Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I already realize that configure Redhat 5.5 as PDC (Primary Domain Controller), and the clients (Windows XP and Windows 2003) can join the realm. The realm name of Linux server is EXAMPLE.COM.

Currently, when the time client (e.g., Windows 2003) join EXAMPLE.COM, from the packet captured by the Wireshark, we learn that there is only NTLM packet in the dcerpc protocol, there is no kerberos packet. The conclusion is that the client is not executing kerberos authentication. My samba configuration file smb.conf is as follow:


  workgroup = SINF                    #my domain name
  server string = Samba PDC Server        
  netbios name = SAMBA149            #my host name 
  local master = yes  
  preferred master = yes
  domain master = yes
  local master = yes
  wins support = yes
  os level = 100
  domain logons = yes
  logon drive = K:
  logon script = startup.bat
  time server = yes
  admin users = root
  logon path = \\%N\%U\profile
  logon home = \\%N\%U 
  log file = /var/log/samba/log.%m
  max log size = 50  
  security = user
  passdb backend = tdbsam
  comment = Network Logon Service
  path = /winhome/netlogon
  writable = no
  write list = root
  follow symlinks = yes
  guest ok = yes

  comment = Home Directiories
  browseable = no
  writable = yes
      create mode = 0664
  directory mode = 0775
  comment = smbuser's project
  path = /home/samba/project
  browseable = yes
  writeable = yes
  write list = @users

Next, I want execution of the kerberos authentication when the client join the PDC, how can I realize it? Any help would be appreciate sincerely! Thank you very much in advance!

share|improve this question
The concept of a PDC has been outdated since the release of windows server 2003. You are likely to find more information if you simply call it a domain controller. – Falcon Momot Nov 12 '13 at 4:32
Thank you very much for reminding me! As I checked from the internet, from the begining of Microsoft Windows 2000, there is no longer distinguish between the PDC and the BDC, all domain controllers are all in a equivalent position. One domain controller changes will be replicated to other domain controllers. We called it PDC Emulator. – laoyang360 Nov 12 '13 at 6:58
up vote 1 down vote accepted

Have a look at his:

To be honest, the reason why kerberos is not used is a bit complicated to say the least. Here's a quick checklist from the top of my head:

  1. Are the clients configured to use kerberos? They might fall back to NTLM when kerberos does not succeed.
  2. Do you have kerberos configured on the PDC? If not, samba is not able to use kerberos auth.
  3. Are the clocks in sync between PDC and the clients? Kerberos is a picky about time.
  4. Are you able to successfully get kerberos credentials by using kinit? If not, you haven't configured kerberos at all.
share|improve this answer
Thank you for your advice. Relay on your advie, I check my configure: – laoyang360 Nov 12 '13 at 13:29
I have reconfigured my samba and kerberos refer to the document from you. Now, The windows client(window2003) can execute the kerberos authentication when it joined the samba PDC. But, It occurs the “STATUS_ACCESS_DENIED”packet through captured packet by wireshare. I have not find where the problem ? @John Wilcox – laoyang360 Nov 12 '13 at 13:48
I have successfully configured, the client (windows2003) can join Samba domain of redhat5.5.Next, I want to do is how to get the keys and tickets from kerberos authentication in the samba source code. There are still many issues to address Thank you very much! @John Wilcox – laoyang360 Nov 13 '13 at 11:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.