1

I have a Linux Mint SMB server set up the default way (i.e. the way it comes from apt-get), so I have this set:

passdb backend = tdbsam

I have LDAP correctly configured with PAM (and user logins via ssh work correctly).

I tried to do this in the settings of a share:

valid users = family

Where family is a group on the LDAP server.

However, when I try to connect to the server as an ldap user, it doesn't let me connect. If I connect as a local user, it works.

Furthermore, the Ubuntu "Shared Folders" control panel does not show any network users in the list of people to grant access to various shares.

So: why isn't this working?

Additions:

Here is what I believe to be a relevant portion of the [very] long log file tagged by name of the computer that's connecting:

Mapping user [SEC1][christopher] from workstation [DEFIANT]

attempting to make a user_info for christopher (christopher)

making strings for christopher's user_info struct

making blobs for christopher's user_info struct

made a user_info for christopher (christopher)

check_ntlm_password: Checking password for unmapped user [SEC1][christopher]@[DEFIANT] with the new password interface

check_ntlm_password: mapped user is: [SEC1][christopher]@[DEFIANT]

check_ntlm_password: auth_context challenge created by random

challenge is:

[0000] F9 89 7B 47 67 0B 29 49 ..{Gg.)I

Check auth for: [christopher]

check_ntlm_password: guest had nothing to say

Check auth for: [christopher]

is_myname("SEC1") returns 1

push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1

push_conn_ctx(0) : conn_ctx_stack_ndx = 0

setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1

Security token: (NULL)

UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups

pdb_getsampwnam (TDB): error fetching database. Key: USER_christopher

pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0

check_sam_security: Couldn't find user 'christopher' in passdb.

check_ntlm_password: sam authentication for user [christopher] FAILED with error NT_STATUS_NO_SUCH_USER

check_ntlm_password: Authentication for user [christopher] -> [christopher] FAILED with error NT_STATUS_NO_SUCH_USER

Checking NTLMSSP password for SEC1\christopher failed: NT_STATUS_NO_SUCH_USER

No such user christopher [SEC1] - using guest account

Note that "SEC1" is the name of the server and "DEFIANT" is the name of the client. I also tried connecting with the username "\"; it correctly recognized the domain but that still didn't change anything.

  • The right syntax for adding a group in valid users parameter is +family. However, this doesn't seem to solve the problem, because connection as a local user works. Could you set log level = 10 in /etc/samba/smb.conf and check log files with tail -F /var/log/samba/*? – Anderson M. Gomes Mar 7 '16 at 1:25
  • Also, does pdbedit -L list all users defined in your LDAP server? – Anderson M. Gomes Mar 7 '16 at 1:30
  • @AndersonM.Gomes pdbedit -L lists the local user but not any of the network users. Also, I'm looking at the log file to try to pair it down because from the time my computer sent my password to the time the log ended, 1306 lines came out. – iAdjunct Mar 7 '16 at 1:35
  • @AndersonM.Gomes See the updates – iAdjunct Mar 7 '16 at 1:43
2

While PAM authenticates users against the LDAP database, Samba authenticates users against its tdbsam backend. The simple solution is adding them with either smbpasswd -a <username> or pdbedit -a -u <username>. The complicated solution is using LDAP as Samba's passdb backend.

EDIT: note that if you configure Samba to use LDAP as passdb backend, it will authenticate LDAP users only, not local ones.

  • Unfortunately, requiring users to enter a password specifically for samba via command line isn't a viable option. Also, the directory server is OS X Server's OpenDirectory and, from what I've read, it has issues when using it as the backend to samba directly via the LDAP back-end (which I've tried to do...) – iAdjunct Mar 7 '16 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.