
windows users can immediately access the folder. ie. setfacl -m g:testgroup9:r-x
/storage/CME/test
Testshare on Samba FS
-----------------
getfacl testshare
# file: storage/CME/test
# owner: root
# group: Domain Users
user::rwx
group::rwx
group:testgroup10:r-x
mask::rwx
other::---
I've poured through documentation for weeks including these articles among
others:
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/idmapper.html#id2598913
http://www.samba.org/samba/history/samba-3.3.0.html
man smb.conf
Here are my final questions.
Has anyone got the "winbind expand groups" option to funtion properly
with Windows clients?
Am I using the proper idmap settings?
Would setting up an LDAP backend with the editposix option help anything?
Is there something I need to do on the Windows server side? (I have installed
Unix Extentions but not sure how to assign UID/GID's)
It seems that everything is working how it's supposed to 'cept I'm
probably missing something very simple. Anyone with any kind of help would be
appreciated.
SMB.CONF
---------------
[global]
workgroup = CME
security = ads
passdb backend = tdbsam:/etc/samba/passdb.tdb
idmap backend = rid (have tested with tdb also with no luck)
idmap uid = 110000-119999
idmap gid = 110000-119999
idmap cache time = 3600
idmap negative cache time = 300
winbind cache time = 900
winbind expand groups = 10
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = true
template shell = /bin/bash
template homedir = /home/%D/%U
machine password timeout = 2592000
realm = CME.COM
use kerberos keytab = yes
password server = prod-srv-8.cme.com
nt acl support = yes
map acl inherit = yes
winbind nss info = rcf2307
allow trusted domains = no
[CME]
path = /storage/CME
writeable = yes
inherit acls = yes
inherit permissions = yes
security mask = 0770
force security mode = 0770
directory security mask = 0770
force directory security mode = 0770
force create mode = 0770
map archive = yes
store dos attributes = yes
NSSWITCH.CONF
----------------------
passwd: files winbind
shadow: files winbind
group: files winbind
hosts: files wins dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files winbind
rpc: files winbind
services: files
netgroup: files winbind
publickey: nisplus
automount: files
aliases: files nisplus winbind
KRB5.CONF
----------------------
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = CME.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
CME.COM = {
kdc = prod-srv-8.cme.com:88
admin_server = prod-srv-8.cme.com:749
default_domain = cme.com
kdc = prod-srv-8.cme.com
}
[domain_realm]
.cme.com = CME.COM
cme.com = CME.COM
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
Joined Domain
----------------------
net ads testjoin
Join is OK
Time
---------------------
NTP is setup on both Windows and Linux and time is always in sync.
Samba Server's nameserver is the AD PDC.
Authconfig --test output
------------------------------------------
caching is disabled
nss_files is always enabled
nss_compat is disabled
nss_db is disabled
nss_hesiod is disabled
hesiod LHS = ""
hesiod RHS = ""
nss_ldap is disabled
LDAP+TLS is disabled
LDAP server = "ldap://127.0.0.1/"
LDAP base DN = "dc=example,dc=com"
nss_nis is disabled
NIS server = ""
NIS domain = ""
nss_nisplus is disabled
nss_winbind is enabled
SMB workgroup = "CME"
SMB servers = "prod-srv-8.cme.com"
SMB security = "ads"
SMB realm = "CME.COM"
Winbind template shell = "/bin/bash"
SMB idmap uid = "110000-119999"
SMB idmap gid = "110000-119999"
nss_wins is enabled
pam_unix is always enabled
shadow passwords are enabled
password hashing algorithm is md5
pam_krb5 is enabled
krb5 realm = "CME.COM"
krb5 realm via dns is enabled
krb5 kdc = "prod-srv-8.cme.com:88,prod-srv-8.cme.com"
krb5 kdc via dns is enabled
krb5 admin server = "prod-srv-8.cme.com:749"
pam_ldap is disabled
LDAP+TLS is disabled
LDAP server = "ldap://127.0.0.1/"
LDAP base DN = "dc=example,dc=com"
pam_pkcs11 is disabled
use only smartcard for login is disabled
smartcard module = "coolkey"
smartcard removal action = "Ignore"
pam_smb_auth is enabled
SMB workgroup = "CME"
SMB servers = "prod-srv-8.cme.com"
pam_winbind is enabled
SMB workgroup = "CME"
SMB servers = "prod-srv-8.cme.com"
SMB security = "ads"
SMB realm = "CME.COM"
pam_cracklib is enabled (try_first_pass retry=3)
pam_passwdqc is disabled ()
pam_access is disabled ()
pam_mkhomedir is enabled ()
Always authorize local users is enabled ()
Authenticate system accounts against network services is disabled
Charles Johnson
Information Technology
Custom Manufacturing & Engineering
2904 44th Ave. N
St. Petersburg, FL 33714
P: 727-548-0522 ext 1759
F: 727-541-8822
www.custom-mfg-eng.com
