Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not work is using the AD users on the centos box. I have activated the "Identity Management for UNIX" on the AD, so that users have a UID, GID, homdir and shell. Unfortunatly there are still only the local users on centos.

id mytestuser gives me "No such user". Further:

    myhost someone:~ $ wbinfo -i mytestuser
    failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
    Could not get info for user mytestuser

    myhost someone:~ $ wbinfo -a mytestuser
    Enter mytestuser's password:
    plaintext password authentication succeeded
    Enter mytestuser's password:
    challenge/response password authentication failed
    Could not authenticate user mytestuser with challenge/response

There seems to be a bug which seems to resemble my problem, but as far as I can tell, I have allready incorporated the syntax change in my samba configuration.

Here is my config:


     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log

     default_realm = ACME.ORG
     dns_lookup_realm = false
     dns_lookup_kdc = false
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = true
     default_keytab_name = FILE:/etc/krb5.keytab

     ACME.ORG= {
      kdc =
      admin_server =
      default_domain =

    [domain_realm] = ACME.ORG = ACME.ORG

     pam = {
       debug = false
       ticket_lifetime = 36000
       renew_lifetime = 36000
       forwardable = true
       krb4_convert = false

klist lists a valid ticket granting ticket.

my /etc/samba/smb.cnf

            workgroup = ACME
            server string = my super suerver
            log level = 3
            log file = /var/log/samba/log.%m
            max log size = 50
            security = ADS
            encrypt passwords = yes
            passdb backend = tdbsam
            realm = ACME.ORG
            preferred master = no
            load printers = yes
            cups options = raw
            printcap name = cups
            printing = cups
            winbind enum users = Yes
            winbind enum groups = Yes
            winbind use default domain = Yes
            winbind nested groups = Yes
            winbind separator = +
            template shell = /bin/bash
            winbind nss info = rfc2307
            kerberos method = system keytab
            dedicated keytab file = /etc/krb5.keytab
            idmap config ACME:backend = rid
            idmap config ACME:base_rid = 10036
            idmap config ACME:range = 10036-1000000
            comment = Home Directories
            browseable = no
            writable = yes
            valid users = %S
            valid users = ACME\%S

Part of my /etc/nsswitch.conf

passwd:     files winbind
shadow:     files winbind
group:      files winbind

And my /etc/pam.d/system-auth

    auth        required
    auth        sufficient nullok try_first_pass
    auth        requisite uid >= 500 quiet
    auth        required
    auth        sufficient use_first_pass
    auth        required

    account     required
    account     sufficient uid < 500 quiet
    account     sufficient use_first_pass
    account     required

    password    requisite try_first_pass retry=3
    password    sufficient md5 shadow nullok try_first_pass use_authtok
    password    sufficient use_first_pass
    password    required
    password    required

    session     optional revoke
    session     required
    session     [success=1 default=ignore] service in crond quiet use_uid
    session     required
    session     required
    session     required
    session     required use_first_pass

To me it looks a bit like this bug. How can I veryfy its this one? Any hints?

share|improve this question
what does sudo getent passwd shows? Does it include any of the AD accounts? – Danila Ladner Jun 13 '13 at 15:40
no, just local accounts. I have read somewhere, that gentent won't show the winbind accounts, but anyway, it is clear that the system has no knowledge of the AD accounts. So somehow there link between winbind and the local usere management is missing. – Isaac Jun 14 '13 at 8:47
no, getent should show LDAP accounts as well. – Danila Ladner Jun 14 '13 at 15:45
Well, anyway, it does not. So I would really like to know why. Any hints for how to debug this would be wellcome. – Isaac Jun 14 '13 at 15:47
What is the output of wbinfo -i <username> – rchhe Jun 18 '13 at 14:17

1 Answer 1

up vote 0 down vote accepted

I finally got it working, thanks to sssd. It does not use winbind (which is probably why it works :)). The whole setup is described very well in this blog post.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.