Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


hello,
i have a problem with krb5 and samba.
when samba is running(i can browse shares with domain account) i can not login with ssh.
And when samba is NOT running i can login with ssh with domain account without any problem.

i would like to login with ssh and browse samba shares at the same time.

if anyone knows how to do it, i'll be very grateful


my configuration:

gentoo
samba 3.6.19
krb5
machine is connected to active directory.

krb5.conf

[logging]                                                                                                                                                                                                  
 default = FILE:/var/log/krb5libs.log                                                                                                                                                                      
 kdc = FILE:/var/log/krb5kdc.log                                                                                                                                                                           
 admin_server = FILE:/var/log/kadmind.log                                                                                                                                                                  

[libdefaults]                                                                                                                                                                                              
 default_realm = xxxxxxxx                                                                                                                                                                             
 dns_lookup_realm = false                                                                                                                                                                                  
 dns_lookup_kdc = false                                                                                                                                                                                   
 kdc_timesync = 1                                                                                                                                                                                     
 ccache_type = 2
 ticket_lifetime = 24h
 forwardable = yes
 proxiable = true
 fcc-mit-ticketflags = true

[realms]
xxxxxx = {
kdc = xxxxx
kdc = xxxxx
 admin_server = xxxx
 default_domain = xxxxxx
}

[domain_realm]
.xxxxxx = xxxxxx
xxxxxxx = xxxxxxx

[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}



smb.conf

[global]

workgroup = xxxxx
security = ADS
realm = xxxx
kerberos method = secrets and keytab
winbind refresh tickets = yes
winbind normalize names = yes
winbind offline logon = false
winbind use default domain = Yes
winbind enum users = yes
winbind enum groups = yes

idmap config * : backend = tdb
   idmap config * : range = 1000000-1999999
   idmap config xxx: backend  = rid
 idmap config xxx: range = 1000-999999
 idmap config xxx: base_rid    = 0
encrypt passwords = yes
map to guest = never
printcap name = /dev/null
load printers = no
printing = bsd
log file = /var/log/samba/log.%m
max log size = 50
dns proxy = yes

server string = xxx
hosts allow = xxxx
hosts deny = 0.0.0.0/0
interfaces = enp11s0 lo
invalid users = root bin daemon nobody named sys tty disk mem kmem @wheel

[IPC$]
hosts allow = xxxxxx
hosts deny = 0.0.0.0/0
veto files = /autorun.inf/desktop.dll

directory security mask = 0700
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.