Questions tagged [winbind]

Winbind is part of the Samba suite and provides an NSS and PAM layer for Unix/Linux systems to integrate authentication with a Windows domain

Filter by
Sorted by
Tagged with
16 votes
6 answers
56k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
Luma's user avatar
  • 1,470
8 votes
6 answers
63k views

Samba Winbind User Resolution

We have successfully deployed AD authentication using Samba and Winbind (idmap_ad) across six Centos 6 servers and have been running happily for a few months now. One of the servers has stopped ...
malco's user avatar
  • 465
8 votes
4 answers
14k views

Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD

I have quite a few Ubuntu Server 17.04 hosts that must be joined to an existing Windows AD domain (Windows Server 2016). I've never done it before, but I'm aware about several ways to achieve this, ...
Ashton R.'s user avatar
6 votes
2 answers
1k views

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server?

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server? This question implies a cluster with 2+ Active Directory servers in ...
Alex's user avatar
  • 1,868
6 votes
2 answers
7k views

Linux machine is in a windows domain, but domain logon isn't working

We have a small network in our department 2 Win Server 2008 Domain Controller 1 debian webserver a number of win7 Clients My predecssor tried to add the webserver to our domain in order to login ...
Simon Lenz's user avatar
6 votes
5 answers
11k views

Linux authentication via ADS -- allowing only specific groups in PAM

I'm taking the samba / winbind / PAM route to authenticate users on our linux servers from our Active Directory domain. Everything works, but I want to limit what AD groups are allowed to ...
Kenaniah's user avatar
  • 213
6 votes
1 answer
2k views

Inconsistent winbind info on Samba 4 AD domain controller

I've setup a Samba 4 AD domain controller on Debian Jessie (samba 4.2.10). Everything's working fine, except that winbind gives wrong user/group information. I have a sample user "testuser" and a ...
MasterM's user avatar
  • 1,071
5 votes
6 answers
5k views

OS X: Finder error -36 when using SMB shares on a Samba server bound to AD

We're looking at deploying SMB homes on Debian (5.0.3) for our mac clients rather than purchasing four new Xserves. We've got our test servers built and functioning properly. Windows clients behave ...
Frenchie's user avatar
  • 1,292
5 votes
2 answers
11k views

Groupmapping does not work for AD groups

We have an ActiveDirectory where we get our users from. So authentication on the linux machine works over pam. We managed this part to work so far, but we need all users to be part of the local group ...
Alexander Baltasar's user avatar
4 votes
2 answers
4k views

Active directory integration not working properly with winbind and samba

I'm trying to get my linux box to use active directory authentication. I believe I have almost everything setup correctly. I'm able to issue wbinfo -g and wbinfo -u and see all the groups and users ...
nwalke's user avatar
  • 643
4 votes
1 answer
13k views

Managing UID/GID of dual Samba / Winbind to AD

I have two Linux servers connected to an Active Directory Windows 2008 server using Samba/Winbind, and here is my samba config workgroup = COMPANY realm = COMPANY.COM server string = ...
Shiroi98's user avatar
  • 283
4 votes
3 answers
571 views

Linux on Windows AD Domain

Successfully joined my Linux Box to a Windows AD Domain. Wanted to know from other admins if it us possible to specify what groups from windows ad is allowed to login? Otherwise anyone with a AD ...
Riaan's user avatar
  • 421
4 votes
1 answer
6k views

FreeRADIUS using Active Directory integration broken without any traces

I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason. I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the ...
Vinícius Ferrão's user avatar
4 votes
1 answer
12k views

Linux - How to control Winbind Authentication cache timeout

I have configured my linux machines (running CentOS 5.2) to authenticate against a Windows server running Active Directory. I have even enabled winbind offline logon. Everything works as expected, ...
cybervedaa's user avatar
4 votes
1 answer
15k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
Antitribu's user avatar
  • 1,749
4 votes
1 answer
3k views

Import Active Directory users into Unix/Linux/FreeBSD group

I need to have FreeBSD 8.2 RELEASE p9 (running FreeNAS) import or associate Active Directory users (or Security Group) with a Unix/FreeBSD group. This way I can use FreeBSD group(s) security on a ...
Allen's user avatar
  • 41
4 votes
2 answers
2k views

Samba/Winbind issues joing to Active directory domain

I'm currently in the process of setting up winbind/samba and getting a few issues. I can test connectivity with wbinfo fine: [root@buildmirror ~]# wbinfo -u hostname username administrator guest ...
jaxxstorm's user avatar
  • 626
4 votes
1 answer
2k views

vsftpd with pam_winbind.so

I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to /media/storage/...
David's user avatar
  • 41
4 votes
1 answer
3k views

Linux computer (Debian) in a Windows Active Directory Domain, Administrator of AD should have root permission after login

I managed to join my Debian machine (Squeeze) to an existing Active Directory (MS Windows 2008 R2 Server). Everything works fine, I can login using accounts from the Active Directory (NTP, Kerberos, ...
WLanger's user avatar
  • 96
4 votes
0 answers
2k views

Configure ntlm_auth for offline operations

We currently have a NAC server set up to authenticate against a Samba4 AD using the ntlm_auth utility and would like to make it more tolerant to network outages. Currently, when the NAC loses ...
Antoine Benkemoun's user avatar
3 votes
1 answer
4k views

Joining Linux cloned VM to Active directory

Joining Linux host to Windows AD is widely documented.However I struggle to find any guides or best practices on how to join Linux clones that were already members of the domain. Naturally things ...
Sergei's user avatar
  • 1,226
3 votes
1 answer
2k views

Logging on as root without winbind timeouts

How can I set up my Linux box so that, if the Active Directory domain controller is down, I can still log in as root, without any timeouts or delays? Following the example of most of the ...
Josh Kelley's user avatar
3 votes
1 answer
2k views

wbinfo -u does not show AD users (is empty)

We have a problem on a Ubuntu Server 14.04 (fileserver) connected to AD on a Windows Server 2008 R2 using Samba (version 4.3.8)/WinBind and Kerberos. The problem is that users do not have writing ...
moster67's user avatar
  • 153
3 votes
1 answer
4k views

SSH instant logout after ssh login kerberos / winbind

I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo. I want to be able to use ...
Meiko Watu's user avatar
3 votes
1 answer
947 views

Best Management Practices for using Winbind?

I'm planning on migrating a few of our Linux servers to use AD authentication via SAMBA/Winbind. Operating system will be openSUSE 11.3 x64. Our AD environment does not have UNIX extensions ...
churnd's user avatar
  • 4,157
3 votes
1 answer
5k views

Linux with winbind, disable local users while AD is available?

Routers and switches with RADIUS authentication can be configured such that login is disabled for locally configured users as long as the RADIUS server is available. If the RADIUS server becomes ...
Salkin's user avatar
  • 31
3 votes
1 answer
5k views

winbind from samba 3.6.3 on Linux works but does not integrate with OS?

Successfully compiled and installed the latest version of samba. Started winbindd and the following diagnostic commands work: wbinfo -p, wbinfo -c, net ads testjoin, etc... However! when using ...
Alex's user avatar
  • 1,868
3 votes
2 answers
3k views

Winbind/AD: Local users with identical AD usernames

We are getting ready to add Winbind/Samba to some CentOS servers. Identity Management for UNIX is running on our DC, and it's testing well so far. There is one scenario I'm having trouble with, and I'...
verbalicious's user avatar
3 votes
0 answers
2k views

SSSD procedure for staying joined when renaming AD computer object

Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
SeligkeitIstInGott's user avatar
3 votes
2 answers
7k views

I have to manually restart winbind.service after every reboot. Ubuntu 18.04

S.O. Ubuntu 18.04.4, Samba version 4.7.6-Ubuntu I have this problem with this machine. Whenever the system restarts, winbind.service fail to start properly, and error "clock skew too great" is ...
giorgiline's user avatar
3 votes
0 answers
2k views

Create and Manage Windows NFS Shares for Linux Clients with AD Authentication

I have a Windows file server that I would like to create NFS shares on. These shares need to be accessible by both Windows 7 domain clients and Linux clients (Red Hat 5 & 6) using Samba/Winbind ...
johnnybgood04's user avatar
3 votes
1 answer
2k views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
steelcityamir's user avatar
3 votes
2 answers
7k views

mounting windows shares on linux while keeping windows permissions

I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
manjiki's user avatar
  • 350
3 votes
0 answers
1k views

Group membership erratically lost after user logs in - Ubuntu, winbind, AD

I have a really strange issue where the wbinfo -g command properly indicates the AD domain group I am interested in and shows a particular user in that group - this is always true, so on the linux ...
Ian Frisbie's user avatar
2 votes
7 answers
33k views

Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation

I'm attempting to join a Ubuntu 12.04 server to Active Directory. I installed samba, and kb5-user, created a machine account in AD, and did: > net ads testjoin Join is OK So far so good. Then I ...
Jon Skarpeteig's user avatar
2 votes
2 answers
6k views

getent groups shows AD groups, but getent passwd doesn't show users

Attempting to get my fedora linux machine to allow Active Directory logons, but I'm not aple to get past this. I'm trying to reconcile a number of tutorials which seem to give contradictory advice as ...
Peter Turner's user avatar
  • 2,278
2 votes
2 answers
964 views

winbind authentication through apache slow

I have a linux machine setup to authenticate users using Active Directory with samba/winbind. Apache is then setup to use that to authenticate the users. This is done using: <IfModule ...
Zitrax's user avatar
  • 794
2 votes
1 answer
3k views

Ubuntu 14.04 Active Directory auth fails after static ip config

I'm having 6 Ubuntu 14.04 servers that are joined to active directory (2003 domain functional level 2008r2 schema) All of the servers work's fine when network interface is configured to use DHCP. But ...
user2782999's user avatar
2 votes
2 answers
12k views

Samba/Winbind: adding domain users to local groups based on domain group

I have a Redhat ES 6 server that's successfully joined to a domain via Winbind (i.e. I can login to the Redhat server using domain credentials with no issues). What I'm looking to do at this point is ...
coledot's user avatar
  • 151
2 votes
1 answer
1k views

Why does realmd list multiples of the same realm?

I'm setting up an Ubuntu server so that users can authenticate against a Windows AD server. Not knowing about realmd, I used Samba Winbind's net join command to join the machine to the domain. ...
watkipet's user avatar
  • 252
2 votes
1 answer
326 views

Bringing Linux Accounts in Active Directory

I'm trying to centralize user login information via Active Directory. Currently I have AD running on Server 2008 R2. I do have Identity Management for UNIX installed on it. I also have a few Linux ...
user1013264's user avatar
2 votes
1 answer
5k views

Set up Samba with Active Directory and local user authentication

My main goal is to set up a Samba-Server, to where users can connect to by using their Active-Directory credentials. Additionally, local linux users on the Samba-Server should be able to authenticate. ...
Soner Kalayci's user avatar
2 votes
3 answers
2k views

linux - windows ad authentication - why join domain?

When using Windows AD to authenticate users on Linux servers is there an advantage to using Winbind and "Joining the Domain" over just authenticating via Kerberos and looking up UID,GID, home dir, etc ...
fred's user avatar
  • 21
2 votes
1 answer
3k views

'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)

On clean installed centos-7 host: realm join -U foo --client-software sssd AD.EXAMPLE.COM After running realm list output looks initially like this: AD.EXAMPLE.COM type: kerberos realm-name: AD....
Ben's user avatar
  • 391
2 votes
2 answers
19k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
WoJ's user avatar
  • 3,657
2 votes
1 answer
567 views

CentOS 6 Gnome login immediately logs me out

Have a strange issue on freshly installed CentOS 6, with Samba Windows 2008 R2 authentication. The login succeeds, and even the home directory created, but then I'm thrown back to the login scren ...
SyRenity's user avatar
  • 3,189
2 votes
2 answers
3k views

Windows Share authentication from Active Directory Linux login

I'm using Active Directory to log into RHEL. To do this, I followed the steps outlined here: http://www.markwilson.co.uk/blog/2007/05/using-active-directory-to-authenticate-users-on-a-linux-...
Kenny's user avatar
  • 520
2 votes
1 answer
879 views

pam_winbind: unknown option require_membership_of

I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group. I'm using a generic conf file for the vsftpd, with ...
Joao Bernardes's user avatar
2 votes
0 answers
14k views

Unable to authenticate to AD using Kinit - cache file not found

I'm trying to set up Winbind with PAM and Kerberos to authenticate CentOS 7 against active directory. So far this is what I've done: yum -y install authconfig krb5-workstation pam_krb5 samba-common ...
GrahamBond's user avatar
2 votes
0 answers
1k views

Samba doesn't seem to stay joined to Active Directory domain [closed]

I can initially join a linux box to the domain with these commands: sudo kinit [email protected] sudo net ads join -k After a few hours or the next day, this happens: ...
Jonathan S. Fisher's user avatar