0

I've configured my Debian box with Samba and successfully joined up to my domain using Winbind. I'm trying to share a folder and expose it using windows active directory authentication (on a server 2012 R2 domain). Everything seems to be working, but no matter what I do I get "Access Denied" when I try to access the share.

I used this tutorial to configure Samba:

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs

I can see the shares, and pull it up on a windows machine using Computer Management console.. I can even change the permissions using windows, but no matter what, I can't actually access the share.

Here are the steps I took to enroll the box in AD and expose the share:

add repos

curl https://debgen.simplylinux.ch/txt/jessie/sources_02afb983ca66b4136396fe1f3cc5e8052fa5532a.txt | sudo tee /etc/apt/sources.list

full update / upgrade

cat /etc/debian_version; apt-get update --fix-missing -y; apt-get dist-upgrade -y; apt-get upgrade -y; cat /etc/debian_version

install tools to join domain

apt-get -y install ntp ntpdate winbind samba samba-client libnss-winbind libpam-winbind krb5-config krb5-locales krb5-user

edit /etc/ntp.conf

server dc1.my.domain.com prefer iburst
service ntp restart

edit /etc/krb5.conf

[libdefaults]

    ticket_lifetime = 24000
    default_realm = MY.DOMAIN.COM
    default_tgs_entypes = rc4-hmac des-cbc-md5
    default_tkt__enctypes = rc4-hmac des-cbc-md5
    permitted_enctypes = rc4-hmac des-cbc-md5
    dns_lookup_realm = true
    dns_lookup_kdc = true
    dns_fallback = yes

[realms]

    MY.DOMAIN.COM = {
    kdc = DC1.MY.DOMAIN.COM
    default_domain = DC1.MY.DOMAIN.COM
    }

[domain_realm]

    .my.domain.com = DC1.MY.DOMAIN.COM
    my.domain.com = DC1.MY.DOMAIN.COM

[appdefaults]

    pam = {
    debug = true
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
    }

[logging]

    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

test getting a ticket for admin

root@nas02:~# kinit domain_admin
Password for domain_admin@MY.DOMAIN.COM:

root@nas02:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: domain_admin@MY.DOMAIN.COM

Valid starting       Expires              Service principal
10/14/2016 21:56:26  10/15/2016 04:36:20  krbtgt/MY.DOMAIN.COM@MY.DOMAIN.COM

kdestroy

edit /etc/samba/smb.conf

# Global parameters

[global]

    workgroup = MY
    realm = MY.DOMAIN.COM
    server role = member server
    security = ADS
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    syslog only = Yes
    log file = /var/log/samba/log.%m
    max log size = 1000
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    template homedir = /home/%U
    template shell = /sbin/bash
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    winbind refresh tickets = Yes
    idmap config samdom:range = 10000-99999
    idmap config samdom:backend = rid
    idmap config *:range = 2000-9999
    idmap config * : backend = tdb
    map acl inherit = Yes
    store dos attributes = Yes
    vfs objects = acl_xattr

edit /etc/nsswitch.conf

passwd:         compat winbind
group:          compat winbind
shadow:         compat winbind
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

join domain

root@nas02:/etc/samba# net ads join -S DC1.MY.DOMAIN.COM -U domain_admin@my.domain.com
Enter domain_admin@my.domain.com's password:

Using short domain name -- MY
Joined 'NAS02' to dns domain 'MY.DOMAIN.COM'

restart everything

service smbd restart; service nmbd restart; service winbind restart

test domain join

root@nas02:/etc/samba# wbinfo -u
domain_admin
guest
krbtgt
svc.sql
svc.tfs
nas_admin


root@nas02:/etc/samba# wbinfo -g
winrmremotewmiusers__
domain computers
domain controllers
schema admins
enterprise admins
cert publishers
domain admins
domain users
domain guests
group policy creator owners
ras and ias servers
allowed rodc password replication group
denied rodc password replication group
read-only domain controllers
enterprise read-only domain controllers
cloneable domain controllers
protected users
dnsadmins
dnsupdateproxy
domain local admins
wss_admin_wpg
wss_wpg
netmon users


root@nas02:/etc/samba# wbinfo -i domain_admin
domain_admin:*:10500:10513:domain_admin:/home/domain_admin:/sbin/bash


root@nas02:/etc/samba# getent passwd
....
....
domain_admin:*:10500:10513:domain_admin:/home/domain_admin:/sbin/bash
....
....


root@nas02:/etc/samba# getent group
root:x:0:
daemon:x:1:
bin:x:2:
....
sambashare:x:114:
winbindd_priv:x:115:
winrmremotewmiusers__:x:11000:
domain computers:x:10515:
domain controllers:x:10516:
schema admins:x:10518:
enterprise admins:x:10519:
....
domain admins:x:10512:
domain users:x:10513:
domain guests:x:10514:
....


root@nas02:/etc/samba# testparm
Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[Demo]"
Processing section "[print$]"
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER

Create the directory we want to share

mkdir -p /srv/samba/Demo/

set permissions

root@nas02:/etc/samba# chmod g=rwx /srv/samba/Demo/
root@nas02:/etc/samba# chgrp "Domain Admins" /srv/samba/Demo/

edit /etc/samba/smb.conf

[Demo]

       path = /srv/samba/Demo/
       read only = no

Reload Samba

root@nas02:/etc/samba# smbcontrol all reload-config
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
  • Attach the ls -ld /srv /srv/samba /srv/samba/Demo output. – drookie Oct 16 '16 at 8:09
  • hey drookie, thanks for the response root@nas02:/# ls -ld /srv /srv/samba /srv/samba/Demo drwxr-xr-x 3 root root 4096 Oct 14 23:25 /srv drwxr-xr-x 3 root root 4096 Oct 14 23:25 /srv/samba drwxrwxr-x 2 root domain admins 4096 Oct 14 23:25 /srv/samba/Demo – stumped221 Oct 17 '16 at 23:57
  • Looks like you're missing the guest user. I don't think it's relevant, but try to add it. In the same time I would increase the loflevel and see what's happening in samba logs. A a wild guess - check if selinux has to do something with this. – drookie Oct 18 '16 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.