7
votes
Accepted
Samba 4: domain joined, but all users are mapped to nobody, and shares are inaccessible from Windows clients
I've found the core problem: a missing package. Unfortunately it's not easy to get right: here is the final, working configuration (thanks to Rowland Penny from samba.org):
get sure you installed all ...
- 6,918
6
votes
Accepted
Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD
I've actually used Centrify commercial version and can totally recommend it. However, it's not worth buying the full version for a pair of Linux hosts, really.
Winbind is a good free alternative ...
- 3,918
5
votes
Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation
I know this post is old but I just ran into the same problem and here is what I found. If you are trying to add a computer to the domain but you are not using a "domain admin" account. The ...
- 51
3
votes
Accepted
winbind authentication through apache slow
I still didn't find how to improve the performance when using mod_authnz_external. However changing to another apache module mod_authnz_ldap got rid of the performance problem. The only downside then ...
- 794
3
votes
Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD
I would second Mr. Raspberry's comment that Centrify is a good option for joining linux/unix hosts to an AD domain.
In my opinion, Centrify has a few advantages over SSSD.
Its easy to implement ...
- 31
3
votes
Joining Ubuntu Server 17.04 to Windows AD: Likewise vs Centrify vs Winbind vs SSSD
Sssd was pretty simple on Ubuntu. I followed the docs on their site https://help.ubuntu.com/lts/serverguide/sssd-ad.html and it worked perfectly. I liked that it was very simple to implement and ...
- 24.1k
3
votes
Accepted
wbinfo -u does not show AD users (is empty)
Try to add the following line to your smb.conf:
client ldap sasl wrapping = plain
It seems as this has caused some trouble lately.
- 190
3
votes
FreeRADIUS using Active Directory integration broken without any traces
Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and ...
- 137
2
votes
Samba Winbind User Resolution
service winbind stop
service stop samba
rm –rf /var/lib/samba
mkdir -p /var/lib/samba/private
rm –rf /var/cache/samba
net join ads –S "yourADserver" –U username
service winbind start
service samba ...
- 21
2
votes
Samba Winbind User Resolution
I had to delete /var/cache/samba as well, in addition to malco's answer (on Debian and Ubuntu)
- 121
2
votes
Samba 4: domain joined, but all users are mapped to nobody, and shares are inaccessible from Windows clients
4294967295 means 2^32 - this is an overflow of counter for GID or UID produced by the winbind deamon to translate xids from AD. That has nothing todo with guest mapping... If you use idmap config ...
- 21
2
votes
Accepted
Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation
I also ran in to the same issue winbindd simply would not start. The entry was already in /etc/hosts but I needed to change /etc/nsswitch.conf and changed to order so that 'files' came first.
hosts: ...
- 36
1
vote
Winbind and AD: Local users with identical AD usernames
I don't know the specifics about Winbind, but in Windows you can prefix the username with the domain name or the machine name to distinguish between a domain and a local user:
DOMAINNAME\username
...
- 70.3k
1
vote
Samba Winbind - Windows Server AD - Users are able to see each other's home directories
I would suggest you alter your 'root preexec' script to check if the users home directory exists and create it if not.
Remove the invalid users line and replace it with 'valid users = %S'
This will ...
1
vote
Accepted
Why does realmd list multiples of the same realm?
This is actually a dangerous situation, as you're probably using ONE of the two entries, not both, and you can't be sure you're using the one you want.
Depending on your nsswitch.conf, you may be ...
- 166
1
vote
Accepted
Should domain_realm point to a domain controller or KDC, or is it just the default_realm name?
Your ex1 is correct, ex2 invalid.
From man page:
[realms]
Contains subsections keyed by Kerberos realm names which describe where to find the Kerberos servers for a particular realm, and other realm-...
- 815
1
vote
Samba 4: domain joined, but all users are mapped to nobody, and shares are inaccessible from Windows clients
Having landed here myself, while looking for some good instructions, thought I should add an update to this post...
Going forward, we are aiming to use sssd instead of winbind for Active Directory ...
- 1,697
1
vote
Linux + Active directory authentication + only letting certain groups login
I struggled with getting any of the above to work for me in RHEL 7. Below is what I was able to get to work.
/etc/sssd/sssd.conf
Change
access_provider = ad
to access_provider = simple
+ ...
- 11
1
vote
Set up Samba with Active Directory and local user authentication
(Writing this frome my phone, so just trying to remember what I did once upon a time) :-)
Okay I am assuming you have already done the samba-tool provision and confirmed that Active Directory have ...
1
vote
Accepted
winbindd gss_init_sec_context failed with [Unspecified GSS failure]
The workaround is adding to /etc/samba/smb.conf and restarting samba & winbind :
winbind rpc only = yes
- 749
1
vote
Accepted
Initialise Kerberos ticket on ssh login using PAM
I ended up using authconfig afterall, which means that I had to prepare a full kerberized environment.
authconfig --enablewinbindkrb5 --update
Note for anyone else who is planning to use this, this ...
- 282
1
vote
Initialise Kerberos ticket on ssh login using PAM
Set krb5_auth = yes in /etc/security/pam_winbind.conf. This file should be safe from any updates by authconfig.
You could use auth sufficient pam_winbind.so use_first_pass krb5_auth in pam, ...
- 12.9k
1
vote
Groupmapping does not work for AD groups
They are well know sids for builtin groups - but I think they can be offset if there is a domain trust, that is where there are 2 or more BUILTIN/users
can you verify the the sid for the AD group in ...
- 1,944
1
vote
linux - windows ad authentication - why join domain?
Yes, Winbind automates setting up the object in Active Directory. I've tried setting up Kerberos to authenticate against AD manually, and it's awful. Lots of obscure commands on the Windows command ...
- 429
1
vote
Cross domain - AD group membership changes not reflected in winbind
It seems that this deletes the cache and forces winbind to pull information from ADC:
service winbind stop
rm /var/cache/samba/netsamlogon_cache.tdb
service winbind start
- 607
1
vote
Cross domain - AD group membership changes not reflected in winbind
Before trying what I suggest, understand it may reset UID/GID mappings that were created by Samba. I do this because everything I care about comes from Active Directory rfc2307 so I'm comfortable ...
- 11
1
vote
Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation
Ran into this error during our production Solaris samba upgrade AND moving to a different AD domain at the same time. We had deleted the object in the old domain but had not told samba to leave the ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible