I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not work is using the AD users on the centos box. I have activated the "Identity Management for UNIX" on the AD, so that users have a UID, GID, homdir and shell. Unfortunatly there are still only the local users on centos.
id mytestuser gives me "No such user". Further:
myhost someone:~ $ wbinfo -i mytestuser
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user mytestuser
myhost someone:~ $ wbinfo -a mytestuser
Enter mytestuser's password:
plaintext password authentication succeeded
Enter mytestuser's password:
challenge/response password authentication failed
Could not authenticate user mytestuser with challenge/response
There seems to be a bug which seems to resemble my problem, but as far as I can tell, I have allready incorporated the syntax change in my samba configuration.
Here is my config:
/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = ACME.ORG
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_keytab_name = FILE:/etc/krb5.keytab
[realms]
ACME.ORG= {
kdc = myadserver.acme.org
admin_server = myadserver.acme.org
default_domain = acme.org
}
[domain_realm]
.acme.org = ACME.ORG
acme.org = ACME.ORG
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
klist lists a valid ticket granting ticket.
my /etc/samba/smb.cnf
[global]
workgroup = ACME
server string = my super suerver
log level = 3
log file = /var/log/samba/log.%m
max log size = 50
security = ADS
encrypt passwords = yes
passdb backend = tdbsam
realm = ACME.ORG
preferred master = no
load printers = yes
cups options = raw
printcap name = cups
printing = cups
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nested groups = Yes
winbind separator = +
template shell = /bin/bash
winbind nss info = rfc2307
kerberos method = system keytab
dedicated keytab file = /etc/krb5.keytab
idmap config ACME:backend = rid
idmap config ACME:base_rid = 10036
idmap config ACME:range = 10036-1000000
[homes]
comment = Home Directories
browseable = no
writable = yes
valid users = %S
valid users = ACME\%S
Part of my /etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
And my /etc/pam.d/system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_krb5.so
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account sufficient pam_winbind.so use_first_pass
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_winbind.so use_first_pass
password required pam_krb5.so
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session required pam_mkhomedir.so
session required pam_krb5.so
session required pam_winbind.so use_first_pass
To me it looks a bit like this bug. How can I veryfy its this one? Any hints?
