Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to SLES and Samba so I need some help. I set up Samba on SUSE 11 successfully. I was able to create a share with no user restrictions which I managed to access from Windows. But I want to allow only a specific group of users to access the share. So I am using "valid users", "read list" and "write list". But once I add valid users to my config file, I am no longer able to access the share. Even though I entered the correct credentials, I am getting access denied error. I tried with root, with local user account, with AD domain user. None of this works. Can you give me a suggestion on how I can solve this. Here is my smb.conf file:

# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
# Date: 2012-02-03
[global]
    workgroup = *******
    passdb backend = tdbsam
    printing = cups
    printcap name = cups
    printcap cache time = 750
    cups options = raw
    map to guest = Bad User
    include = /etc/samba/dhcp.conf
    logon path = \\%L\profiles\.msprofile
    logon home = \\%L\%U\.9xprofile
    logon drive = P:
    usershare allow guests = No
    idmap gid = 10000-20000
    idmap uid = 10000-20000
    realm = ********
    security = ADS
    template homedir = /home/%D/%U
    template shell = /bin/bash
    usershare max shares = 100
    winbind refresh tickets = yes
    wins support = No
[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes
[profiles]
    comment = Network Profiles Service
    path = %H
    read only = No
    store dos attributes = Yes
    create mask = 0600
    directory mask = 0700
[users]
    comment = All users
    path = /home
    read only = No
    inherit acls = Yes
    veto files = /aquota.user/groups/shares/
[groups]
    comment = All groups
    path = /home/groups
    read only = No
    inherit acls = Yes
[printers]
    comment = All Printers
    path = /var/tmp
    printable = Yes
    create mask = 0600
    browseable = No

[Share]
    inherit acls = Yes
    path = /share/Share
    read only = No
    browseable = Yes
    valid users = @****+Group1, *****+user1

Here is the output of the logfile, when I amn trying to access the share:

[2013/05/17 15:39:18.753943,  3] lib/access.c:338(allow_access)
  Allowed connection from IP Address(IP Address)
[2013/05/17 15:39:18.754178,  3] smbd/oplock.c:922(init_oplocks)
  init_oplocks: initializing messages.
[2013/05/17 15:39:18.754281,  3] smbd/oplock_linux.c:226(linux_init_kernel_oplocks)
  Linux kernel oplocks enabled
[2013/05/17 15:39:18.754396,  3] smbd/process.c:1662(process_smb)
  Transaction 0 of length 137 (0 toread)
[2013/05/17 15:39:18.754447,  3] smbd/process.c:1467(switch_message)
  switch message SMBnegprot (pid 11575) conn 0x0
[2013/05/17 15:39:18.754827,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [PC NETWORK PROGRAM 1.0]
[2013/05/17 15:39:18.754882,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LANMAN1.0]
[2013/05/17 15:39:18.754922,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [Windows for Workgroups 3.1a]
[2013/05/17 15:39:18.754959,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LM1.2X002]
[2013/05/17 15:39:18.754996,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [LANMAN2.1]
[2013/05/17 15:39:18.755035,  3] smbd/negprot.c:598(reply_negprot)
  Requested protocol [NT LM 0.12]
[2013/05/17 15:39:18.755163,  3] smbd/negprot.c:419(reply_nt1)
  using SPNEGO
[2013/05/17 15:39:18.755204,  3] smbd/negprot.c:704(reply_negprot)
  Selected protocol NT LM 0.12
[2013/05/17 15:39:18.757824,  3] smbd/process.c:1662(process_smb)
  Transaction 1 of length 142 (0 toread)
[2013/05/17 15:39:18.757917,  3] smbd/process.c:1467(switch_message)
  switch message SMBsesssetupX (pid 11575) conn 0x0
[2013/05/17 15:39:18.757970,  3] smbd/sesssetup.c:1333(reply_sesssetup_and_X)
  wct=12 flg2=0xc807
[2013/05/17 15:39:18.758013,  2] smbd/sesssetup.c:1279(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2013/05/17 15:39:18.758051,  3] smbd/sesssetup.c:1065(reply_sesssetup_and_X_spnego)
  Doing spnego session setup
[2013/05/17 15:39:18.758091,  3] smbd/sesssetup.c:1107(reply_sesssetup_and_X_spnego)
  NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
[2013/05/17 15:39:18.758159,  3] smbd/sesssetup.c:660(reply_spnego_negotiate)
  reply_spnego_negotiate: Got secblob of size 40
[2013/05/17 15:39:18.758344,  3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  Got NTLMSSP neg_flags=0xe2088297
[2013/05/17 15:39:18.762052,  3] smbd/process.c:1662(process_smb)
  Transaction 2 of length 486 (0 toread)
[2013/05/17 15:39:18.762108,  3] smbd/process.c:1467(switch_message)
  switch message SMBsesssetupX (pid 11575) conn 0x0
[2013/05/17 15:39:18.762152,  3] smbd/sesssetup.c:1333(reply_sesssetup_and_X)
  wct=12 flg2=0xc807
[2013/05/17 15:39:18.762190,  2] smbd/sesssetup.c:1279(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2013/05/17 15:39:18.762225,  3] smbd/sesssetup.c:1065(reply_sesssetup_and_X_spnego)
  Doing spnego session setup
[2013/05/17 15:39:18.762262,  3] smbd/sesssetup.c:1107(reply_sesssetup_and_X_spnego)
  NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
[2013/05/17 15:39:18.762313,  3] ../libcli/auth/ntlmssp_server.c:348(ntlmssp_server_preauth)
  Got user=[user1] domain=[DOMAINNAME] workstation=[WORKSTATIONNAME] len1=24 len2=246
share|improve this question
    
I forgot to write that I replaced the domain name with ****** –  stancheva May 17 '13 at 8:10

1 Answer 1

up vote 0 down vote accepted

Sorry for no writing this as a comment, but my rep is not high enough for that.

What I see is that you use + as a separator for Domain and Group, but you didn't set the + as the winbind separator in your config.

winbind separator = +

Also you're setting the passdb backend to tdbsam which is a local database. This is probably the reason why your AD authentication fails.

Try setting the following:

workgroup = [SHORTDOMAINNAME]
realm = [KERBEROS REALM / LONG DOMAIN NAME]
password server = [fqdn of your pdc]
winbind use default domain = yes
encrypt passwords = yes
security = ads

the realm and workgroup should be all in caps and match your 'krb5.conf' file

krb5.conf:

[libdefaults]
    default_realm = [KERBEROS REALM / LONG DOMAIN NAME]
    dns_lookup_realm = true
    dns_lookup_kdc = true
    default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    clockskew = 300
    forwardable = true
    proxiable = true

[realms]
    [KERBEROS REALM / LONG DOMAIN NAME] = {
            kdc = [fqdn of your pdc]
            default_domain = [long domain name lowercase]
    }
[domain_realm]
    .[long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]
    [long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]

You can also check if everything works with

wbinfo -u 

and you should see the list of users

wbinfo -g 

to see the list of groups.

If you have groups with spaces in the name, don't forget to put them in " in valid users

Hope it helps

share|improve this answer
    
everything in caps like [KERBEROS REALM] should also be in caps in the config –  Meiko Watu May 17 '13 at 9:26
    
Hello Meiko, Thanks a lot for the quick response. I did everything you said, but unfortunately I am still not able to access the share. It keeps saying access denied :( Do you have a clue what else might be wrong? –  stancheva May 17 '13 at 10:52
    
I have added the log output to my posts. It might help. –  stancheva May 17 '13 at 10:56
    
getent passwd lists only local accounts, but it should list AD accounts as well. Also in the /lib directory I have libnss_winbind.so.2 and libnss_wins.so.2 , but libnss_winbind.so and libnss_wins.so are missing, so I am thinking maybe my winbind configuration is not correct. But I am not sure how can I fix it. Can anybody give me a clue???? –  stancheva May 17 '13 at 12:21
    
Hey! do you use samba 3.6 or samba 4? I remember from my last samba setup that it was necessary to link the winbind and libnss so's manually. maybe give it a try: ln -s /lib/libnss_winbind.so.2 /lib/libnss_winbind.so and ln -s libnss_wins.so.2 libnss_wins.so Found a source for it just for the Samba4 installation now wiki.samba.org/index.php/Samba4/Winbind –  Meiko Watu May 17 '13 at 13:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.