On 12/02/15 09:51, sk at green.no wrote:> samba-bounces at lists.samba.org wrote on 09.02.2015 20:52:43:
>
>> OK, make the [global] part of your smb.conf look like this:
>>
>> [global]
>> netbios name = bgo-nfs01
>> workgroup = GREENREEFERS
>> security = ADS
>> realm = GREENREEFERS.NO
>> dedicated keytab file = /etc/krb5.keytab
>> kerberos method = secrets and keytab
>> server string = %h server
>> winbind enum users = yes
>> winbind enum groups = yes
>> winbind use default domain = yes
>> winbind trusted domains only = no
>> winbind nested groups = yes
>> winbind refresh tickets = Yes
>> winbind nss info = rfc2307
>> idmap config *:backend = tdb
>> idmap config *:range = 2000-9999
>> idmap config GREENREEFERS:backend = rid
>> idmap config GREENREEFERS:range=10000-99999
>> load printers = no
>> printing = bsd
>> printcap name = /dev/null
>> disable spoolss = yes
>> preferred master = no
>> local master = no
>> template homedir = /dev/null
>> template shell = /bin/true
>> syslog = 0
>> log file = /var/log/samba/log.%m
>> max log size = 1000
>> dns proxy = No
>> interfaces = eth1 lo
>> bind interfaces only = yes
>> log level = 2 msdfs:8 auth:5 winbind:5 idmap:5 acls:3
>> panic action = /usr/share/samba/panic-action %d
>> valid users = @"GREENREEFERS\grr"
>> vfs objects = acl_xattr
>> map acl inherit = Yes
>> store dos attributes = Yes
>>
>> Check that /etc/krb5.conf exists and looks like this:
>>
>> [libdefaults]
>> default_realm = GREENREEFERS.NO
>> dns_lookup_realm = false
>> dns_lookup_kdc = true
>>
>> Check that /etc/resolv.conf points to your AD DC (first on list)
>>
>> Check that the passwd & group lines in /etc/nsswitch.conf contain
> 'winbind'
>
> Hi, sorry for late answer.
>
> I did change the [global], and pasted smb.cfg here:
> http://pastebin.com/WRNCKu42
> I changed the krb5.conf file and pasted it here:
> http://pastebin.com/JqSavqD1
> nsswitch.com is unchanged, pasted here: http://pastebin.com/bW3HcKKN
> resolv.conf have been correct all the time, I have verified now as well.
>
Does 'getent passwd <a domain user>' now show anything ?
Rowland