Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having two issues with AD auth on Ubuntu.

Firstly, if I set the passed to be changed at next login, or run passwd, it ask for the current NT pass and twice, then asks for the new one four times, essentially doing it twice simultaneously. Second, I cannot access Samba shares on the Ubuntu machine from Windows. It asks for user pass, and Domain accts and local accts can't login. The machine is on the domain, the domain users are read from the DC and can ssh. Basically, beyond these two important issues, works great. Here are the pertinent files:


security = ads
realm = DOMAIN.NET
password server = dc01.domain.net
workgroup = DOMAIN
#idmap uid = 1000-99999
#idmap gid = 1000-99999
idmap config *:backend = tdb
idmap config *:range = 70001-80000
idmap config DOMAIN:backend = ad
idmap config DOMAIN:range = 500-40000
winbind nss info = rfc2307
winbind separator = +
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template homedir = /home/%U
template shell = /bin/bash
client use spnego = yes
domain master = no
comment = Ubuntu File Server Share
path = /data
browsable = yes
guest ok = yes
read only = no
create mask = 0755


    default = FILE:/var/log/krb5.log
    allow_weak_crypto = true
    ticket_lifetime = 24000
    default_realm = DOMAIN.NET
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
    DOMAIN.NET = {
        kdc = DC01.DOMAIN.NET
        admin_server = DC01.DOMAIN.NET
        default_domain = DOMAIN
    .domain.net = DOMAIN.NET
    domain.net = DOMAIN.NET


# pre_auth-client-config # passwd:         compat
passwd: compat winbind
# pre_auth-client-config # group:          compat
group: compat winbind
# pre_auth-client-config # shadow:         compat
shadow: compat winbind

hosts:          files dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

# pre_auth-client-config # netgroup:       nis
netgroup: nis

auth    sufficient      pam_winbind.so
auth    required        pam_unix.so nullok_secure use_first_pass

password    [success=1 default=ignore]  pam_winbind.so try_first_pass
password    requisite           pam_deny.so
password    sufficient  pam_winbind.so
password   required   pam_unix.so nullok obscure min=4 max=50 md5
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.