Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem that occasionally apprears-dissapears and it drives me nuts.

My Debian servers are authenticated against AD and only "linuxadmins" group member can SSH to server and "sudo su".

SSH login works, no problems in there but users are getting errors "user xyz is not in sudoers " while using sudo

my /etc/sudoers contains AD group name

%linuxadmins ALL =(ALL) ALL

And samba conf

#GLOBAL PARAMETERS
[global]
   workgroup = RKAS
   realm = RKAS.RK
   preferred master = no
   server string = SEP DEV Server
   security = ADS
   encrypt passwords = true
   log level = 3
   log file = /var/log/samba/%m
   max log size = 50
   printcap name = cups
   printing = cups
   winbind enum users = Yes
   winbind enum groups = Yes
   winbind use default domain = Yes
   winbind nested groups = Yes
   #winbind separator = +
   #idmap uid = 600-20000
   #idmap gid = 600-20000
   ;template primary group = "Domain Users"
   template shell = /bin/bash
   template homedir = /home/%D/%U
   winbind offline logon = yes
   winbind refresh tickets = yes

The problem lies in group's separator that samba handles.

getent group | grep linuxadmins

gives back two different results in between few minutes

linuxadmins:x:784:xyz

or

\linuxadmins:x:784:xyz

Users are only able to sudo if there's no baskslash.

What's wrong? I cannot understand why it constantly adding backslash and removing it in the group names?

common-account:

account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 new_authtok_reqd=done default=ignore]        pam_winbind.so
account required                        pam_permit.so

common-auth:

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login require_membership_of=linuxadmins try_first_pass
auth    required                        pam_permit.so

and no common-system, only session

session     required    pam_mkhomedir.so umask=0022 skel=/etc/skel

I must add that this behavior is happening through all linux servers

share|improve this question
    
Have all the users got uidNumber attributes, similarly gidNumber attributes for the groups? –  Tom O'Connor Jul 4 '13 at 8:43
    
I disabled the UID and GID from smb.conf since these are depicated But it seems that yes, users have their uid's without the smb.conf (using Debian 6 and 7) –  user1492810 Jul 4 '13 at 9:10
    
Derp, session was what i meant. ;) –  Tom O'Connor Jul 4 '13 at 10:39

1 Answer 1

Right, so actually idmap uid range is deprecated, but it got replaced with this:

idmap backend = ad
idmap config *:backend = ad
idmap config *:range = 10000-20000

See, what I think is happening.. Is that samba (and associated modules) doesn't know how to assign the right id/uid to a user.

I'd drop those 3 lines into /etc/samba/smb.conf, Wipe out the samba cache files (they all get recreated) rm -rf /var/lib/samba/* Restart all the samba services, winbindd,smbd,nmbd and then have a go with wbinfo -u, wbinfo -g, wbinfo -i $id

You'll also want to make sure that all the users and groups have uidNumbers and gidNumbers (Active Directory Administrative Center, right click a user, open properties, find the Attribute Editor, set uidnumber and gidnumber if they're not already set).

You also need to have a gidNumber for groups up the tree, including Domain Users.

share|improve this answer
    
That didn't end well. Now wbinfo works but getent doesn't see AD users and groups. So I can log in as local service account I created for root replacement. –  user1492810 Jul 4 '13 at 10:14
    
Interesting. Can you post /etc/pam.d/common-account, common-auth, and common-system ? –  Tom O'Connor Jul 4 '13 at 10:16
    
i'll edit my original post –  user1492810 Jul 4 '13 at 10:20
    
can you su - $user from root to be one of the AD users? or do a native login on PTY2 or something? –  Tom O'Connor Jul 4 '13 at 10:40
    
I'm in with local sudo user. I discovered that the problem is related with net cache. I'm still unsure how. –  user1492810 Jul 4 '13 at 10:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.