Centos5 joined Active Directory, but AD users can't log in.

Installing, Configuring, Troubleshooting server daemons such as Web and Mail
Post Reply
the_jaymz
Posts: 5
Joined: 2007/05/04 21:26:28
Location: Mobile, AL, US

Centos5 joined Active Directory, but AD users can't log in.

Post by the_jaymz » 2007/05/04 23:08:15

I finally got my Centos server to join our AD domain. I can see the users with net ads user
but can't login with any of the users in AD.
Any ideas?
Thanks,
James

erroneus
Posts: 14
Joined: 2007/05/08 08:57:01
Location: Arlington, Texas

Re: Centos5 joined Active Directory, but AD users can't log in.

Post by erroneus » 2007/05/08 09:49:37

I can say I have gotten that far at least. I am able to see users log in via ssh, but for some reason when doing anything samba, I get a kerberos ticket error.

The way I got myself to the point beyond yours is by configuring the network authentication. It's a wizard process, I know, and I still have no idea how to manually make that all happen, but at least the machine can join the domain and users can (sort of) log into the machine with AD authentication. I say sort of because I haven't added the PAM stuff to create home directories on the fly.. Once I do that, I expect better things. Right now, my biggest hurdle is getting beyond this kerberos ticket thing.

mpatrick
Posts: 1
Joined: 2007/05/10 02:40:52

Re: Centos5 joined Active Directory, but AD users can't log in.

Post by mpatrick » 2007/05/10 02:53:07

I have users logging into my 2003 AD ok.

What do you have when you run authconfig? Under "User Information" all are blank but Use Winbind. Under Authentication I have Use MD5, Use Shadow, Use Winbind, Local Auth is sufficient.

When you hit NEXT, you get Winbind Settings. I have

Security model: ads
Domain: HOME
Domain Controllers: dawn.home.domain.com
ADS realm: HOME.DOMAIN.COM
Template shell /bin/bash

You might try running

wbinfo -g ( shows groups )
wbinfo -u ( shows users )

Maybe one of them will toss an error that helps.

Here is my smb.conf from my machine, if that helps.

[global]
log level = 0

# general options
workgroup = HOME
netbios name = WILLOW
server string = File server
nt acl support = true

# idmap uid and idmap gid are aliases for
# winbind uid and winbid gid, respectively
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/%D/%U
template shell = /bin/bash
winbind use default domain = yes

# Active directory joining
# "ads server" is only necessary if your kdc
# can't be located using /etc/krb5.conf
security = ads
realm = HOME.DOMAIN.COM
# this handles the "ads server = " directive as well
password server = dawn.home.domain.com

[RAID]
comment = RAID share
path = /data/SMB/storage
read only = no
public = yes

erroneus
Posts: 14
Joined: 2007/05/08 08:57:01
Location: Arlington, Texas

Re: Centos5 joined Active Directory, but AD users can't log in.

Post by erroneus » 2007/05/10 07:01:51

Could it be that you need to set user/group permissions for accessing your share(s)?

Also, those pesky ACLs could also be an issue. I find that if you don't care about actual ownership of files and the like, you could set the force user = and force group = attributes on the share definition, but I definitely don't see mention of any specific user or group access permission in the share and they are certainly needed.

getfacl and setfacl are the commands used in setting the ACLs if you want to go that route.

See the guide I am attaching here to verify your checklist of settings to be sure they are all correct. I found this particular guide to be extremely useful.

(I cannot attach a PDF here...)

http://www.infosecwriters.com/text_resources/pdf/AD_and_Linux_TMunn.pdf <-- the guide is here

Post Reply

Return to “CentOS 5 - Server Support”