I am struggling to get Samba to authenticate against AD.
I have tried the config above, but without success.
My host is already on AD and authenticating, and is configured exactly as many others.
It is only Samba that I cannot get authenticating against AD.
I set my smb.conf up as above.
My sssd.conf and krb.conf are as shown below.
What could I be doing wrong/how can I debug this?
I have the book "Implementing Samba 4" , but it doesn't go into these types of nuts and bolts.
I have the O'Reilly "Using Samba", and it goes into great detail, but it's last updated 2007 and as far as I can tell, is one or more gyrations out of date. It is talking about Winbind and OpenLDAP and as far as I can tell that is old-skool, in RHEL land, replaced by SSSD, is that right? I mean, I have sssd in my nsswitch.conf, but would want to have winbind in there if I was using winbind, is that correct? So because I'm doing SSSD I do -not- want to run winbind, correct? But still I have not had success getting Samba to authenticate against my AD DC. All I can get is
session setup failed: NT_STATUS_LOGON_FAILURE
and
[2017/05/10 14:03:03.550796, 1] ../source3/param/loadparm.c:2377(lp_idmap_range)
idmap range not specified for domain '*'
The instructions above say to say "net ads join" even though a "realm join" has already been done, at least, in my case. Do I still want to do the net ads join? Here is what "realm list" showed before I said "net ads join":
[root@dwsftp10 etc]# realm list
westmarine.net
type: kerberos
realm-name: WESTMARINE.NET
domain-name: westmarine.net
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U
login-policy: allow-realm-logins
Then I said "net join" as per kvashishta, in the thread, above. Now when I say "realm list" I get:
[root@dwsftp10 samba]# realm list
westmarine.net
type: kerberos
realm-name: WESTMARINE.NET
domain-name: westmarine.net
configured: kerberos-member
server-software: active-directory
client-software: winbind
required-package: oddjob-mkhomedir
required-package: oddjob
required-package: samba-winbind-clients
required-package: samba-winbind
required-package: samba-common-tools
login-formats: WESTMARINE\%U
login-policy: allow-any-login
westmarine.net
type: kerberos
realm-name: WESTMARINE.NET
domain-name: westmarine.net
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U
login-policy: allow-realm-logins
..I am now in there twice! The first listing for WESTMARINE.NET now shows winbind all over it. Why? That's not what I want, right? Also, now, it takes forever to SSH into this machine - it's like it goes away for a while while trying to authenticate.
Help!
Thanks very much in advance!!
-----------------------------------------------------------------------------
/etc/krb5.conf:
[root@dwsftp10 etc]# cat krb5.conf
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = WESTMARINE.NET
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = yes
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
WESTMARINE.NET = {
kdc = 10.7.34.177
master_kdc = 10.7.34.177
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
admin_server = 10.7.34.177
default_domain = westmarine.net
pkinit_anchors = FILE:/etc/ipa/ca.crt
}
[domain_realm]
.westmarine.net = WESTMARINE.NET
westmarine.net = WESTMARINE.NET
[dbmodules]
WESTMARINE.NET = {
db_library = ipadb.so
}
----------------------------------------------------------------------------
[root@dwsftp10 etc]# cat sssd/sssd.conf
[sssd]
config_file_version = 2
domains = westmarine.net
services = nss, pam
[domain/westmarine.net]
ad_domain = westmarine.net
krb5_realm = WESTMARINE.NET
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
# OVERRIDES
auth_provider = ad
chpass_provider = ad
access_provider = ad
# defines user/group schema type
ldap_schema = ad
#
ldap_id_mapping = true
use_fully_qualified_names = False
override_shell = /bin/bash
fallback_homedir = /home/%u
# caching credentials
cache_credentials = true
# access controls
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
# performance
ldap_referrals = false
--------------------------------------------------------------
[root@dwsftp10 samba]# cat smb.conf
[global]
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
# server string is the equivalent of the NT Description field
# netbios name can be used to specify a server name not tied to the hostname
workgroup = WESTMARINE
realm = WESTMARINE.NET
netbios name = dwsftp10
password server = *
#password server = pwsdc03.westmarine.net
server string = Samba Server Version %v
security = ads
#kerberos method = secrets and keytab
#kerberos method = dedicated keytab
#dedicated keytab file = /etc/krb5.keytab
#encrypt passwords = yes
#idmap uid = 10000-20000
#idmap gid = 10000-20000
# max 50KB per log file, then rotate
max log size = 50000
log file = /var/log/samba/%m.log
log level = 3
#password backend = tdbsam
#idmap config WESTMARINE.NET: backend = rid
#idmap config WESTMARINE.NET: range = 10000-20000
#wins server = pwsdc03.westmarine.net
idmap config *: backend = tdb
local master = no
domain master = no
preferred master = no
wins support = no
wins proxy = no
dns proxy = yes
name resolve order = wins bcast host lmhosts
#client signing = yes
#client use spnego = yes
load printers = no
printcap name = /dev/null
disable spoolss = yes
#winbind use default domain = yes
[Moderator: split from original topic viewtopic.php?f=48&t=52872 which is too old]