LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-23-2015, 08:35 PM   #1
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Rep: Reputation: Disabled
Centos 6.6 and Samba 3 - Can't get Domain User to login


Hi All

I have been racking my brains for the past 15 hours or so trying to know why my AD users can't actually login to the share which i have assigned.

This is my smb.conf below:

Quote:
[global]
workgroup = EXAMPLE
security = ads
realm = EXAMPLE.GROUP
domain master = no
local master = no
preferred master = no
printcap name = /etc/printcap
load printers = no
idmap backend = tdb
idmap uid = 10000-99999
idmap gid = 10000-99999
idmap config EXAMPLE:backend = rid
idmap config EXAMPLE:range = 10000-9999
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
template homedir = /home/%D/%U
template shell = /bin/false
client use spnego = yes
client ntlmv2 auth = yes
encrypt passwords = yes
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 2
valid users = any
[Research]
comment = Research
path = /sharing/research
valid users = EXAMPLE\user1
force group = "domain users"
writable = yes
read only = no
force create mode = 0660
create mask = 0777
directory mask = 0777
force directory mode = 0770
access based share enum = yes
hide unreadable = yes
[Admin]
comment = Admin Area
path = /var/www/html/cmsmadesimple
browseable = yes
writable = yes
read only = no
inherit acls = yes
inherit permissions = yes
create mask = 700
directory mask = 700
valid users = user1
When i do wbinfo -u or wbinfo -g i can see the usernames and groups in my AD.

Also when i do : id username it actually gives me the information for that user in my domain.

I have done net ads login -U and joined the domain.

I have set the pam auth modifications and the krb5 and nsswitch.conf files.

So i do not get why i can't have the user i have assigned to that share access it?

I can only imagine i have something wrong in my smb.conf?

Please any helps would be appreciated.

Thanks
 
Old 05-23-2015, 08:40 PM   #2
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,412

Rep: Reputation: Disabled
When you say "log in to the share", are you talking about browsing the share in Windows Explorer?

Are you logged in to the Windows workstation as "user1"?

What are the actual permissions on /var/www/html/cmsmadesimple?

Edit: Have you tried changing "valid users = user1" to "valid users = EXAMPLE\user1" on the Admin share?

Also, unless a line got truncated, your idmap range setting is invalid.

Last edited by Ser Olmy; 05-23-2015 at 08:44 PM.
 
Old 05-23-2015, 08:46 PM   #3
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
When i say login yeah i mean actually set a UNC path or map that share to the Windows PC. I am logged in as "user1". Permissions of /var/www/html/cmsmadesimple are 777.

I have tried access the Research Folder also and tried changing the grp to "domain users" along with doing chmod 777 but it still comes up asking for login details and when i enter them it says they are wrong - which i know they are not.

Thanks
 
Old 05-23-2015, 08:52 PM   #4
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Edit: Have you tried changing "valid users = user1" to "valid users = EXAMPLE\user1" on the Admin share?
Yes I have. I tried with EXAMPLE\user1 and just user1 as i thought because i have "winbind use default domain = yes" set it might ignore the EXAMPLE ? as when i say "id user1" on the CLI it comes up with the details instead of having to actually enter EXAMPLE+user1.

I have also tried Removing the idmap option as it is apparently depreciated still with no luck.
 
Old 05-23-2015, 09:04 PM   #5
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,412

Rep: Reputation: Disabled
You do need an idmap range option. Samba will default to using tdb if you don't specify an idmap backend, but you always have to specify a valid range. "10000 - 9999" is invalid, as the last number must always be greater than the first.

When I asked about permissions I was primarily thinking of ownership, but 777 should make that irrelevant.

When you run id user1, does it map to a valid Unix ID or do you get something like 4,294,967,295?
 
Old 05-23-2015, 09:09 PM   #6
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
Thanks for clearing that up

When i do id user1 it lists all of the groups that user is associated with within AD. I'm wondering do i have to map an AD member group to a linux user or something?

modified and shortened example:

[root@ROM samba]# id user1
uid=10000(user1) gid=10000(domain users) groups=10000(domain users)
 
Old 05-23-2015, 09:26 PM   #7
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,412

Rep: Reputation: Disabled
Quote:
Originally Posted by yx0p View Post
When i do id user1 it lists all of the groups that user is associated with within AD. I'm wondering do i have to map an AD member group to a linux user or something?
That's exactly what the idmap function does, and is why you get a Unix User ID when you run the id command on an AD user:

Quote:
Originally Posted by yx0p View Post
[root@ROM samba]# id user1
uid=10000(user1) gid=10000(domain users) groups=10000(domain users)
This is proof of a working idmap configuration. It also proves that the "winbind use default domain" option is active, as you didn't have to type id EXAMPLE\\user1 to obtain the Unix ID of a user from the AD domain.

You should try changing the owner of a file to be a domain user, just to verify that both nsswitch and PAM are indeed working properly:
Code:
# touch somefile
# chown EXAMPLE\\user1 somefile
# ls -l somefile
If the result is a file owned by the domain user "user1", all is well.

I looked through your smb.conf once more, and noticed the "valid users = any" setting. I can't remember having seen any references to "any" as a valid parameter on the Samba Wiki pages. Have you tried commenting out that setting?

It's often a good idea to start off with a bare minimum of settings, and then add the required settings one by one to see if anything breaks. For instance, the "client", "encrypt passwords" and "restrict anonymous" settings should be superfluous, so you could try commenting out those as well.

Do the settings reported by testparm match your intended settings in smb.conf?
 
Old 05-23-2015, 09:36 PM   #8
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
I have tried commenting the "any" part out and also the "client" and "restrict anonymous" but still not letting me in.
Quote:
[root@ROM samba]# testparm
Load smb config files from /etc/samba/smb.conf
WARNING: The "idmap uid" option is deprecated
WARNING: The "idmap gid" option is deprecated
Processing section "[Research]"
Processing section "[Admin]"
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
Press enter to see a dump of your service definitions
All seems ok when trying testparm?


When touching the file and chowning it - it did work and the ownership changed to that user although i didn't have to put EXAMPLE just chown user1

Quote:
-rw-r--r-- 1 user1 root 0 May 24 02:33 somefile
I really do not get why i can't login - i stumped lol.

NOTE: I can actually login via SSH to the linux box with my AD username and password and get a bash prompt, i just can't login to the shares of samba.

I have also tried the following:
Quote:
[root@ROM cmsmadesimple]# net groupmap list
Administrators (S-1-5-32-544) -> BUILTIN\administrators
Domain Users (S-1-5-21-3899014848-4164311632-4153544244-513) -> CMSUSERS
Users (S-1-5-32-545) -> BUILTIN\users
[root@ROM cmsmadesimple]#
CMSUSERS is the local group with access to the cmasmadesimple directory. When adding the Domain Users to link to CMSUSERS i thought this would work? Not sure if this is something else?

Thanks for the help so far!

Last edited by yx0p; 05-23-2015 at 09:48 PM.
 
Old 05-23-2015, 09:48 PM   #9
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,412

Rep: Reputation: Disabled
You don't by any chance have a local Linux user called "user1" as well? (cat /etc/passwd | grep user1) If you do try to specify the domain name (chown EXAMPLE\\user1 somefile), does it still work?

Here's a minimal smb.conf, you could try that and see if it works:
Code:
[global]
workgroup = EXAMPLE
security = ads
realm = EXAMPLE.GROUP
idmap uid = 10000-99999
idmap gid = 10000-99999
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind nested groups = yes
template homedir = /home/%D/%U
log file = /var/log/samba/samba.log

[Research]
comment = Research
path = /sharing/research
valid users = EXAMPLE\user1
force group = "domain users"
writable = yes
read only = no
force create mode = 0660
create mask = 0777
directory mask = 0777
force directory mode = 0770
access based share enum = yes
hide unreadable = yes

[Admin]
comment = Admin Area
path = /var/www/html/cmsmadesimple
valid users = EXAMPLE\user1
browseable = yes
writable = yes
read only = no
inherit acls = yes
inherit permissions = yes
create mask = 700
directory mask = 700
Open a terminal and have tail -f /var/log/samba/samba.log running while you try to access a shared folder. Perhaps that will provide some clues.
 
Old 05-23-2015, 10:01 PM   #10
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
This does actually work! haha i don't believe it!

I changed it to this:
Quote:
[Admin]
comment = Admin Area
path = /var/www/html/cmsmadesimple
browseable = yes
writable = yes
force group = "domain users"
read only = no
inherit acls = yes
inherit permissions = yes
create mask = 700
directory mask = 700
valid users = EXAMPLE\user1
and i can login with my username now. Thanks!

May i ask is there a way i can associate "domin users" AD group with a local group?

Nevermind! my net groupmap has worked - i tried to create a file and it showed the following:
Quote:
-rwxrw-rw- 1 user1 CMSUSERS 0 May 24 03:03 TestFile1.txt

Thanks very much for your help!!

Last edited by yx0p; 05-23-2015 at 10:05 PM.
 
Old 05-24-2015, 04:46 AM   #11
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
I do have one other query please:

When allowing people to access the share it allows them and i can write to that share but if i go into a directory further into that share it will not allow me to write. I also keep seeing this too:

DENY_WRITE 0x20196 WRONLY EXCLUSIVE+BATCH

Any helps with this would be great.

Thanks
 
Old 05-25-2015, 01:21 PM   #12
yx0p
LQ Newbie
 
Registered: Feb 2015
Posts: 14

Original Poster
Rep: Reputation: Disabled
For anyone having the same issue i set this in the smb.conf:

Quote:
oplocks = false
level2 oplocks = false
As for the sub folder issue i just added force group = "users" to the share and bingo i had write access.

The permissions of the linux box for the group was different, as the user i was logging in with was part of "domain users"

Thanks
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
CentOS Unable to add Domain user to linux group using PBIS-Open and Samba. banshii Linux - Server 2 11-13-2014 11:54 AM
Ubuntu/AD/KRB5/LDAP/NIS able to use domain user login with putty, unable in gui login Nitroglycerine Linux - Server 0 06-28-2012 05:17 AM
Joined Domain, can't login as domain user mikeyt_333 Linux - Networking 12 08-26-2005 09:25 AM
winbind + samba + gdm unable to login with Domain user theowl Linux - Networking 1 06-11-2004 09:30 AM
Samba Domain Login ..Tookers.. Linux - Networking 6 12-10-2002 04:12 PM


All times are GMT -5. The time now is 10:13 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration