4

I'm trying to get my linux box to use active directory authentication. I believe I have almost everything setup correctly. I'm able to issue wbinfo -g and wbinfo -u and see all the groups and users respectively.

Brief intro to my setup:

The username I use on my linux box to do admin things is nick. My active directory username is nwalke. They have two different passwords. I am able to log in to the box with nick and that user's password and I'm also able to login as nwalke with nwalke's password.

The curious bit:

Upon creating the active directory user's home directory, I run a script that requires root access. This is to setup some system wide things like a samba share for them. When I log in as nwalke, I enter my nwalke password and it succeeds. I'm then greeted with [sudo] password for nick:. If I enter my nwalke password here, it says Sorry, try again.. If I enter nick's password, it says Sorry, user nick is not allowed to execute scriptname as root.

If I do groups as nwalke, I see that magically my user has been given the group nick.

Now, I accidentally thought that nick had a UID of 100, not 1000. So originally in my smb.conf I had idmap uid 1000-10000. The only thing I can think of, is that I logged in with nwalke while that was still set and now I'm just being presented with a UID of 1000 forcing linux to think I'm nick.

I'm not really sure where to go from here. Like I said, I'm fairly certain active directory is communicating with my server properly, but something must not be mapped right on the linux side.

Any thoughts?

Here is my smb.conf:

[global]
    security = ads
    netbios name = hostname
    realm = COMPANY.COM
    password server = adshost.company.com
    workgroup = COMPANY
    idmap uid = 10000-90000
    idmap gid = 10000-90000
    winbind separator = +
    winbind enum users = no
    winbind enum groups = no
    winbind use default domain = yes
    template homedir = /home/%D/%U
    template shell = /bin/bash
    client use spnego = yes
    domain master = no
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes

Do I need to bind to a user on the linux box somehow?

2
  • BTW, you marked this as accepted. Did my answer help? I am slightly curious if you were able to figure out specifically which file the winbind mappings were in.
    – Zoredache
    Oct 18, 2012 at 17:57
  • I was not. I must have not been restarting winbind or something. I figured I'd try restarting one more time, and it worked.
    – nwalke
    Oct 18, 2012 at 18:00

2 Answers 2

3

It sounds like you have a UID overlap.
If nwalke and nick share the same numeric UID the first nsswitch match will win for things like id, sudo, ls, etc. (and the first match is usually out of the passwd file unless you've changed the order in /etc/nsswitch.conf or equivalent).

(logins will work with either name, because login looks up the user by name. Having two users with the same name will cause some interesting chaos though...)

Your local (/etc/passwd, /etc/group) and remote (NIS, Samba, LDAP, whatever) UIDs/GIDs should not overlap. Fix that core problem and the rest will resolve itself.

3
  • I have changed the value in my smb.conf to 10,000 and it still feels like nwalke is getting paired with 1000. How do I resolve that? Would that be on the NIS side of things or is Linux storing what UID it gave nwalke before?
    – nwalke
    Oct 17, 2012 at 16:10
  • Linux may be caching the UID (nscd or similar evil is a likely culprit, I think Samba/winbindd also does caching too so you may want to restart that service). A quick check could be done by creating another account with a different username/UID and making sure that works.
    – voretaq7
    Oct 17, 2012 at 16:12
  • I'll have to try that. I've rebooted the box after I changed the Samba config for other reasons. And I haven't installed nscd on here. Weird.
    – nwalke
    Oct 17, 2012 at 16:14
3

I have changed the value in my smb.conf to 10,000 and it still feels like nwalke is getting paired with 1000. How do I resolve that?

I can't recall which file it is, and I don't currently have a system to check.

When a user first connects an ID will be assigned, and then it will be stored in one of the Samba databases in /var/lib/samba/ Take a look in that folder, it might be obvious which file it is. You could possibly try stopping Samba, and just moving/deleting all the files there, though you would need to re-join the domain since the machine-account credentials are also stored in one of those databases.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .