Questions tagged [winbind]
Winbind is part of the Samba suite and provides an NSS and PAM layer for Unix/Linux systems to integrate authentication with a Windows domain
135
questions
16
votes
6
answers
56k
views
Linux + Active directory authentication + only letting certain groups login
I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind).
What I would like to do now though is only allow certain people or certain groups to ...
8
votes
6
answers
63k
views
Samba Winbind User Resolution
We have successfully deployed AD authentication using Samba and Winbind (idmap_ad) across six Centos 6 servers and have been running happily for a few months now.
One of the servers has stopped ...
8
votes
4
answers
14k
views
Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD
I have quite a few Ubuntu Server 17.04 hosts that must be joined to an existing Windows AD domain (Windows Server 2016). I've never done it before, but I'm aware about several ways to achieve this, ...
6
votes
2
answers
1k
views
How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server?
How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server? This question implies a cluster with 2+ Active Directory servers in ...
6
votes
2
answers
7k
views
Linux machine is in a windows domain, but domain logon isn't working
We have a small network in our department
2 Win Server 2008 Domain Controller
1 debian webserver
a number of win7 Clients
My predecssor tried to add the webserver to our domain in order to login ...
6
votes
5
answers
11k
views
Linux authentication via ADS -- allowing only specific groups in PAM
I'm taking the samba / winbind / PAM route to authenticate users on our linux servers from our Active Directory domain.
Everything works, but I want to limit what AD groups are allowed to ...
6
votes
1
answer
2k
views
Inconsistent winbind info on Samba 4 AD domain controller
I've setup a Samba 4 AD domain controller on Debian Jessie (samba 4.2.10). Everything's working fine, except that winbind gives wrong user/group information.
I have a sample user "testuser" and a ...
5
votes
6
answers
5k
views
OS X: Finder error -36 when using SMB shares on a Samba server bound to AD
We're looking at deploying SMB homes on Debian (5.0.3) for our mac clients rather than purchasing four new Xserves. We've got our test servers built and functioning properly. Windows clients behave ...
5
votes
2
answers
11k
views
Groupmapping does not work for AD groups
We have an ActiveDirectory where we get our users from.
So authentication on the linux machine works over pam.
We managed this part to work so far, but we need all users to be part of the local group ...
4
votes
2
answers
4k
views
Active directory integration not working properly with winbind and samba
I'm trying to get my linux box to use active directory authentication. I believe I have almost everything setup correctly. I'm able to issue wbinfo -g and wbinfo -u and see all the groups and users ...
4
votes
1
answer
13k
views
Managing UID/GID of dual Samba / Winbind to AD
I have two Linux servers connected to an Active Directory Windows 2008 server using Samba/Winbind, and here is my samba config
workgroup = COMPANY
realm = COMPANY.COM
server string = ...
4
votes
3
answers
571
views
Linux on Windows AD Domain
Successfully joined my Linux Box to a Windows AD Domain. Wanted to know from other admins if it us possible to specify what groups from windows ad is allowed to login? Otherwise anyone with a AD ...
4
votes
1
answer
6k
views
FreeRADIUS using Active Directory integration broken without any traces
I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason.
I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the ...
4
votes
1
answer
12k
views
Linux - How to control Winbind Authentication cache timeout
I have configured my linux machines (running CentOS 5.2) to authenticate against a Windows server running Active Directory. I have even enabled winbind offline logon. Everything works as expected, ...
4
votes
1
answer
15k
views
Linux nested groups with winbind
We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
4
votes
1
answer
3k
views
Import Active Directory users into Unix/Linux/FreeBSD group
I need to have FreeBSD 8.2 RELEASE p9 (running FreeNAS) import or associate Active Directory users (or Security Group) with a Unix/FreeBSD group. This way I can use FreeBSD group(s) security on a ...
4
votes
2
answers
2k
views
Samba/Winbind issues joing to Active directory domain
I'm currently in the process of setting up winbind/samba and getting a few issues.
I can test connectivity with wbinfo fine:
[root@buildmirror ~]# wbinfo -u
hostname username
administrator
guest
...
4
votes
1
answer
2k
views
vsftpd with pam_winbind.so
I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to /media/storage/...
4
votes
1
answer
3k
views
Linux computer (Debian) in a Windows Active Directory Domain, Administrator of AD should have root permission after login
I managed to join my Debian machine (Squeeze) to an existing Active Directory (MS Windows 2008 R2 Server). Everything works fine, I can login using accounts from the Active Directory (NTP, Kerberos, ...
4
votes
0
answers
2k
views
Configure ntlm_auth for offline operations
We currently have a NAC server set up to authenticate against a Samba4 AD using the ntlm_auth utility and would like to make it more tolerant to network outages.
Currently, when the NAC loses ...
3
votes
1
answer
4k
views
Joining Linux cloned VM to Active directory
Joining Linux host to Windows AD is widely documented.However I struggle to find any guides or best practices on how to join Linux clones that were already members of the domain.
Naturally things ...
3
votes
1
answer
2k
views
Logging on as root without winbind timeouts
How can I set up my Linux box so that, if the Active Directory domain controller is down, I can still log in as root, without any timeouts or delays?
Following the example of most of the ...
3
votes
1
answer
2k
views
wbinfo -u does not show AD users (is empty)
We have a problem on a Ubuntu Server 14.04 (fileserver) connected to AD on a Windows Server 2008 R2 using Samba (version 4.3.8)/WinBind and Kerberos. The problem is that users do not have writing ...
3
votes
1
answer
4k
views
SSH instant logout after ssh login kerberos / winbind
I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo.
I want to be able to use ...
3
votes
1
answer
947
views
Best Management Practices for using Winbind?
I'm planning on migrating a few of our Linux servers to use AD authentication via SAMBA/Winbind. Operating system will be openSUSE 11.3 x64. Our AD environment does not have UNIX extensions ...
3
votes
1
answer
5k
views
Linux with winbind, disable local users while AD is available?
Routers and switches with RADIUS authentication can be configured such that login is disabled for locally configured users as long as the RADIUS server is available. If the RADIUS server becomes ...
3
votes
1
answer
5k
views
winbind from samba 3.6.3 on Linux works but does not integrate with OS?
Successfully compiled and installed the latest version of samba.
Started winbindd and the following diagnostic commands work:
wbinfo -p, wbinfo -c, net ads testjoin, etc...
However! when using ...
3
votes
2
answers
3k
views
Winbind/AD: Local users with identical AD usernames
We are getting ready to add Winbind/Samba to some CentOS servers. Identity Management for UNIX is running on our DC, and it's testing well so far. There is one scenario I'm having trouble with, and I'...
3
votes
0
answers
2k
views
SSSD procedure for staying joined when renaming AD computer object
Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
3
votes
2
answers
7k
views
I have to manually restart winbind.service after every reboot. Ubuntu 18.04
S.O. Ubuntu 18.04.4, Samba version 4.7.6-Ubuntu
I have this problem with this machine. Whenever the system restarts, winbind.service fail to start properly, and error "clock skew too great" is ...
3
votes
0
answers
2k
views
Create and Manage Windows NFS Shares for Linux Clients with AD Authentication
I have a Windows file server that I would like to create NFS shares on. These shares need to be accessible by both Windows 7 domain clients and Linux clients (Red Hat 5 & 6) using Samba/Winbind ...
3
votes
1
answer
2k
views
PAM Winbind Expired Password
We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted.
What's the ...
3
votes
2
answers
7k
views
mounting windows shares on linux while keeping windows permissions
I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
3
votes
0
answers
1k
views
Group membership erratically lost after user logs in - Ubuntu, winbind, AD
I have a really strange issue where the wbinfo -g command properly indicates the AD domain group I am interested in and shows a particular user in that group - this is always true, so on the linux ...
2
votes
7
answers
33k
views
Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation
I'm attempting to join a Ubuntu 12.04 server to Active Directory. I installed samba, and kb5-user, created a machine account in AD, and did:
> net ads testjoin
Join is OK
So far so good. Then I ...
2
votes
2
answers
6k
views
getent groups shows AD groups, but getent passwd doesn't show users
Attempting to get my fedora linux machine to allow Active Directory logons, but I'm not aple to get past this. I'm trying to reconcile a number of tutorials which seem to give contradictory advice as ...
2
votes
2
answers
964
views
winbind authentication through apache slow
I have a linux machine setup to authenticate users using Active Directory with samba/winbind.
Apache is then setup to use that to authenticate the users. This is done using:
<IfModule ...
2
votes
1
answer
3k
views
Ubuntu 14.04 Active Directory auth fails after static ip config
I'm having 6 Ubuntu 14.04 servers that are joined to active directory (2003 domain functional level 2008r2 schema)
All of the servers work's fine when network interface is configured to use DHCP.
But ...
2
votes
2
answers
12k
views
Samba/Winbind: adding domain users to local groups based on domain group
I have a Redhat ES 6 server that's successfully joined to a domain via Winbind (i.e. I can login to the Redhat server using domain credentials with no issues).
What I'm looking to do at this point is ...
2
votes
1
answer
1k
views
Why does realmd list multiples of the same realm?
I'm setting up an Ubuntu server so that users can authenticate against a Windows AD server. Not knowing about realmd, I used Samba Winbind's net join command to join the machine to the domain. ...
2
votes
1
answer
326
views
Bringing Linux Accounts in Active Directory
I'm trying to centralize user login information via Active Directory. Currently I have AD running on Server 2008 R2. I do have Identity Management for UNIX installed on it. I also have a few Linux ...
2
votes
1
answer
5k
views
Set up Samba with Active Directory and local user authentication
My main goal is to set up a Samba-Server, to where users can connect to by using their Active-Directory credentials. Additionally, local linux users on the Samba-Server should be able to authenticate.
...
2
votes
3
answers
2k
views
linux - windows ad authentication - why join domain?
When using Windows AD to authenticate users on Linux servers is there an advantage to using Winbind and "Joining the Domain" over just authenticating via Kerberos and looking up UID,GID, home dir, etc ...
2
votes
1
answer
3k
views
'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)
On clean installed centos-7 host:
realm join -U foo --client-software sssd AD.EXAMPLE.COM
After running realm list output looks initially like this:
AD.EXAMPLE.COM
type: kerberos
realm-name: AD....
2
votes
2
answers
19k
views
winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint.
Apr 3 14:44:14 ...
2
votes
1
answer
567
views
CentOS 6 Gnome login immediately logs me out
Have a strange issue on freshly installed CentOS 6, with Samba Windows 2008 R2 authentication.
The login succeeds, and even the home directory created, but then I'm thrown back to the login scren ...
2
votes
2
answers
3k
views
Windows Share authentication from Active Directory Linux login
I'm using Active Directory to log into RHEL. To do this, I followed the steps outlined here:
http://www.markwilson.co.uk/blog/2007/05/using-active-directory-to-authenticate-users-on-a-linux-...
2
votes
1
answer
879
views
pam_winbind: unknown option require_membership_of
I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group.
I'm using a generic conf file for the vsftpd, with ...
2
votes
0
answers
14k
views
Unable to authenticate to AD using Kinit - cache file not found
I'm trying to set up Winbind with PAM and Kerberos to authenticate CentOS 7 against active directory.
So far this is what I've done:
yum -y install authconfig krb5-workstation pam_krb5 samba-common ...
2
votes
0
answers
1k
views
Samba doesn't seem to stay joined to Active Directory domain [closed]
I can initially join a linux box to the domain with these commands:
sudo kinit [email protected]
sudo net ads join -k
After a few hours or the next day, this happens:
...