Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


hello,
i have a problem with krb5 and samba.
when samba is running(i can browse shares with domain account) i can not login with ssh.
And when samba is NOT running i can login with ssh with domain account without any problem.

i would like to login with ssh and browse samba shares at the same time.

if anyone knows how to do it, i'll be very grateful


my configuration:

gentoo
samba 3.6.19
krb5
machine is connected to active directory.

krb5.conf

[logging]                                                                                                                                                                                                  
 default = FILE:/var/log/krb5libs.log                                                                                                                                                                      
 kdc = FILE:/var/log/krb5kdc.log                                                                                                                                                                           
 admin_server = FILE:/var/log/kadmind.log                                                                                                                                                                  

[libdefaults]                                                                                                                                                                                              
 default_realm = xxxxxxxx                                                                                                                                                                             
 dns_lookup_realm = false                                                                                                                                                                                  
 dns_lookup_kdc = false                                                                                                                                                                                   
 kdc_timesync = 1                                                                                                                                                                                     
 ccache_type = 2
 ticket_lifetime = 24h
 forwardable = yes
 proxiable = true
 fcc-mit-ticketflags = true

[realms]
xxxxxx = {
kdc = xxxxx
kdc = xxxxx
 admin_server = xxxx
 default_domain = xxxxxx
}

[domain_realm]
.xxxxxx = xxxxxx
xxxxxxx = xxxxxxx

[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}



smb.conf

[global]

workgroup = xxxxx
security = ADS
realm = xxxx
kerberos method = secrets and keytab
winbind refresh tickets = yes
winbind normalize names = yes
winbind offline logon = false
winbind use default domain = Yes
winbind enum users = yes
winbind enum groups = yes

idmap config * : backend = tdb
   idmap config * : range = 1000000-1999999
   idmap config xxx: backend  = rid
 idmap config xxx: range = 1000-999999
 idmap config xxx: base_rid    = 0
encrypt passwords = yes
map to guest = never
printcap name = /dev/null
load printers = no
printing = bsd
log file = /var/log/samba/log.%m
max log size = 50
dns proxy = yes

server string = xxx
hosts allow = xxxx
hosts deny = 0.0.0.0/0
interfaces = enp11s0 lo
invalid users = root bin daemon nobody named sys tty disk mem kmem @wheel

[IPC$]
hosts allow = xxxxxx
hosts deny = 0.0.0.0/0
veto files = /autorun.inf/desktop.dll

directory security mask = 0700
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.