1

I am new to SLES and Samba so I need some help. I set up Samba on SUSE 11 successfully. I was able to create a share with no user restrictions which I managed to access from Windows. But I want to allow only a specific group of users to access the share. So I am using "valid users", "read list" and "write list". But once I add valid users to my config file, I am no longer able to access the share. Even though I entered the correct credentials, I am getting access denied error. I tried with root, with local user account, with AD domain user. None of this works. Can you give me a suggestion on how I can solve this. Here is my smb.conf file:

# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
# Date: 2012-02-03
[global]
    workgroup = *******
    passdb backend = tdbsam
    printing = cups
    printcap name = cups
    printcap cache time = 750
    cups options = raw
    map to guest = Bad User
    include = /etc/samba/dhcp.conf
    logon path = \\%L\profiles\.msprofile
    logon home = \\%L\%U\.9xprofile
    logon drive = P:
    usershare allow guests = No
    idmap gid = 10000-20000
    idmap uid = 10000-20000
    realm = ********
    security = ADS
    template homedir = /home/%D/%U
    template shell = /bin/bash
    usershare max shares = 100
    winbind refresh tickets = yes
    wins support = No
[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes
[profiles]
    comment = Network Profiles Service
    path = %H
    read only = No
    store dos attributes = Yes
    create mask = 0600
    directory mask = 0700
[users]
    comment = All users
    path = /home
    read only = No
    inherit acls = Yes
    veto files = /aquota.user/groups/shares/
[groups]
    comment = All groups
    path = /home/groups
    read only = No
    inherit acls = Yes
[printers]
    comment = All Printers
    path = /var/tmp
    printable = Yes
    create mask = 0600
    browseable = No

[Share]
    inherit acls = Yes
    path = /share/Share
    read only = No
    browseable = Yes
    valid users = @****+Group1, *****+user1

Here is the output of the logfile, when I amn trying to access the share:

[2013/05/17 15:39:18.753943,  3] lib/access.c:338(allow_access)
  Allowed connection from IP Address(IP Address)
[2013/05/17 15:39:18.754178,  3] smbd/oplock.c:922(init_oplocks)
  init_oplocks: initializing messages.
[2013/05/17 15:39:18.754281,  3] smbd/oplock_linux.c:226(linux_init_kernel_oplocks)
  Linux kernel oplocks enabled
[2013/05/17 15:39:18.754396,  3] smbd/process.c:1662(process_smb)
  Transaction 0 of length 137 (0 toread)
[2013/05/17 15:39:18.754447,  3] smbd/process.c:1467(switch_message)
  switch message SMBnegprot (pid 11575) conn 0x0
[2013/05/17 15:39:18.754827,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [PC NETWORK PROGRAM 1.0]
[2013/05/17 15:39:18.754882,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LANMAN1.0]
[2013/05/17 15:39:18.754922,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [Windows for Workgroups 3.1a]
[2013/05/17 15:39:18.754959,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LM1.2X002]
[2013/05/17 15:39:18.754996,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LANMAN2.1]
[2013/05/17 15:39:18.755035,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [NT LM 0.12]
[2013/05/17 15:39:18.755163,  3] smbd/negprot.c:419(reply_nt1)
  using SPNEGO
[2013/05/17 15:39:18.755204,  3] smbd/negprot.c:704(reply_negprot)
  Selected protocol NT LM 0.12
[2013/05/17 15:39:18.757824,  3] smbd/process.c:1662(process_smb)
  Transaction 1 of length 142 (0 toread)
[2013/05/17 15:39:18.757917,  3] smbd/process.c:1467(switch_message)
  switch message SMBsesssetupX (pid 11575) conn 0x0
[2013/05/17 15:39:18.757970,  3] smbd/sesssetup.c:1333(reply_sesssetup_and_X)
  wct=12 flg2=0xc807
[2013/05/17 15:39:18.758013,  2] smbd/sesssetup.c:1279(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2013/05/17 15:39:18.758051,  3] smbd/sesssetup.c:1065(reply_sesssetup_and_X_spnego)
  Doing spnego session setup
[2013/05/17 15:39:18.758091,  3] smbd/sesssetup.c:1107(reply_sesssetup_and_X_spnego)
  NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
[2013/05/17 15:39:18.758159,  3] smbd/sesssetup.c:660(reply_spnego_negotiate)
  reply_spnego_negotiate: Got secblob of size 40
[2013/05/17 15:39:18.758344,  3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  Got NTLMSSP neg_flags=0xe2088297
[2013/05/17 15:39:18.762052,  3] smbd/process.c:1662(process_smb)
  Transaction 2 of length 486 (0 toread)
[2013/05/17 15:39:18.762108,  3] smbd/process.c:1467(switch_message)
  switch message SMBsesssetupX (pid 11575) conn 0x0
[2013/05/17 15:39:18.762152,  3] smbd/sesssetup.c:1333(reply_sesssetup_and_X)
  wct=12 flg2=0xc807
[2013/05/17 15:39:18.762190,  2] smbd/sesssetup.c:1279(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2013/05/17 15:39:18.762225,  3] smbd/sesssetup.c:1065(reply_sesssetup_and_X_spnego)
  Doing spnego session setup
[2013/05/17 15:39:18.762262,  3] smbd/sesssetup.c:1107(reply_sesssetup_and_X_spnego)
  NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
[2013/05/17 15:39:18.762313,  3] ../libcli/auth/ntlmssp_server.c:348(ntlmssp_server_preauth)
  Got user=[user1] domain=[DOMAINNAME] workstation=[WORKSTATIONNAME] len1=24 len2=246
1
  • I forgot to write that I replaced the domain name with ******
    – stancheva
    May 17, 2013 at 8:10

1 Answer 1

0

Sorry for no writing this as a comment, but my rep is not high enough for that.

What I see is that you use + as a separator for Domain and Group, but you didn't set the + as the winbind separator in your config.

winbind separator = +

Also you're setting the passdb backend to tdbsam which is a local database. This is probably the reason why your AD authentication fails.

Try setting the following:

workgroup = [SHORTDOMAINNAME]
realm = [KERBEROS REALM / LONG DOMAIN NAME]
password server = [fqdn of your pdc]
winbind use default domain = yes
encrypt passwords = yes
security = ads

the realm and workgroup should be all in caps and match your 'krb5.conf' file

krb5.conf:

[libdefaults]
    default_realm = [KERBEROS REALM / LONG DOMAIN NAME]
    dns_lookup_realm = true
    dns_lookup_kdc = true
    default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    clockskew = 300
    forwardable = true
    proxiable = true

[realms]
    [KERBEROS REALM / LONG DOMAIN NAME] = {
            kdc = [fqdn of your pdc]
            default_domain = [long domain name lowercase]
    }
[domain_realm]
    .[long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]
    [long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]

You can also check if everything works with

wbinfo -u 

and you should see the list of users

wbinfo -g 

to see the list of groups.

If you have groups with spaces in the name, don't forget to put them in " in valid users

Hope it helps

10
  • everything in caps like [KERBEROS REALM] should also be in caps in the config
    – Meiko Watu
    May 17, 2013 at 9:26
  • Hello Meiko, Thanks a lot for the quick response. I did everything you said, but unfortunately I am still not able to access the share. It keeps saying access denied :( Do you have a clue what else might be wrong?
    – stancheva
    May 17, 2013 at 10:52
  • I have added the log output to my posts. It might help.
    – stancheva
    May 17, 2013 at 10:56
  • getent passwd lists only local accounts, but it should list AD accounts as well. Also in the /lib directory I have libnss_winbind.so.2 and libnss_wins.so.2 , but libnss_winbind.so and libnss_wins.so are missing, so I am thinking maybe my winbind configuration is not correct. But I am not sure how can I fix it. Can anybody give me a clue????
    – stancheva
    May 17, 2013 at 12:21
  • Hey! do you use samba 3.6 or samba 4? I remember from my last samba setup that it was necessary to link the winbind and libnss so's manually. maybe give it a try: ln -s /lib/libnss_winbind.so.2 /lib/libnss_winbind.so and ln -s libnss_wins.so.2 libnss_wins.so Found a source for it just for the Samba4 installation now wiki.samba.org/index.php/Samba4/Winbind
    – Meiko Watu
    May 17, 2013 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .