similar to: winbind authentication mystery

Greetings, I'm running Fedora 11 (Samba 3.3.2) and am trying to configure winbind authentication against a Windows 2003 server. I've run kinit and net join successfully, and can wbinfo -u, -g, and -t successfully, as well as getent passwd and getent group successfully. I can even use passwd to change domain user passwords. However, when I try to log in via gdm, ssh, or even su, I do not

We've discovered that although Winbind supports password changes when the account password is expired, this only works with *interactive* shells. This is a major problem for us. Use case 1: SSH tunnels: $ ssh user2@localhost -N -L 4711:localhost:22 user2@localhost's password: <trying to use the tunnel> channel 2: open failed: administratively prohibited: open failed As you can

> -----Original Message----- > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of L.P.H. van > Belle via samba > Sent: 24 July 2018 09:41 > To: samba at lists.samba.org > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due time > differences with the domain controller > > I did re-read the whole thread again. > > Im running out

Ben Love had this to say: > * Mike Leone wrote on [2010-03-27 22:02:38 -0400]: >> I tried to log on as "DACRIB+administrator" at the physical console. I >> was prompted twice for my password (dunno if that's because my password >> has a "!" in it or not). Then it starts to login. I see the motd. I see >> it say that it was trying to create a

On 7/28/2020 4:11 PM, Jason Keltz wrote: > > On 7/28/2020 3:59 PM, Jason Keltz via samba wrote: >> I'm experimenting with smb + winbind. >> >> My host is joined to AD and I can login to my host fine using my AD >> credentials via SSH.?? The only issue is that I don't get a Kerberos >> ticket generated. >> >> In

Hi People! I use pam_winbind for authentication in my computer workstation using Debian Lenny 5.0, Stable Version. I configure my user with this option "sambaPwdMustChange: 0", and I logon in GDM without asking to change password. Who knows what can be? I use Samba PDC with Heimdal Kerberos, but, I configure PAM with only pam_winbind for tests... Client versions: ii

When we installed OpenSSH 2.1.1p4 on our Solaris systems, our users noticed that it did not honor password expiration consistently with other Solaris login services. The patch below is against OpenSSH 2.2.0p1 and adds support for PAM password changes on expiration via pam_chauthtok(). A brief summary of changes: auth-pam.c: * change declaration of pamh to "static pam_handle_t *pamh",

I've attached two patches. The first just changes the output of "ssh -V" to print that it was built against rsaref if libRSAglue (which is built as part of openssl only when it is built against rsaref) is present at build-time. The second adds appropriate calls to pam_setcred() in sshd. Without them, our systems can't access AFS because the PAM modules only get tokens at a

>> >Could we please have a clarification on the semantics of >> >PAM_CRED_ESTABLISH vs. the semantics of PAM_REINITIALIZE_CREDS? >> >> My interpretation is: >> >> You call PAM_ESTABLISH_CRED to create them >> You call PAM_REINITIALIZE_CRED to update creds that can expire over time, >> for example a kerberos ticket. Oops. I meant

This is the second attempt at sending this. Apologies for any duplicates. I've got Winbind up and running to authenticate our users against our AD and to save kerberos tickets. I have used the "winbind refresh tickets = yes" setting expecting this to renew these kerberos tickets before they expire. This does not appear to work. Gnome will pop up a dialog box saying that the

Hi, i use mandrake 8.2 and i have this error when i run the following command (for pam use). I also have the same error on older mandrake's. Is this related to mandrake or what ? Someone has a solution plz ? make nsswitch/pam_winbind.so Compiling nsswitch/pam_winbind.c with -fPIC nsswitch/pam_winbind.c:65: parse error before `*' nsswitch/pam_winbind.c: In function `converse':

Guys, I'm having some problems trying to compile Samba-2.2.7a --with-pam. The ./configure works fine but the compile fails. I have no problems --without-pam. Any help would be greately appreciated. Linux SuSE SLES7 on S390, Kernel 2.4.19, Samba 2.2.7a, gcc-2.95.3-62, pam-0.74-34, pam-devel-0.74-34 ./configure \ --prefix=/usr \ --sysconfdir=/etc/samba \ --localstatedir=/var/log/samba \

Greetings, ***Warning: New to compiling and use RPMs whenever I can :-)*** When trying to compile I get the above error. It is preceded by: ======= . . . Compiling nsswitch/pam_winbind.c with -fPIC nsswitch/pam_winbind.c:60: parse error before `*' nsswitch/pam_winbind.c: In function `converse': nsswitch/pam_winbind.c:67: `pamh' undeclared (first use in this function)

http://bugzilla.mindrot.org/show_bug.cgi?id=127 Summary: PAM with ssh authentication and pam_krb5 doesn't work properly Product: Portable OpenSSH Version: 3.0.2p1 Platform: UltraSparc OS/Version: Solaris Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo:

I tried to compile pam_ldap-184 but it gave lots of error msgs. BTW, I have successfully compiled nss_ldap-255. For pam_ldap, my configure looks like: ./configure --with-ldap-lib=openldap --with-ldap-dir=/usr/local --with-ldap-conf-file=/usr/local/etc/openldap/ldap.conf and the following is the configure output --- start of configure output --- creating cache ./config.cache checking host system

while trying to sort out the PAM incompatabilities between openssh 3.0.2p1 and solaris 8 and sun's pam_krb5 i got some things to work. i'm really not sure where the appropriate place to submit patches is so for now i'm sending them here. this patch will allow PAM interoperability when using sun's pam_krb5 without using the system login routine (this way X forwarding will

>Neither the Sun PAM documentation nor the Linux-PAM documentation >describe the semantics of PAM_REINITIALIZE_CREDS in any useful detail. I would agree it is vague, but then that is also a problem with the XSSO document (http://www.opengroup.org/onlinepubs/008329799/) >Could we please have a clarification on the semantics of >PAM_CRED_ESTABLISH vs. the semantics of

Hello everyone, I've installed Samba 4.0.4 from source on an Ubuntu Server 12.04 machine. I've configured it as an AD DC following the instructions here: http://wiki.samba.org/index.php/Samba_AD_DC_HOWTO Then I configured Winbind following the instructions here: http://wiki.samba.org/index.php/Samba4/Winbind Users can now login through SSH to the server and access their files and

Hi Team, We have a weird issue that we are trying to understand. We have winbind set up and working successfully for user authentication with passwords via ssh. We have pam.d/system-auth-ac and password-auth-ac (symlinked) set to require membership of a group which works great via password authentication. However, if the user has a ssh key set up, they seem to bypass the group membership

A few things to keep in mind: - kbd-int should call pam_authenticate(), acct_mgmt(), chauthtok(), if required, setcred(PAM_ESTABLISH_CRED) and open_session() ALL during kbd-int so that modules in each of those PAM stacks can prompt the user (pam_open_session(), for example, may prompt a user with an informational message akin to the last login message) - all userauth methods should