I had my samba domain member working a few days ago, but now it stopped serving domain users. Some of the steps I already tried: clear caches, rejoin domain, reboot, pam-auth-update, with and without "winbind use default domain = yes" and some more.
Edit: it is an Active Directory domain with server 2008 DCs
Something changed though. When it was working, "wbinfo -u" and "wbinfo -g" displayed the accounts like LONGNAME\accoutname. Now they only show the accountname.
---Edit2: this seems to not be related to the problem. I put "workgroup=LONGNAME" above "realm=SHORTNAME.TLD" and now wbinfo -u or -g show the accounts as before: LONGNAME\accountname.
The somelocaluser can access the shares. When a domain user tries to access the share I get:
[2018/04/24 13:34:49.422394, 3] ../source3/auth/user_krb5.c:51(get_user_from_kerberos_info)
Kerberos ticket principal name is [user@SHORTNAME.TLD]
[2018/04/24 13:34:49.423991, 3] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
Username LONGNAME\user is invalid on this system
Has anybody a clue? I'm out of ideas.
Below is my config and some troubleshooting output.
Software: Ubuntu 16.04.4 LTS, Samba 4, krb5-config, krb5-user, winbind, libpam-winbind, libnss-winbind
Config: hostname is e. g. 'samba'
/etc/network/interfaces
auto ens18
iface ens18 inet static
address 10.10.*****
netmask 255.255.0.0
gateway 10.10.*****
dns-nameservers 172.17.*** 172.17.***
dns-search shortname.tld
DNS-resolution works, but I put the name servers (and AD-DCs at the same time) in hosts too /etc/hosts
127.0.0.1 localhost
172.17.*** DC1.shortname.tld
172.17.*** DC2.shortname.tld
Time Sync is external but same source as DCs and difference is zero. I use timesyncd.
/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5.log
[libdefaults]
ticket_lifetime = 24000
clock_skew = 300
default_realm = SHORTNAME.TLD
dns_lookup_kdc = true
dns_lookup_realm = false
[realms]
SHORTNAME.TLD = {
kdc = dc1:88
admin_server = dc1:464
default_domain = SHORTNAME.TLD
}
[domain_realm]
.shortname.tld = SHORTNAME.TLD
shortname.tld = SHORTNAME.TLD
ping and kinit admin@SHORTNAME.TLD are working
klist-Output:
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@SHORTNAME.TLD
Valid starting Expires Service principal
24.04.2018 18:48:19 25.04.2018 01:28:09 krbtgt/SHORTNAME.TLD@SHORTNAME.TLD
net ads join -U admin@SHORTNAME.TLD
Using short domain name -- LONGNAME
Joined 'SAMBA' to dns domain 'shortname.tld'
/etc/nsswitch.conf
passwd: compat winbind
group: compat winbind
shadow: compat
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
I have a local user who needs to authenticate without a password and therefore I changed the nullok_secure parameter for pam_unix.so into nullok in the pam-common-files. Further I changed the parameter minimum_uid from 1000 to 10000 for pam_krb5.so in the pam-common-files.
net ads info
LDAP server: 172.17.***
LDAP server name: dc1.shortname.tld
Realm: SHORTNAME.TLD
Bind Path: dc=SHORTNAME,dc=TLD
LDAP port: 389
Server time: Di, 24 Apr 2018 19:11:11 CEST
KDC server: 172.17.***
Server time offset: 0
systemctl status winbind
● winbind.service - LSB: start Winbind daemon
Loaded: loaded (/etc/init.d/winbind; bad; vendor preset: enabled)
Active: active (running) since Di 2018-04-24 18:08:59 CEST; 1h 3min ago
Docs: man:systemd-sysv-generator(8)
Process: 1920 ExecStop=/etc/init.d/winbind stop (code=exited, status=0/SUCCESS)
Process: 2132 ExecStart=/etc/init.d/winbind start (code=exited, status=0/SUCCESS)
Tasks: 8
Memory: 25.5M
CPU: 3.663s
CGroup: /system.slice/winbind.service
├─2147 /usr/sbin/winbindd
├─2148 /usr/sbin/winbindd
├─2154 /usr/sbin/winbindd
├─2159 /usr/sbin/winbindd
├─2161 /usr/sbin/winbindd
├─2167 /usr/sbin/winbindd
├─2502 /usr/sbin/winbindd
└─2503 /usr/sbin/winbindd
Apr 24 18:08:59 samba systemd[1]: Starting LSB: start Winbind daemon...
Apr 24 18:08:59 samba winbind[2132]: * Starting the Winbind daemon winbind
Apr 24 18:08:59 samba winbind[2132]: ...done.
Apr 24 18:08:59 samba winbindd[2147]: [2018/04/24 18:08:59.795374, 0] ../source3/winbindd/winbindd_cache.c:3245(initialize_winbindd_cache)
Apr 24 18:08:59 samba winbindd[2147]: initialize_winbindd_cache: clearing cache and re-creating with version number 2
Apr 24 18:08:59 samba systemd[1]: Started LSB: start Winbind daemon.
Apr 24 18:08:59 samba winbindd[2147]: [2018/04/24 18:08:59.798362, 0] ../lib/util/become_daemon.c:124(daemon_ready)
Apr 24 18:08:59 samba winbindd[2147]: STATUS=daemon 'winbindd' finished starting up and ready to serve connections
/etc/samba/smb.conf
[global]
realm = SHORTNAME.TLD
workgroup = LONGNAME
idmap config * : backend = tdb
idmap config * : range = 1000-9999
idmap config MICROCONSULT : backend = nss
idmap config MICROCONSULT : range = 10000-19999
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 300
winbind expand groups = 5
winbind max domain connections = 10
template homedir = /dev/null
client use spnego = yes
client ntlmv2 auth = yes
restrict anonymous = 2
acl group control = yes
inherit acls = yes
inherit owner = yes
inherit permissions = yes
vfs objects = acl_xattr
deadtime = 15
admin users = "@LONGNAME\\linuxadminsgroup"
store dos attributes = yes
null passwords = yes
domain master = no
local master = no
preferred master = no
os level = 0
server string = %h server (Samba, Ubuntu)
wins server = 172.17.*** 172.17.***
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = member server
passdb backend = tdbsam
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccess fully* .
pam password change = yes
map to guest = bad user
#======================= Share Definitions =======================
[ShareOne]
path = /smbshare/ShareOne
valid users = somelocaluser, @LONGNAME\\linuxwriter
create mask = 570
directory mask = 570
writeable = no
write list = @LONGNAME\\linuxwriter
[ShareTwo]
path = /smbshare/ShareTwo
valid users = somelocaluser, @LONGNAME\\linuxwriter
create mask = 770
directory mask = 770
writeable = yes