LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-17-2003, 06:53 AM   #1
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Rep: Reputation: 30
Samba authentication in W2k Domain


I would like users that are authenticated through the Windows 2000 Domain Controller here at work to connect to my gentoo samba box. I've set the 'security = server' and 'password server = WIN2000SERVER', but authenticated users still cannot connect to my samba box. Is there something I've missed? Do I need to do something to the smbpasswd file?

I've also tried the 'security = domain' 'password server = *' with the same results.
 
Old 02-17-2003, 03:59 PM   #2
jmarsh
Member
 
Registered: Dec 2002
Posts: 129

Rep: Reputation: 15
i would check to make sure you have encrypted passwords = yes. win2k needs passwords to be encrypted in order to connect to a samba machine.
 
Old 02-17-2003, 04:12 PM   #3
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
that is done already
 
Old 02-17-2003, 09:25 PM   #4
jamrock
Member
 
Registered: Jan 2003
Location: Kingston, Jamaica
Posts: 444

Rep: Reputation: 41
You can try one of these options.

Add all the users to the Linux passwd file.

Let Samba add the users to the passwd file.


To do the latter try this. The text comes from another post. Modify the script to fit the commands of your distro.


security = domain
password server = xxxxxx

These settings tell Samba to let the domain controller do the authentication. It will ignore the smbpasswd file and accept the password that has been authenticated by the domain conroller (password server).

The only catch here is that the user still needs to exist in the (Linux) passwd file.


There is also a way to automatically add the user to the passwd file if he doesn't exist on the Linux machine but is authenticated by the domain controller. The command needs to be entered under the global section of the smb.conf file.

add user script = useradd %u -c "Account from PDC" -s /bin/false -d /home/%u -m -n -g finance

This says to Samba:

add the user and use the username sent by the domain controller
useradd %u

the user comment is "Account from PDC"
- c "Account from PDC"

don't allow the user to log on locally (i.e. from the samba machine)
-s /bin/false

create a home directory under /home and call it the name of the user
-d /home/%u -m

add the user to the group finance
-n -g finance.

I got the script from the November 2002 edition of SysAdmin magazine in an article written by Arnie Miles. I haven't worked through all the security implications of letting Samba automatically adding users to the Linux machine.
 
Old 02-18-2003, 08:14 AM   #5
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
I did as you suggested, but I still cannot access my Samba box with users that have not been added with the 'smbpasswd -a' command line. How do I execute that script? Can I write a script to add all users that are in the domain to the passwd file? I very likely can obtain a text file containing all users and their passwords. Is this a possible plan?
 
Old 02-18-2003, 08:29 AM   #6
biggiefatts
Member
 
Registered: May 2002
Location: Buffalo, NY
Distribution: Mandrake 9.0, Red Hat 8.0
Posts: 60

Rep: Reputation: 15
If you place the above mentioned script into your smb.conf file and restart the daemon, Samba will add the users as they attempt to connect to the server.

Last edited by biggiefatts; 02-18-2003 at 08:32 AM.
 
Old 02-18-2003, 08:39 AM   #7
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
I did do that, but nogo. As I connected from Win98 machines (eventually I will be connecting with Win2k/XP boxes, also), I still got a prompt asking for the $IPC password. Entering the user's password form the domain did not go through. Would doing 'security = server' 'server = xxxxx' work instead of domain?
 
Old 02-18-2003, 08:55 AM   #8
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
Talking

got it, whoot! I changed the security to server, and found that the '-n' option was bad (in my distro - Slackware). Once I corrected those two things, we're up and running! This is terrific! Thanks guys!!!!

Last edited by ixion; 02-18-2003 at 08:56 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
W2K Domain Authentication burnt_toast Linux - Networking 2 09-25-2004 04:55 PM
Move w2k Member of Samba Domain to DMZ ollitronix Linux - Networking 2 07-19-2004 02:16 AM
Samba and w2k domain users ymichy Linux - Networking 0 09-15-2003 07:32 AM
squid Authentication and W2K Domain aqoliveira Linux - Networking 0 11-22-2002 12:33 PM
Samba: W2k clients cannot login after joining domain Ajentsmith Linux - Networking 2 09-04-2002 12:29 PM


All times are GMT -5. The time now is 04:45 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration