I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not work is using the AD users on the centos box. I have activated the "Identity Management for UNIX" on the AD, so that users have a UID, GID, homdir and shell. Unfortunatly there are still only the local users on centos.

id mytestuser gives me "No such user". Further:

    myhost someone:~ $ wbinfo -i mytestuser
    failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
    Could not get info for user mytestuser

    myhost someone:~ $ wbinfo -a mytestuser
    Enter mytestuser's password:
    plaintext password authentication succeeded
    Enter mytestuser's password:
    challenge/response password authentication failed
    Could not authenticate user mytestuser with challenge/response

There seems to be a bug which seems to resemble my problem, but as far as I can tell, I have allready incorporated the syntax change in my samba configuration.

Here is my config:


     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log

     default_realm = ACME.ORG
     dns_lookup_realm = false
     dns_lookup_kdc = false
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = true
     default_keytab_name = FILE:/etc/krb5.keytab

     ACME.ORG= {
      kdc = myadserver.acme.org
      admin_server = myadserver.acme.org
      default_domain = acme.org

     .acme.org = ACME.ORG
     acme.org = ACME.ORG

     pam = {
       debug = false
       ticket_lifetime = 36000
       renew_lifetime = 36000
       forwardable = true
       krb4_convert = false

klist lists a valid ticket granting ticket.

my /etc/samba/smb.cnf

            workgroup = ACME
            server string = my super suerver
            log level = 3
            log file = /var/log/samba/log.%m
            max log size = 50
            security = ADS
            encrypt passwords = yes
            passdb backend = tdbsam
            realm = ACME.ORG
            preferred master = no
            load printers = yes
            cups options = raw
            printcap name = cups
            printing = cups
            winbind enum users = Yes
            winbind enum groups = Yes
            winbind use default domain = Yes
            winbind nested groups = Yes
            winbind separator = +
            template shell = /bin/bash
            winbind nss info = rfc2307
            kerberos method = system keytab
            dedicated keytab file = /etc/krb5.keytab
            idmap config ACME:backend = rid
            idmap config ACME:base_rid = 10036
            idmap config ACME:range = 10036-1000000
            comment = Home Directories
            browseable = no
            writable = yes
            valid users = %S
            valid users = ACME\%S

Part of my /etc/nsswitch.conf

passwd:     files winbind
shadow:     files winbind
group:      files winbind

And my /etc/pam.d/system-auth

    auth        required      pam_env.so
    auth        sufficient    pam_unix.so nullok try_first_pass
    auth        requisite     pam_succeed_if.so uid >= 500 quiet
    auth        required      pam_krb5.so
    auth        sufficient    pam_winbind.so use_first_pass
    auth        required      pam_deny.so

    account     required      pam_unix.so
    account     sufficient    pam_succeed_if.so uid < 500 quiet
    account     sufficient    pam_winbind.so use_first_pass
    account     required      pam_permit.so

    password    requisite     pam_cracklib.so try_first_pass retry=3
    password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
    password    sufficient    pam_winbind.so use_first_pass
    password    required      pam_krb5.so
    password    required      pam_deny.so

    session     optional      pam_keyinit.so revoke
    session     required      pam_limits.so
    session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
    session     required      pam_unix.so
    session     required      pam_mkhomedir.so
    session     required      pam_krb5.so
    session     required      pam_winbind.so use_first_pass

To me it looks a bit like this bug. How can I veryfy its this one? Any hints?

  • what does sudo getent passwd shows? Does it include any of the AD accounts? – Danila Ladner Jun 13 '13 at 15:40
  • no, just local accounts. I have read somewhere, that gentent won't show the winbind accounts, but anyway, it is clear that the system has no knowledge of the AD accounts. So somehow there link between winbind and the local usere management is missing. – Isaac Jun 14 '13 at 8:47
  • no, getent should show LDAP accounts as well. – Danila Ladner Jun 14 '13 at 15:45
  • Well, anyway, it does not. So I would really like to know why. Any hints for how to debug this would be wellcome. – Isaac Jun 14 '13 at 15:47
  • What is the output of wbinfo -i <username> – rchhe Jun 18 '13 at 14:17

I finally got it working, thanks to sssd. It does not use winbind (which is probably why it works :)). The whole setup is described very well in this blog post.

| improve this answer | |
  • blog seems to be dead – user292812 Apr 25 '17 at 15:31
  • Maybe you can get it from google cache? – Isaac Apr 26 '17 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.