Questions tagged [winbind]
Winbind is part of the Samba suite and provides an NSS and PAM layer for Unix/Linux systems to integrate authentication with a Windows domain
135
questions
0
votes
1
answer
8k
views
Convert Samba Active Directory to sssd instead of winbind
I've inherited a Samba 4 Active Directory (AD) server. It works fine with winbind, however for security reasons we'd like to change to sssd. The domain has two domain controllers (primary and ...
3
votes
2
answers
7k
views
I have to manually restart winbind.service after every reboot. Ubuntu 18.04
S.O. Ubuntu 18.04.4, Samba version 4.7.6-Ubuntu
I have this problem with this machine. Whenever the system restarts, winbind.service fail to start properly, and error "clock skew too great" is ...
1
vote
1
answer
4k
views
winbind separator and group name behavior in getent group, constantly changing
I have a problem that occasionally apprears-dissapears and it drives me nuts.
My Debian servers are authenticated against AD and only "linuxadmins" group member can SSH to server and "sudo su".
SSH ...
0
votes
0
answers
2k
views
Unable to log in as root or domain user
Solved - See Update 2 below.
We have a Debian Jessie DNS / SSH server.
I have joined it to our AD domain by following this guide and created a cron job to sync the time with a domain controller ...
0
votes
0
answers
18
views
Debian: Set persistent winbind group for tape device
A ProLiant server with Ultrium 6-SCSI tape driven by smartpqi, running Debian 10.13. Server is member of a Windows domain using winbind and nsswitch.conf:
group: files winbind. Group membership of /...
0
votes
1
answer
122
views
Winbind and AD: Local users with identical AD usernames
we successfully got Samba up and running with Winbind on our openLeap 15.4.
The Linux server is a member of the Windows domain.
Due to a user with identical name in AD as well as locally on the Linux ...
0
votes
1
answer
582
views
Failed to join a computer to samba domain (Zentyal) - Couldn't join realm: Insufficient permissions to join the domain
I'm relatively new Zentyal user (few months), and I love it! But I've ran into a problem I hope someone can help me with.
In my deployment I have two Zentyal servers (zentyal-1.mydomain.com and ...
0
votes
0
answers
757
views
UID of windows Active Directory user seems to have been overwritten on storage host passwd
I have an issue which has me scratching my head, and I dont know where I need to enable deeper logging to find the source of the issue.
We have a third party appliance, where we do have root ssh ...
0
votes
1
answer
575
views
Samba Winbind - Windows Server AD - Users are able to see each other's home directories
I'm running AlmaLinux and Samba Winbind joined into Windows Server 2019 AD. The domain users have home directories and a pccommon directory (shared folder).
When I create a new domain user in the ...
1
vote
2
answers
3k
views
Removing a "semi joined" Ubuntu workstation from an Active Directory domain
I am joining an Ubuntu workstation to an MS AD. I had 1 or 2 config issues when I first tried to run net ads join which resulted in an error message and the workstation not being added correctly I ...
1
vote
1
answer
2k
views
Moving from LDAP to LDAPS - Ubuntu 14.04 Winbind, Samba
I have an Ubuntu 14.04 AD DS member server which appears to be binding to AD no problem with the following command:
wbinfo -g
I want to move to using LDAPS now. I configured LDAPS on my 2012 R2 DC ...
3
votes
1
answer
2k
views
PAM Winbind Expired Password
We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted.
What's the ...
1
vote
1
answer
3k
views
Winbind not enumerating users and groups of trusted domain
I'm using Samba 4.1.6-Ubuntu in Ubuntu 14.04, for authenticating users from two domains with a one-way cross-forest trust between them. Samba machine is joined to DOMAINA, while DOMAINB is the trusted ...
6
votes
1
answer
2k
views
Inconsistent winbind info on Samba 4 AD domain controller
I've setup a Samba 4 AD domain controller on Debian Jessie (samba 4.2.10). Everything's working fine, except that winbind gives wrong user/group information.
I have a sample user "testuser" and a ...
5
votes
2
answers
11k
views
Groupmapping does not work for AD groups
We have an ActiveDirectory where we get our users from.
So authentication on the linux machine works over pam.
We managed this part to work so far, but we need all users to be part of the local group ...
2
votes
1
answer
5k
views
Set up Samba with Active Directory and local user authentication
My main goal is to set up a Samba-Server, to where users can connect to by using their Active-Directory credentials. Additionally, local linux users on the Samba-Server should be able to authenticate.
...
0
votes
1
answer
2k
views
Active Directory Group Membership not reflecting correctly in linux
Background:
On an isolated network. Multiple RHEL6 Linux systems connected to a Windows 2012R2 DC. Systems joined to domain and authenticating with DC. Using IDMAP_RID. No known changes to ...
2
votes
1
answer
780
views
Samba Shares Without Using Winbind
I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
1
vote
0
answers
3k
views
Samba/Winbind domain member authentication issue
In setting up a new Linux Samba fileserver as a AD member I keep running into an issue with authentication.
It appears to be triggered by running with selinux in Enforcing mode after joining AD, but ...
1
vote
1
answer
1k
views
Ubuntu 18.04/20.04 SSSD Configuration Issues
I would like to first mention that I have more experience with the CentOS/RHEL world than I do with configuration of Ubuntu. Most of the Ubuntu systems that I have had to build use default ...
0
votes
0
answers
2k
views
Pam_unix sshd authentication failure even though the login works?
I have a server that is configured with winbind and samba to provide active directory authentication. The active directory integration works fine however whenever I authenticate I see the following ...
1
vote
1
answer
1k
views
Samba extended ACLs restricting user even though they are in an authorized AD group for the share?
Have Samba extended ACLs (https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Samba_Extended_ACL_Support) via SMB+WinBind set for a CentOS 7 file server to mount shares on a Windows ...
1
vote
1
answer
268
views
Restarting winbind service on rhel6, service restarts but ansible fails the run
Seeing this consistently with the playbook below.
- hosts: all
gather_facts: no
become: yes
tasks:
- name: restart winbind
service:
name: winbind
state: restarted
- name: ...
1
vote
0
answers
203
views
winbind works but Squid acts wrong
I am trying to get a Squid Proxy running with Kerberos+Samba+Winbind, which is connected to my AD.
Everything works great so far!
krb auth working
wbinfo -u, -a, -g working
I made some new testing-...
1
vote
0
answers
106
views
AD group membership isn't always reflected
I have a problem regarding AD group membership not being always reflected on a Linux machine.
I have joined several CentOS 7.8 machines in my AD, based on Samba and Winbind. After the join, those ...
0
votes
3
answers
3k
views
pam auth via winbind, howto map primary group for users?
I have unix users authenticating to an PDC (via winbind) and want to have the primary group of those users a local unix group (e.g. www-data).
users have the group "domain users" with gid 10006 (as ...
1
vote
0
answers
1k
views
Random SSH connection timeout on first try to CentOS servers
Have got a curious issue with SSH on CentOS 6 and haven't found a solution yet.
We have our CentOS 6 servers all joined to an Active Directory 2012 R2 domain using Winbind. It is not used for ...
2
votes
7
answers
33k
views
Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation
I'm attempting to join a Ubuntu 12.04 server to Active Directory. I installed samba, and kb5-user, created a machine account in AD, and did:
> net ads testjoin
Join is OK
So far so good. Then I ...
2
votes
1
answer
1k
views
Why does realmd list multiples of the same realm?
I'm setting up an Ubuntu server so that users can authenticate against a Windows AD server. Not knowing about realmd, I used Samba Winbind's net join command to join the machine to the domain. ...
3
votes
0
answers
2k
views
SSSD procedure for staying joined when renaming AD computer object
Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
2
votes
1
answer
876
views
pam_winbind: unknown option require_membership_of
I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group.
I'm using a generic conf file for the vsftpd, with ...
2
votes
2
answers
19k
views
winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint.
Apr 3 14:44:14 ...
1
vote
1
answer
790
views
Should domain_realm point to a domain controller or KDC, or is it just the default_realm name?
In /etc/krb5.conf, given the folowing default_realm, should [realms].default_domain point at the default_realm or a Domain Controller (DC) or Key Distribution Denter (KDC)?
ada and adb are Windows ...
1
vote
4
answers
37k
views
Samba 4: domain joined, but all users are mapped to nobody, and shares are inaccessible from Windows clients
I've got a Debian/Jessie Samba 4.2.14 running as an AD member. ADC is a Windows2008R2 server. Join worked without problem.
# net ads testjoin
Join is OK
wbinfo -u and wbinfo -g work perfectly and ...
1
vote
2
answers
7k
views
Configure Winbind to get User Info from Windows
I need to configure SAMBA and Winbind on Ubuntu 10.04.1 clients to get their UID, GID, and home directory from Windows Active Directory.
I have Windows Services for Unix installed with the relevant ...
1
vote
0
answers
2k
views
Samba: authenticate against Active Directory using winbind but authorize against separate OpenLDAP server
Short Version
How can I configure a CentOS 7 machine with Samba 4.8.0 serving users on Windows 7 clients to authenticate using their domain login credentials (winbindd and Active Directory) but be ...
1
vote
1
answer
661
views
FreeRADIUS can not login with Active Directory user
I install freeradius 3 in debian 9. I can login with user from text file in radius but I want to login with user from Active Directory.
First, I install this library.
apt install samba winbind krb5-...
0
votes
1
answer
987
views
Winbind rfc2307 shell not honored after Samba 4 upgrade
I have CentOS 7 servers with samba-winbind talking to an AD. We use rfc2307 to override the default shell for certain (power) users. One such server is still running an older version of samba-winbind, ...
1
vote
0
answers
50
views
Make winbind rfc2307 optional
Back in the samba-winbind 4.4 days, you could set a default template shell and template directory for AD users, but override these defaults by using rfc2307. This was useful because we could allow ...
2
votes
2
answers
960
views
winbind authentication through apache slow
I have a linux machine setup to authenticate users using Active Directory with samba/winbind.
Apache is then setup to use that to authenticate the users. This is done using:
<IfModule ...
8
votes
6
answers
63k
views
Samba Winbind User Resolution
We have successfully deployed AD authentication using Samba and Winbind (idmap_ad) across six Centos 6 servers and have been running happily for a few months now.
One of the servers has stopped ...
1
vote
1
answer
784
views
Samba File Server shows already deleted users as directory owner / winbind name resolution
I have on a Samba File Server (openSUSE Leap 15), a directory with subdirectorys in which some should have no more owner. User Name Resolution is going by winbind. I want to delete every dir with no ...
0
votes
0
answers
839
views
Samba for Debian Stretch keeps asking for password
so I've got the dreaded 'samba keeps asking for password' issue in Debian Stretch.
My environment:
2x AD DCs running WS2012R2
A few physical computers and several VMs running on ESXi 6.7
All ...
1
vote
0
answers
1k
views
Samba4 in AD Domain: getent shows only local accounts
I had my samba domain member working a few days ago, but now it stopped serving domain users. Some of the steps I already tried: clear caches, rejoin domain, reboot, pam-auth-update, with and without "...
8
votes
4
answers
14k
views
Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD
I have quite a few Ubuntu Server 17.04 hosts that must be joined to an existing Windows AD domain (Windows Server 2016). I've never done it before, but I'm aware about several ways to achieve this, ...
3
votes
2
answers
3k
views
Winbind/AD: Local users with identical AD usernames
We are getting ready to add Winbind/Samba to some CentOS servers. Identity Management for UNIX is running on our DC, and it's testing well so far. There is one scenario I'm having trouble with, and I'...
1
vote
1
answer
1k
views
Apache NTLM not authenicating domain username/password.
I have a centos box and I am trying to setup NTLM authenication for apache. I have the linux box on the AD domain already and able to get user and group info using the wbinfo command.
I have the ...
1
vote
1
answer
7k
views
FreeRADIUS mschap
Following this guide, I am trying to set up FreeRADIUS to authenticate against Active Directory. I can get an Access-Accept message when I send the password in plaintext (using the DEFAULT Auth-...
16
votes
6
answers
56k
views
Linux + Active directory authentication + only letting certain groups login
I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind).
What I would like to do now though is only allow certain people or certain groups to ...
4
votes
1
answer
2k
views
vsftpd with pam_winbind.so
I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to /media/storage/...