1

I had my samba domain member working a few days ago, but now it stopped serving domain users. Some of the steps I already tried: clear caches, rejoin domain, reboot, pam-auth-update, with and without "winbind use default domain = yes" and some more.

Edit: it is an Active Directory domain with server 2008 DCs

Something changed though. When it was working, "wbinfo -u" and "wbinfo -g" displayed the accounts like LONGNAME\accoutname. Now they only show the accountname.

---Edit2: this seems to not be related to the problem. I put "workgroup=LONGNAME" above "realm=SHORTNAME.TLD" and now wbinfo -u or -g show the accounts as before: LONGNAME\accountname.

The somelocaluser can access the shares. When a domain user tries to access the share I get:

[2018/04/24 13:34:49.422394,  3] ../source3/auth/user_krb5.c:51(get_user_from_kerberos_info)
  Kerberos ticket principal name is [user@SHORTNAME.TLD]
[2018/04/24 13:34:49.423991,  3] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
  Username LONGNAME\user is invalid on this system

Has anybody a clue? I'm out of ideas.

Below is my config and some troubleshooting output.

Software: Ubuntu 16.04.4 LTS, Samba 4, krb5-config, krb5-user, winbind, libpam-winbind, libnss-winbind

Config: hostname is e. g. 'samba'

/etc/network/interfaces

auto ens18
iface ens18 inet static
       address         10.10.*****
       netmask         255.255.0.0
       gateway         10.10.*****
       dns-nameservers 172.17.*** 172.17.***
       dns-search      shortname.tld

DNS-resolution works, but I put the name servers (and AD-DCs at the same time) in hosts too /etc/hosts

127.0.0.1      localhost
172.17.***     DC1.shortname.tld
172.17.***     DC2.shortname.tld

Time Sync is external but same source as DCs and difference is zero. I use timesyncd.

/etc/krb5.conf

[logging]
   default = FILE:/var/log/krb5.log
[libdefaults]
       ticket_lifetime = 24000
       clock_skew = 300
       default_realm = SHORTNAME.TLD
           dns_lookup_kdc = true
           dns_lookup_realm = false
[realms]
       SHORTNAME.TLD = {
               kdc = dc1:88
               admin_server = dc1:464
               default_domain = SHORTNAME.TLD
       }
[domain_realm]
       .shortname.tld = SHORTNAME.TLD
       shortname.tld = SHORTNAME.TLD

ping and kinit admin@SHORTNAME.TLD are working

klist-Output:

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@SHORTNAME.TLD

Valid starting       Expires              Service principal
24.04.2018 18:48:19  25.04.2018 01:28:09  krbtgt/SHORTNAME.TLD@SHORTNAME.TLD


net ads join -U admin@SHORTNAME.TLD

Using short domain name -- LONGNAME
Joined 'SAMBA' to dns domain 'shortname.tld'


/etc/nsswitch.conf

passwd:         compat winbind
group:          compat winbind
shadow:         compat
gshadow:        files
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

I have a local user who needs to authenticate without a password and therefore I changed the nullok_secure parameter for pam_unix.so into nullok in the pam-common-files. Further I changed the parameter minimum_uid from 1000 to 10000 for pam_krb5.so in the pam-common-files.

net ads info

LDAP server: 172.17.***
LDAP server name: dc1.shortname.tld
Realm: SHORTNAME.TLD
Bind Path: dc=SHORTNAME,dc=TLD
LDAP port: 389
Server time: Di, 24 Apr 2018 19:11:11 CEST
KDC server: 172.17.***
Server time offset: 0


systemctl status winbind

● winbind.service - LSB: start Winbind daemon
   Loaded: loaded (/etc/init.d/winbind; bad; vendor preset: enabled)
   Active: active (running) since Di 2018-04-24 18:08:59 CEST; 1h 3min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 1920 ExecStop=/etc/init.d/winbind stop (code=exited, status=0/SUCCESS)
  Process: 2132 ExecStart=/etc/init.d/winbind start (code=exited, status=0/SUCCESS)
   Tasks: 8
   Memory: 25.5M
      CPU: 3.663s
   CGroup: /system.slice/winbind.service
           ├─2147 /usr/sbin/winbindd
           ├─2148 /usr/sbin/winbindd
           ├─2154 /usr/sbin/winbindd
           ├─2159 /usr/sbin/winbindd
           ├─2161 /usr/sbin/winbindd
           ├─2167 /usr/sbin/winbindd
           ├─2502 /usr/sbin/winbindd
           └─2503 /usr/sbin/winbindd

Apr 24 18:08:59 samba systemd[1]: Starting LSB: start Winbind daemon...
Apr 24 18:08:59 samba winbind[2132]:  * Starting the Winbind daemon winbind
Apr 24 18:08:59 samba winbind[2132]:    ...done.
Apr 24 18:08:59 samba winbindd[2147]: [2018/04/24 18:08:59.795374,  0] ../source3/winbindd/winbindd_cache.c:3245(initialize_winbindd_cache)
Apr 24 18:08:59 samba winbindd[2147]:   initialize_winbindd_cache: clearing cache and re-creating with version number 2
Apr 24 18:08:59 samba systemd[1]: Started LSB: start Winbind daemon.
Apr 24 18:08:59 samba winbindd[2147]: [2018/04/24 18:08:59.798362,  0] ../lib/util/become_daemon.c:124(daemon_ready)
Apr 24 18:08:59 samba winbindd[2147]:   STATUS=daemon 'winbindd' finished starting up and ready to serve connections


/etc/samba/smb.conf

[global]
realm = SHORTNAME.TLD
workgroup = LONGNAME
idmap config * : backend = tdb
idmap config * : range = 1000-9999
idmap config MICROCONSULT : backend = nss
idmap config MICROCONSULT : range = 10000-19999
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 300
winbind expand groups = 5
winbind max domain connections = 10
template homedir = /dev/null
client use spnego = yes
client ntlmv2 auth = yes
restrict anonymous = 2
acl group control = yes
inherit acls = yes
inherit owner = yes
inherit permissions = yes
vfs objects = acl_xattr
deadtime = 15
admin users = "@LONGNAME\\linuxadminsgroup"
store dos attributes = yes
null passwords = yes
domain master = no
local master = no
preferred master = no
os level = 0
server string = %h server (Samba, Ubuntu)
wins server = 172.17.*** 172.17.***
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = member server
passdb backend = tdbsam
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccess    fully* .
pam password change = yes
map to guest = bad user
#======================= Share Definitions =======================
[ShareOne]
        path = /smbshare/ShareOne
        valid users = somelocaluser, @LONGNAME\\linuxwriter
        create mask = 570
        directory mask = 570
        writeable = no
        write list = @LONGNAME\\linuxwriter

[ShareTwo]
        path = /smbshare/ShareTwo
        valid users = somelocaluser, @LONGNAME\\linuxwriter
        create mask = 770
        directory mask = 770
        writeable = yes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.