We have a samba AD (4.3.11-Ubuntu) attaching to both Windows and Linux clients (Ubuntu 14, and Ubuntu 18)

If I examine the LDAP for a user, his loginShell parameter is /bin/zsh. This was working for Ubuntu 14, but on the clean installs of Ubuntu 18, his login tries to use bash.

I have confirmed zsh is installed on the Ubuntu 18 computers.

If I add an /etc/passwd entry for the user in a local Ubuntu 18 machine, zsh is correctly used.

How can I determine where the issue is coming from?


Samba active directory was set up on the clients using Puppet to push in the configuration files, and run any needed commands. The process was:

puppet init.pp

class samba {
    package {'mycustompackage-samba':
        ensure => present,
        require => Exec['apt-get-update'],
    file {"/etc/resolv.conf.local":
        ensure  => file,
        source  => "puppet:///modules/samba/resolv.conf",
        before  => File['/etc/resolv.conf'],
    file {"/etc/resolv.conf":
        ensure  => link,
        target  => "/etc/resolv.conf.local",
    service {"systemd-resolved":
        ensure => false,
        enable => false
    file {'/etc/nsswitch.conf':
        source => [
        owner => root,
        group => root,
        mode => "0644",
        ensure => present
    file {'/etc/NetworkManager/NetworkManager.conf':
        source  => "puppet:///modules/samba/NetworkManager.conf",
        owner   => root,
        group   => root,
        mode    => "644",
        ensure  => present,
        before  => File['/etc/resolv.conf'],
    file {'/etc/krb5.conf':
        source => [
        owner => root,
        group => root,
        mode => "0600",
        ensure => present
    file {'/etc/samba/smb.conf':
        source => [
        ensure => present,
        owner => root,
        group => root,
        mode => "0644",
        require => Package['h2t-samba']
    host {'Servername.redacted.de':
        ip => 'xxx.yyy.zzz.9',
        host_aliases => ["Servername"]


    workgroup = RedactedDomainName
    client signing = yes
    client use spnego = yes
    kerberos method = secrets and keytab
    realm = RedactedDomainName.redacted.de
    security = ads
    preferred master = no
    encrypt passwords = true
    log level = 3
    log file = /var/log/samba/log.%m
    max log size = 50
    printcap name = cups
    printing = cups
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    winbind nested groups = Yes
    winbind separator = +
    winbind refresh tickets = Yes
    winbind nss info = rfc2307
    idmap config * : backend = tdb
    idmap config * : range = 1000-999999
    idmap config RedactedDomainName : backend = rid
    idmap config RedactedDomainName : range=1000-999999
    idmap config RedactedDomainName : base_rid = 0
    ;template primary group = "redactedPrimaryGroup"
    winbind rpc only = no
    template homedir = /share/homes/all/%U
    template shell = /bin/bash
    client use spnego = yes
    client ntlmv2 auth = yes
    restrict anonymous = 2
    socket options = IPTOS_LOWDELAY TCP_NODELAY




    default_realm = RedactedDomainName.redacted.de
    ticket_lifetime = 24h #
    renew_lifetime = 7d
# The following krb5.conf variables are only for MIT Kerberos.
# The following encryption type specification will be used by MIT Kerberos
# if uncommented.  In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
#   default_tgs_enctypes = des3-hmac-sha1
#   default_tkt_enctypes = des3-hmac-sha1
#   permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
    RedactedDomainName.redacted.de = {
        kdc = Servrname.redacted.de
        admin_server = Servername.redacted.de
        default_domain = RedactedDomainName.redacted.de
    .RedactedDomainName.redacted.de = RedactedDomainName.redacted.de
    RedactedDomainName.redacted.de = RedactedDomainName.redacted.de


# /etc/nsswitch.conf
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd:         compat systemd winbind
group:          compat systemd winbind
shadow:         compat
gshadow:        files
hosts:          files mdns4_minimal [NOTFOUND=return] dns myhostname
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis


# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
nameserver xxx.yyy.zzz.9
nameserver xxx.yyy.zzz.90
nameserver xxx.yyy.zzz.91
search redacted.de


services = nss, pam
config_file_version = 2
domains = RedactedDomainName.redacted.de
id_provider = ad
access_provider = ad
# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME.  Use with pam_mkhomedir.so
override_homedir = /home/%g/%u
# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = mymachine.myubuntu.example.com
# Uncomment if DNS SRV resolution is not working
# ad_server = dc.mydomain.example.com
# Uncomment if the AD domain is named differently than the Samba domain
# Enumeration is discouraged for performance reasons.
enumerate = true

Could you please reproduce the steps taken to integrate the Ubuntu clients into the AD? If you are using sssd, you might check that the value sss is set for passwd in your nsswitch.conf like passwd: files sss

edit: I see two possible points:

  • change template shell = /bin/bash into template shell = /bin/zsh inside smb.conf to set it globally

  • alter the passwd entry in nsswitch.conf to passwd: compat systemd winbind sss to have sssd resolve the passwd atributes

It seems that winbind is unable to map the LDAP attribute to the local nsswitch passwd. Nsswitch, Winbind and sssd are the areas you might want to investigate further.

  • I added the info to the OP. I checked the puppet domain config being used on Ubuntu 14 machines, and didn't see any reference to SSS in the nsswitch.conf. It works on 14. Just not 18. I don't know if that means anything regarding the nsswitch.conf and sss however. – BurningKrome May 8 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.