Hi,
I'm running a mixed linux/Windows network with authentication done using
Active Directory. The Linux clients use Samba/Winbind for
authentication (with help from the list, thanks!). I've setup smb.conf
such that doing 'net ads join -Uadministrator' populates
my /etc/krb5.keytab (see configuration files below).
klist shows me a nice set of principals from /etc/krb5.keytab
klist -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
----
--------------------------------------------------------------------------
2 host/ubuntu.sonytel.be at EDEN.SONYTEL.BE
2 host/ubuntu.sonytel.be at EDEN.SONYTEL.BE
2 host/ubuntu.sonytel.be at EDEN.SONYTEL.BE
2 host/ubuntu at EDEN.SONYTEL.BE
2 host/ubuntu at EDEN.SONYTEL.BE
2 host/ubuntu at EDEN.SONYTEL.BE
2 UBUNTU$@EDEN.SONYTEL.BE
2 UBUNTU$@EDEN.SONYTEL.BE
2 UBUNTU$@EDEN.SONYTEL.BE
If I look on the AD server using ADSI edit I see the following values in
the servicePrincipalName field for the clients Computer object:
HOST/UBUNTU
HOST/ubuntu.sonytel.be
However when I try to use any of the principals using 'kinit -k
principalname' I get:
kinit host/ubuntu.sonytel.be at EDEN.SONYTEL.BE
kinit: Client not found in Kerberos database while getting initial
credentials
Why doesn't this work?
The reason why I'm asking is because I'm also trying to get NFSv4 with
kerberos going, however when I try to mount a remote filesystem I see
the following error messages and the mount gets a permission denied:
handling krb5 upcall
Full hostname for 'linux2-install.sonytel.be' is
'linux2-install.sonytel.be'
Full hostname for 'ubuntu.sonytel.be' is 'ubuntu.sonytel.be'
Key table entry not found while getting keytab entry for
'root/ubuntu.sonytel.be at EDEN.SONYTEL.BE'
Key table entry not found while getting keytab entry for
'nfs/ubuntu.sonytel.be at EDEN.SONYTEL.BE'
Success getting keytab entry for
'host/ubuntu.sonytel.be at EDEN.SONYTEL.BE'
WARNING: Client not found in Kerberos database while getting initial
ticket for principal 'host/ubuntu.sonytel.be at EDEN.SONYTEL.BE' using
keytab 'WRFILE:/etc/krb5.keytab'
ERROR: No credentials found for connection to server
linux2-install.sonytel.be
doing error downcall
destroying client clnt19
Any idea what might be wrong?
Nico
---------------------------------------------------------------------------
==== /etc/samba/smb.conf
[global]
server string = %h server (Samba, Ubuntu)
wide links = yes
unix extensions = no
server signing = mandatory
security = ads
workgroup = EDEN
realm = EDEN.SONYTEL.BE
kerberos method = secrets and keytab
dedicated keytab file = /etc/krb5.keytab
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
pam password change = yes
map to guest = bad user
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
idmap backend = ad
idmap config EDEN:backend = ad
idmap config EDEN:default = yes
idmap config EDEN:schema_mode = rfc2307
idmap config EDEN:range = 999-999999
winbind nss info = rfc2307
winbind enum groups = yes
winbind enum users = yes
winbind use default domain = yes
winbind offline logon = true
winbind refresh tickets = true
usershare allow guests = no
==== /etc/krb5.conf
[libdefaults]
default_realm = EDEN.SONYTEL.BE
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[realms]
EDEN.SONYTEL.BE = {
kdc = deus.eden.sonytel.be
admin_server = deus.eden.sonytel.be
}
[domain_realm]
.eden.sonytel.be = EDEN.SONYTEL.BE
eden.sonytel.be = EDEN.SONYTEL.BE
.sonytel.be = EDEN.SONYTEL.BE
sonytel.be = EDEN.SONYTEL.BE
[login]
krb4_convert = true
krb4_get_tickets = false
====== environment
Linux clients: Ubuntu 9.10 or 10.04
running Samba 3.4.x
Windows server: 2008 R2
--
With kind regards
Nico De Ranter
Senior System Administrator
Techsoft Centre
Technology and Software Centre Europe
The Corporate Village - Da Vincilaan 7-D1 - B-1935 Zaventem - Belgium
Phone: +32 (0)2 700 8641
Fax: +32 (0)2 700 8622
E-mail: nico.deranter at eu.sony.com
A division of Sony Europe (Belgium) N.V.
VAT BE 0413.825.160 - RPR Brussels
Fortis - BIC GEBABEBB - IBAN BE41293037680010
