Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have joined my first Debian box to an Active Directory (2008 R2). It works, I can log in with AD credentials, browse Samba shares.

There is just a problem with the time it takes for someone to log in via ssh (the only way to log into the headless servers). It takes about 30 to 45 seconds to get a prompts, the subsequent logins are immediate for a few minutes, then again it takes a long time to log in (and so on).

  • Same thing with a sudo.
  • However (authenticated) browsing the shares is fast, no delays.

The AD structure is quite large, it takes about 3 minutes to get a wbinfo -u, which is 365k entries.

I have noted in the logs a succession of these pairs of entries:

winbindd[3701]:   kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
winbindd[3701]: [2014/03/31 11:00:38.393016,  0] ../source3/libads/sasl.c:994(ads_sasl_spnego_bind)

klist shows a proper list, though, and /etc/krb.conf is exactly as listed in the Samba Wiki.

The `/etc/samba/smb.conf` is quite standard:
[global]
realm = DOMAIN.EXAMPLE.COM
workgroup = DOMAIN
netbios name = MYDEBIAN
security = ADS
encrypt passwords = yes
wins server =  adserver.example.com
winbind use default domain = yes
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = no
winbind enum groups = no
winbind nested groups = false
template homedir = /home/%D/%U
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
winbind use default domain = yes
preferred master = no
valid users = @it.security
admin users = @it.security
printing = bsd
printcap name = /dev/null

The entries related to login in /etc/nsswitch.conf:

passwd:         files winbind
group:          files winbind
shadow:         files
  • Is it likely to be a cache misconfiguration?

  • Should the login be fast with no caching (in other words - is the login configuration itself incorrect and some caching mechanism just helps in my case but hides the real problem?)

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.