New answers tagged

1

I ended up using authconfig afterall, which means that I had to prepare a full kerberized environment. authconfig --enablewinbindkrb5 --update Note for anyone else who is planning to use this, this command updates the PAM stack, I believe it invalidates the config in /etc/security/pam_winbind.conf and also modifies /etc/samba/smb.conf. In order to use it ...


1

Set krb5_auth = yes in /etc/security/pam_winbind.conf. This file should be safe from any updates by authconfig. You could use auth sufficient pam_winbind.so use_first_pass krb5_auth in pam, but that might be overridden by authconfig.


2

Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and then make sure that the privileged pipe is owned by root:winbindd_priv. The winbind privileged pipe is usually in /var/lib/samba/winbindd_privileged/, or a ...


0

Out of nowhere it suddenly worked: do NOT specify -S rootdomainname.com in net ads


0

They are well know sids for builtin groups - but I think they can be offset if there is a domain trust, that is where there are 2 or more BUILTIN/users can you verify the the sid for the AD group in Powershell Get-ADGroup -Identity users | select sid see if there are any issues with listing users on the samba server net usersidlist one other thing is ...



Top 50 recent answers are included