I've configured my Debian box with Samba and successfully joined up to my domain using Winbind. I'm trying to share a folder and expose it using windows active directory authentication (on a server 2012 R2 domain). Everything seems to be working, but no matter what I do I get "Access Denied" when I try to access the share.

I used this tutorial to configure Samba:


I can see the shares, and pull it up on a windows machine using Computer Management console.. I can even change the permissions using windows, but no matter what, I can't actually access the share.

Here are the steps I took to enroll the box in AD and expose the share:

add repos

curl https://debgen.simplylinux.ch/txt/jessie/sources_02afb983ca66b4136396fe1f3cc5e8052fa5532a.txt | sudo tee /etc/apt/sources.list

full update / upgrade

cat /etc/debian_version; apt-get update --fix-missing -y; apt-get dist-upgrade -y; apt-get upgrade -y; cat /etc/debian_version

install tools to join domain

apt-get -y install ntp ntpdate winbind samba samba-client libnss-winbind libpam-winbind krb5-config krb5-locales krb5-user

edit /etc/ntp.conf

server dc1.my.domain.com prefer iburst
service ntp restart

edit /etc/krb5.conf


    ticket_lifetime = 24000
    default_realm = MY.DOMAIN.COM
    default_tgs_entypes = rc4-hmac des-cbc-md5
    default_tkt__enctypes = rc4-hmac des-cbc-md5
    permitted_enctypes = rc4-hmac des-cbc-md5
    dns_lookup_realm = true
    dns_lookup_kdc = true
    dns_fallback = yes


    kdc = DC1.MY.DOMAIN.COM
    default_domain = DC1.MY.DOMAIN.COM


    .my.domain.com = DC1.MY.DOMAIN.COM
    my.domain.com = DC1.MY.DOMAIN.COM


    pam = {
    debug = true
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false


    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

test getting a ticket for admin

root@nas02:~# kinit domain_admin
Password for domain_admin@MY.DOMAIN.COM:

root@nas02:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: domain_admin@MY.DOMAIN.COM

Valid starting       Expires              Service principal
10/14/2016 21:56:26  10/15/2016 04:36:20  krbtgt/MY.DOMAIN.COM@MY.DOMAIN.COM


edit /etc/samba/smb.conf

# Global parameters


    workgroup = MY
    realm = MY.DOMAIN.COM
    server role = member server
    security = ADS
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    syslog only = Yes
    log file = /var/log/samba/log.%m
    max log size = 1000
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    template homedir = /home/%U
    template shell = /sbin/bash
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    winbind refresh tickets = Yes
    idmap config samdom:range = 10000-99999
    idmap config samdom:backend = rid
    idmap config *:range = 2000-9999
    idmap config * : backend = tdb
    map acl inherit = Yes
    store dos attributes = Yes
    vfs objects = acl_xattr

edit /etc/nsswitch.conf

passwd:         compat winbind
group:          compat winbind
shadow:         compat winbind
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

join domain

root@nas02:/etc/samba# net ads join -S DC1.MY.DOMAIN.COM -U domain_admin@my.domain.com
Enter domain_admin@my.domain.com's password:

Using short domain name -- MY
Joined 'NAS02' to dns domain 'MY.DOMAIN.COM'

restart everything

service smbd restart; service nmbd restart; service winbind restart

test domain join

root@nas02:/etc/samba# wbinfo -u

root@nas02:/etc/samba# wbinfo -g
domain computers
domain controllers
schema admins
enterprise admins
cert publishers
domain admins
domain users
domain guests
group policy creator owners
ras and ias servers
allowed rodc password replication group
denied rodc password replication group
read-only domain controllers
enterprise read-only domain controllers
cloneable domain controllers
protected users
domain local admins
netmon users

root@nas02:/etc/samba# wbinfo -i domain_admin

root@nas02:/etc/samba# getent passwd

root@nas02:/etc/samba# getent group
domain computers:x:10515:
domain controllers:x:10516:
schema admins:x:10518:
enterprise admins:x:10519:
domain admins:x:10512:
domain users:x:10513:
domain guests:x:10514:

root@nas02:/etc/samba# testparm
Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[Demo]"
Processing section "[print$]"
Loaded services file OK.

Create the directory we want to share

mkdir -p /srv/samba/Demo/

set permissions

root@nas02:/etc/samba# chmod g=rwx /srv/samba/Demo/
root@nas02:/etc/samba# chgrp "Domain Admins" /srv/samba/Demo/

edit /etc/samba/smb.conf


       path = /srv/samba/Demo/
       read only = no

Reload Samba

root@nas02:/etc/samba# smbcontrol all reload-config
  • Attach the ls -ld /srv /srv/samba /srv/samba/Demo output. – drookie Oct 16 '16 at 8:09
  • hey drookie, thanks for the response root@nas02:/# ls -ld /srv /srv/samba /srv/samba/Demo drwxr-xr-x 3 root root 4096 Oct 14 23:25 /srv drwxr-xr-x 3 root root 4096 Oct 14 23:25 /srv/samba drwxrwxr-x 2 root domain admins 4096 Oct 14 23:25 /srv/samba/Demo – stumped221 Oct 17 '16 at 23:57
  • Looks like you're missing the guest user. I don't think it's relevant, but try to add it. In the same time I would increase the loflevel and see what's happening in samba logs. A a wild guess - check if selinux has to do something with this. – drookie Oct 18 '16 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.