samba - Oct 2019 - net ads join -- strange message

Hello,

I have an server ad? - everything seems ok
I have a windows client and a linux client . The users must to connect 
on windows or on linux with the same home.

when I join my client linux with the command net ads join -U 
administration I have after the following message

net ads join -U administrator
Enter administrator's password:

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password

Error reading password from file descriptor 0: empty password
Using short domain name -- SAMBADOM
Joined 'CLIENTBLUESEYE' to dns domain 'sambadom.calais.fr'

but my machine is joined to my samba AD.

Why I have this error ?
In my log samba I have :
 ?load_auth_module: Attempting to find an auth method to match samba4
/usr/sbin/smbd: load_auth_module: auth method samba4 has a valid init
/usr/sbin/smbd: ldb_wrap open of secrets.ldb
/usr/sbin/smbd: Starting GENSEC mechanism spnego
/usr/sbin/smbd: Starting GENSEC submechanism gssapi_krb5


Does it test different authentication methods ?


My smb.conf server is? :

# Global parameters
[global]
 ??? dns forwarder = 193.49.xxx.xxx
 ??? netbios name = BLUEYESTEST
 ??? realm = SAMBADOM.CALAIS.FR
 ??? server role = active directory domain controller
 ??? workgroup =SAMBADOM
 ??? idmap_ldb:use rfc2307 = yes
 ??? log level =5
 ??? log file =/var/log/samba3/log.%M
 ??? max log size = 1000
 ??? host msdfs = no
#??? vfs objects = acl_xattr
#??? map acl inherit =yes
#??? store dos attributes = yes
 ??? load printers = no
 ??? printing = bsd
 ??? printcap name = /dev/null
 ??? disable spoolss = yes

#? for tests only
 ??? winbind enum users =yes
 ??? winbind enum groups =yes
#
 ??? winbind separator = /
 ??? winbind use default domain = yes

[netlogon]
 ??? path = /var/lib/samba/sysvol/sambadom.calais.fr/scripts
 ??? read only = No
 ??? writable = yes

[sysvol]
 ??? path = /var/lib/samba/sysvol
 ??? read only = No
 ??? browsable =yes
[homes]
 ??? path=/home/SAMBADOM/%G/%U
 ??? writable=yes
 ??? read only = no


my smb.conf client linux is

[global]
 ??? security =ADS
 ??? realm = SAMBADOM.CALAIS.FR
 ??? workgroup =SAMBADOM
 ??? netbios name = clientblueseye
 ??? winbind separator = /
 ??? winbind enum users = yes
 ??? winbind enum groups = yes


 ??? idmap config * : backend=tdb
 ??? idmap config * : range=1000-2000

 ??? idmap config SAMBADOM : backend = ad
 ??? idmap config SAMBADOM : schema_mode =rfc2307
 ??? idmap config SAMBADOM : backend = rid
 ??? idmap config SAMBADOM : range = 10000-600000
 ??? idmap config SAMBADOM : unix_nss_info = yes
 ??? idmap config SAMBADOM : unix_primary_group = yes
 ??? template homedir =/etudiants/%U

#??? template homedir = /home/%D/%G/%U

 ??? template shell =/bin/bash
 ??? kerberos method =? secrets and keytab
 ??? dedicated keytab file =/etc/krb5.keytab
 ??? winbind refresh tickets =yes
#
#??? username map = /etc/samba/samba_usermapping
 ??? winbind use default domain = yes
 ??? log file =/var/log/samba/log.%m
 ??? log level = 3
# for acl support on members servers with shares
#??? vfs object = acl_xattr
#??? map acl inherit = yes
#??? store dos attributes = yes
#??? winbind nss info = rfc2307




Thanks for your help

Sincerely

-- 
Nathalie RAMAT-LECLERCQ

Service Informatique

Universite du Littoral-C?te d'Opale
SCoSI - Service Commun du Syst?me d'Information
P?le Syst?mes et r?seaux

Centre de Gestion Universitaire de Calais
50 rue ferdinand Buisson
C.S 80699
62228 CALAIS CEDEX

On 23/10/2019 10:51, nathalie ramat via samba wrote:
> Hello,
>
> I have an server ad? - everything seems ok
> I have a windows client and a linux client . The users must to connect 
> on windows or on linux with the same home.
>
> when I join my client linux with the command net ads join -U 
> administration I have after the following message
>
> net ads join -U administrator
> Enter administrator's password:
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
>
> Error reading password from file descriptor 0: empty password
> Using short domain name -- SAMBADOM
> Joined 'CLIENTBLUESEYE' to dns domain 'sambadom.calais.fr'
>
> but my machine is joined to my samba AD.
>
> Why I have this error ?
I do not think this has anything to do with Samba, but 'The users must 
to connect on windows or on linux with the same home' may give a hint, 
are you using something like pam-mount ?

>
> My smb.conf server is? :
>
> # Global parameters
> [global]
> ??? dns forwarder = 193.49.xxx.xxx
> ??? netbios name = BLUEYESTEST
> ??? realm = SAMBADOM.CALAIS.FR
> ??? server role = active directory domain controller
> ??? workgroup =SAMBADOM
> ??? idmap_ldb:use rfc2307 = yes
> ??? log level =5
> ??? log file =/var/log/samba3/log.%M
> ??? max log size = 1000
> ??? host msdfs = no
> #??? vfs objects = acl_xattr
> #??? map acl inherit =yes
> #??? store dos attributes = yes
> ??? load printers = no
> ??? printing = bsd
> ??? printcap name = /dev/null
> ??? disable spoolss = yes
>
> #? for tests only
> ??? winbind enum users =yes
> ??? winbind enum groups =yes
> #
> ??? winbind separator = /
> ??? winbind use default domain = yes
>
> [netlogon]
> ??? path = /var/lib/samba/sysvol/sambadom.calais.fr/scripts
> ??? read only = No
> ??? writable = yes
>
> [sysvol]
> ??? path = /var/lib/samba/sysvol
> ??? read only = No
> ??? browsable =yes
> [homes]
> ??? path=/home/SAMBADOM/%G/%U
> ??? writable=yes
> ??? read only = no
Er, you do know that 'writable=yes' and 'read only = no' mean
the same
thing, you only need one of them.
>
>
> my smb.conf client linux is
>
> [global]
> ??? security =ADS
> ??? realm = SAMBADOM.CALAIS.FR
> ??? workgroup =SAMBADOM
> ??? netbios name = clientblueseye
> ??? winbind separator = /
> ??? winbind enum users = yes
> ??? winbind enum groups = yes
>
>
> ??? idmap config * : backend=tdb
> ??? idmap config * : range=1000-2000
With that line, you cannot have any local Unix users
>
> ??? idmap config SAMBADOM : backend = ad
> ??? idmap config SAMBADOM : schema_mode =rfc2307
> ??? idmap config SAMBADOM : backend = rid
> ??? idmap config SAMBADOM : range = 10000-600000
> ??? idmap config SAMBADOM : unix_nss_info = yes
> ??? idmap config SAMBADOM : unix_primary_group = yes
Sorry, but you cannot use both the 'ad' and 'rid' winbind
backend,
choose one and remove the other and if you choose 'rid', remove the 
unneeded extra 'ad' lines
> template homedir =/etudiants/%U
>
> #??? template homedir = /home/%D/%G/%U
>
> ??? template shell =/bin/bash
> ??? kerberos method =? secrets and keytab
> ??? dedicated keytab file =/etc/krb5.keytab
> ??? winbind refresh tickets =yes
> #
> #??? username map = /etc/samba/samba_usermapping
turn this back on
>
> ??? winbind use default domain = yes
> ??? log file =/var/log/samba/log.%m
> ??? log level = 3
> # for acl support on members servers with shares
> #??? vfs object = acl_xattr
> #??? map acl inherit = yes
> #??? store dos attributes = yes
also turn these on again

Rowland

hello,

Le 23/10/2019 ? 12:45, Rowland penny via samba a ?crit?:
> On 23/10/2019 10:51, nathalie ramat via samba wrote:
>> Hello,
>>
>> I have an server ad? - everything seems ok
>> I have a windows client and a linux client . The users must to 
>> connect on windows or on linux with the same home.
>>
>> when I join my client linux with the command net ads join -U 
>> administration I have after the following message
>>
>> net ads join -U administrator
>> Enter administrator's password:
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>>
>> Error reading password from file descriptor 0: empty password
>> Using short domain name -- SAMBADOM
>> Joined 'CLIENTBLUESEYE' to dns domain
'sambadom.calais.fr'
>>
>> but my machine is joined to my samba AD.
>>
>> Why I have this error ?
>
> I do not think this has anything to do with Samba, but 'The users must 
> to connect on windows or on linux with the same home' may give a hint, 
> are you using something like pam-mount ?
>
>
yes i use pam_mount.


I have modified the script pam_mount.conf.xml .to create the directory 
of my? user.

<?xml version="1.0" encoding="UTF-8"?>

<pam_mount>
<debug enable="1"/>
<mkmountpoint enable="1" />
<mntoptions allow="nosuid,nodev,loop,encryption,fsck" />
<mntoptions require="nosuid,nodev" />
<lsof>/usr/bin/lsof %(MNTPT) </lsof>
<cifsmount> /sbin/mount.cifs //%(SERVER)/%(VOLUME) %(MNTPT) -o 
"user=%(USER),domain=SAMBADOM,uid=%(USER),gid=%(USERGID),cifsacl,file_mode=0700,dir_mode=0700"
</cifsmount>
<umount>/bin/umount %(MNTPT) </umount>
<volume 
options="username=%(DOMAIN_USER),workgroup=%(DOMAIN_NAME),uid=%(DOMAIN_USER),fmask=700,file_mode=0700,dir_mode=0700"
mountpoint="/etudiants/%(USER)" path="%(DOMAIN_USER)" 
server="blueyestest" fstype="cifs" />
</pam_mount>



The home of my user? mount correctly. I have juste problem via les acl .

on the server my user have this rights

root at blueyestest:/home/SAMBADOM/specifique/testjeudi# ls -l
total 12
-rwxrwxr--+ 1 SAMBADOM/testjeudi SAMBADOM/specifique??? 0 oct.? 21 11:59 
testlinux21102019
drwxrwxr--+ 2 SAMBADOM/testjeudi SAMBADOM/specifique 4096 oct.? 17 13:39 
testwindow17102019

root at blueyestest:/home/SAMBADOM/specifique/testjeudi# getfacl 
testlinux21102019
# file: testlinux21102019
# owner: SAMBADOM/testjeudi
# group: SAMBADOM/specifique
user::rwx
group::r--
group:SAMBADOM/specifique:r--
group:SAMBADOM/testjeudi:rwx
mask::rwx
other::r--




on my client linux the rights are :

 ?-rwx------ 1 testjeudi specifique??? 0 oct.? 21 11:59 testlinux21102019
drwxr-x--- 2 testjeudi specifique??? 0 oct.? 17 13:39 testwindow17102019



I think that acl are not supported by smb3.1.1 ?
>>
>> My smb.conf server is? :
>>
>> # Global parameters
>> [global]
>> ??? dns forwarder = 193.49.xxx.xxx
>> ??? netbios name = BLUEYESTEST
>> ??? realm = SAMBADOM.CALAIS.FR
>> ??? server role = active directory domain controller
>> ??? workgroup =SAMBADOM
>> ??? idmap_ldb:use rfc2307 = yes
>> ??? log level =5
>> ??? log file =/var/log/samba3/log.%M
>> ??? max log size = 1000
>> ??? host msdfs = no
>> #??? vfs objects = acl_xattr
>> #??? map acl inherit =yes
>> #??? store dos attributes = yes
>> ??? load printers = no
>> ??? printing = bsd
>> ??? printcap name = /dev/null
>> ??? disable spoolss = yes
>>
>> #? for tests only
>> ??? winbind enum users =yes
>> ??? winbind enum groups =yes
>> #
>> ??? winbind separator = /
>> ??? winbind use default domain = yes
>>
>> [netlogon]
>> ??? path = /var/lib/samba/sysvol/sambadom.calais.fr/scripts
>> ??? read only = No
>> ??? writable = yes
>>
>> [sysvol]
>> ??? path = /var/lib/samba/sysvol
>> ??? read only = No
>> ??? browsable =yes
>> [homes]
>> ??? path=/home/SAMBADOM/%G/%U
>> ??? writable=yes
>> ??? read only = no
> Er, you do know that 'writable=yes' and 'read only = no'
mean the same
> thing, you only need one of them.
>>
>>
>> my smb.conf client linux is
>>
>> [global]
>> ??? security =ADS
>> ??? realm = SAMBADOM.CALAIS.FR
>> ??? workgroup =SAMBADOM
>> ??? netbios name = clientblueseye
>> ??? winbind separator = /
>> ??? winbind enum users = yes
>> ??? winbind enum groups = yes
>>
>>
>> ??? idmap config * : backend=tdb
>> ??? idmap config * : range=1000-2000
> With that line, you cannot have any local Unix users
All users are created in my ad. I have juste one local user (id 1000)- 
created during installation. I decided to use backend ad .
I give Uidnumber, GidNumber and UnixHomeDirectory directly in the samba 
attributes
>>
>> ??? idmap config SAMBADOM : backend = ad
>> ??? idmap config SAMBADOM : schema_mode =rfc2307
>> ??? idmap config SAMBADOM : backend = rid
>> ??? idmap config SAMBADOM : range = 10000-600000
>> ??? idmap config SAMBADOM : unix_nss_info = yes
>> ??? idmap config SAMBADOM : unix_primary_group = yes
> Sorry, but you cannot use both the 'ad' and 'rid' winbind
backend,
> choose one and remove the other and if you choose 'rid', remove the
> unneeded extra 'ad' lines
>> template homedir =/etudiants/%U
>>
>> #??? template homedir = /home/%D/%G/%U
>>
>> ??? template shell =/bin/bash
>> ??? kerberos method =? secrets and keytab
>> ??? dedicated keytab file =/etc/krb5.keytab
>> ??? winbind refresh tickets =yes
>> #
>> #??? username map = /etc/samba/samba_usermapping
> turn this back on
>>
>> ??? winbind use default domain = yes
>> ??? log file =/var/log/samba/log.%m
>> ??? log level = 3
>> # for acl support on members servers with shares
>> #??? vfs object = acl_xattr
>> #??? map acl inherit = yes
>> #??? store dos attributes = yes
> also turn these on again
>
> Rowland
>
>
>
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
-- 
Nathalie RAMAT-LECLERCQ

Service Informatique

Universite du Littoral-C?te d'Opale
SCoSI - Service Commun du Syst?me d'Information
P?le Syst?mes et r?seaux

Centre de Gestion Universitaire de Calais
50 rue ferdinand Buisson
C.S 80699
62228 CALAIS CEDEX