I'm running a Samba Active Directory domain with Ubuntu 18.04 clients.
I used the
/etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it on a number of machines, and it worked fine...
rightmire@testpc:~$ groups domain users dialout master BUILTIN+users rightmire
However, today for no apparent reason - it is no longer mapping the dialout group...
rightmire@testpc:~$ groups domain users master BUILTIN+users rightmire
pam-auth-update does seem to see the groups.conf...
I'm not sure how to begin troubleshooting this. Searching for
pam-auth-update in the logs comes up with nothing. I'm not seeing anything pertinent in
root@testpc:~# cat /etc/security/group.conf | sed '/^#/d' *;*;*;Al0000-2400;dialout
root@testpc:~# cat /usr/share/pam-configs/my_groups Name: activate /etc/security/group.conf Default: yes Priority: 900 Auth-Type: Primary Auth: required pam_group.so use_first_pass
root@testpc:~# DEBIAN_FRONTEND=noninteractive pam-auth-update root@testpc:~# (I.e. no error...)
It seems that the problem only appears with
su - user or local login (even though the local login is via the domain).
I.e. If I login via ssh as the user, the dialout group appears fine...
rightmire@localPC:~$ ssh rightmire@remotePC Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-46-generic x86_64) (...snip...) 68 packages can be updated. 43 updates are security updates. rightmire@remotePC:~$ groups domain users dialout master BUILTIN+users rightmire@remotePC:~$
But if I
su - rightmire, it does not appear...
root@remotePC:~# su - rightmire rightmire@remotePC:~$ groups domain users master BUILTIN+users domain admins denied rodc password replication group staff konstrukteure vicongroup h2t rightmire rightmire@remotePC:~$
I have looked in the
/etc/pam.d. The two files which contain a reference to
./common-auth:auth required pam_group.so use_first_pass ./login:auth optional pam_group.so
However, the majority of the (login pertinent) files (including
sudo which DON'T set the group, as well as
sshd which DOES set the groups) include
./chfn:@include common-auth ./chsh:@include common-auth ./cron:@include common-auth ./cups:@include common-auth ./gdm-password:@include common-auth ./lightdm:@include common-auth ./login:@include common-auth ./other:@include common-auth ./polkit-1:@include common-auth ./samba:@include common-auth ./slock:@include common-auth ./sshd:@include common-auth ./su:@include common-auth ./sudo:@include common-auth