Tag Info

Hot answers tagged

16

This goes for windows clients: In short, the client's Net Logon service (or more accurately, the Domain Controller Locator component of the service) queries the DNS servers SRV records, to find a domain controller within its own site (site information is stored in the domain-joined client's registry). It then contacts a Domain Controller determined by the ...


4

This should answer your question: Active directory with duplicate machine SIDs Duplicate SIDs don't matter (for non domain controllers.) edit: To clarify - each machine will be given a new RID as it is joined to the domain, regardless of what its local SID is. A RID will never be re-used, ever, regardless of the member server being a clone.


3

It sounds like you have a UID overlap. If nwalke and nick share the same numeric UID the first nsswitch match will win for things like id, sudo, ls, etc. (and the first match is usually out of the passwd file unless you've changed the order in /etc/nsswitch.conf or equivalent). (logins will work with either name, because login looks up the user by name. ...


3

I have changed the value in my smb.conf to 10,000 and it still feels like nwalke is getting paired with 1000. How do I resolve that? I can't recall which file it is, and I don't currently have a system to check. When a user first connects an ID will be assigned, and then it will be stored in one of the Samba databases in /var/lib/samba/ Take a look in ...


3

See this article for how site location is determined. http://technet.microsoft.com/en-us/library/cc978016.aspx. This article details the process. I'm not sure why Mathias would point you to the DNS article (DNS is involved but nothing is registered and the query is for the address of a dc). Additionally (and maybe this is a language issue) there is never ...


3

Are you using nsswitch.conf? If so, are the winbind entries in there correctly? The winbind separator is a bugaboo because of naming conventions. Yes, it can be made to work with a \ instead of +, but there are consequences. (Using \ brings you closer to the old-style NT4 logins, which is what you're after). Frankly, if you only have a single domain, I ...


3

I currently use the AllowGroups directive in /etc/ssh/sshd_config to limit who's able to log in. Specify a one or more AD groups on that line, and those people will be the only ones able to log in. Keep in mind that this only works if your users are only accessing the server remotely via ssh. If they're singing in locally, you'll need to find another ...


3

Assuming the groups are available to the Linux system, I recommend editing /etc/security/access.conf for Ubuntu, RedHat distributions (and their forks) and probably a bunch of others. This doesn't require editing PAM files, and is a nicely standard place to do it. There are usually examples in the file, commented out.


3

Solaris 10 ships with a working (if not up-to-date) version of samba however the libraries are not compatible with the sunfreeware product. The problem you are seeing is caused by the sunfreeware product not having an nss_winbind.so library in the package and /usr/lib/nss_winbind.so is not compatible. To fix you will have to create your own. Download the ...


3

It sounds like you're talking about using ADS Security Mode on your Samba server. These security modes permit Samba to offload authentication to the Active Directory (AD) domain. The configuration process is outlined in the Samba docs. Basically, you'll configure your Samba server with the name of the AD domain, configure the Kerberos /etc/krb5.conf file ...


2

You can use the idmap_rid idmap backend, which algorithmically generates ids so that there's no need to synchronize them (that is, two systems will always generate the same GID for a given group). You can also use the LDAP idmap backend to store generated ids in a central (shared) location. This is only necessary if you're not using the idmap_rid backend. ...


2

Did you install and configure Kerberos then join the domain etc? SECURITY = ADS In this mode, Samba will act as a domain member in an ADS realm. To operate in this mode, the machine running Samba will need to have Kerberos installed and configured and Samba will need to be joined to the ADS realm using the net utility.


2

You should be able to do this through the /etc/nsswitch.conf file. Make sure that wins is listed before your other name services hosts: wins file dns ...


2

ok, it's resolved by checking the user details: super simple, they just didn't had a correct shell assigned from winbind. SO therefore, it just went through motd and then logged out. smb.conf : template shell = /bin/bash thats it.


2

It's certainly possible if you add the Linux users to Active Directory. Samba doesn't do much for you here. The real "magic" is being done by LDAP and Kerberos. In an ideal setup, OpenLDAP enumerates the users from Active Directory, and Kerberos handles authentication. Samba is not necessary for the use case you're describing (unless you insist on having ...


2

Really, everything you have asked here and more can be answered by reading The Official Samba HOWTO and Reference Guide. It seems that most admins are not aware of its existence, but once they get ahold of it, most of the issues/mysteries/questions regarding Samba installs will simply be resolved. If there was a sage piece of advice I'd give to the Samba ...


2

After finding the configuration listed at this location: http://www.ccs.neu.edu/home/battista/articles/winbindenterprise/winbindenterprise.pdf, I was able to get it working properly (well, for the most part). The primary task I needed to accomplish was to get each user to obtain their own unique UID, which this implementation does. I'm not able to retrieve ...


2

On the off chance this helps somebody: the way to get Winbind to notice the Unix login shell and home directory information from Active Directory is by adding the following to smb.conf: winbind nss info = rfc2307


2

Yes, there are a few ways of doing this depending on what you're trying to accomplish exactly. The first method can be done through the samba config. This will only allow these users to connect to Samba, other users can still login through other services (ssh, local term, etc). With this, you'll want to add a line to your [global] section in smb.conf: ...


2

I heartily recommend Likewise-Open for this sort of thing (http://www.beyondtrust.com/Products/PowerBroker-Identity-Services-Open-Edition/), because they make it dead simple to specify the groups able to log in, and the like. The simplicity and time savings alone is worth checking it out. I built an AD infrastructure specifically to authenticate Linux users ...


2

Make sure the winbind service is running. Set up in your /etc/pam.d/samba: account [default=bad success=ok user_unknown=ignore] pam_winbind.so account required pam_permit.so password sufficient pam_winbind.so use_authtok password required pam_deny.so session required pam_limits.so auth required pam_nologin.so ...


2

Not only do you generally want pam_unix first, but when you fire up any session, pam will enumerate the groups you belong to using initgroups(3), which will go through all group backends defined in /etc/nsswitch.conf. There are a few reasons for this behaviour, mostly technical limitations around separation of concerns, but in short this allows you to ...


2

This seems to be a reported bug in samba's winbind, although it was saslauthd which complained. Here is the bug report: https://bugzilla.samba.org/show_bug.cgi?id=7265 A workaround, until this is released, is to restart winbind and saslauthd every few days (in a cron).


1

My coworker resolved this. The issue was that we had old data in the winbind cache. We cleared the cache at /var/lib/samba and /var/cache/samba then restarted winbind and everything is working again.


1

You need to register your host with the DNS system - either from updates by the DHCP server or by manually entering the correct A and PTR entries so that other domain members can resolve. NetBIOS name resolution is (hopefully) not used anymore as it is everything that the gods have forbidden.


1

You should not try to map the uid to root, nor the gid this way. If you to give the Administrators root privileges on the system, you could use sudo. You could use the Windows Group for granting the sudo privileges (Domain-Admins).


1

Sorted it out with PowerBroker Identity Services Open Edition: http://www.beyondtrust.com/Products/PowerBroker-Identity-Services-Open-Edition/ Worked out of box, without the complications of samba.


1

Active Directory stores this information in LDAP accessible databases. LDAP query filter "(|(idnumber=%s)(mailnickname =%s))". Unknown if Samba/Winbind allow use of RFC2254 query filters.


1

Solved! just had to run net cache flush and then restart winbind


1

I believe the first line in /etc/pam.d/su looks like this: auth sufficient pam_rootok.so In other words, when you su tries to authorize your to become jdoe, everything looks okay. What you can do is either add your pam_succeed_if line to /etc/pam.d/su, or much better, add an entry to /etc/pam.d/system-auth, but modify it so the auth ...



Only top voted, non community-wiki answers of a minimum length are eligible