LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 11-29-2008, 11:59 PM   #1
lqkums
LQ Newbie
 
Registered: Nov 2008
Posts: 2

Rep: Reputation: 0
Getting Samba to authenticate against Active Directory


Hi,

Iam trying to setup Samba version 3.2.3 on Redhat (RHEL5) server to use Active Directory for authentication. I followed the instructions from article in following website:
http://technet.microsoft.com/en-au/m.../dd228986.aspx

Setup Winbind + Samba + Kerberos and it seems to work fine. I can see the users in Active Directory through winbind as well as authenticate users using NTLM authentication.

Problem is that Iam unable to access Samba share from Windows clients as AD user. Analyzing the network traffic on SMBD port gives:
---
10.849969 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: TESTDOMAIN\testuser
10.853302 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, Error:STATUS_LOGON_FAILURE
--

I can however access the Samba share as local user in the Samba server via smbpasswd:
---
166.059746 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: D1950-01\kums
166.068297 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
166.068500 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\global
166.068787 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
---

Winbind gives following error, not sure if this is significant for I can access the AD via "wbinfo"
[2008/11/26 15:22:58, 1] libsmb/cliconnect.c:cli_session_setup_kerberos(626)
cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: Cannot find KDC for requested realm

Googling helped me to get so far, but not completely resolve this issue.

Please find the configuration setting + detailed error log below:

----
i) Software Version
samba-client-3.2.3
samba-common-3.2.3
samba-3.2.3
samba-doc-3.2.3
samba-winbind-32bit-3.2.3
samba-swat-3.2.3
samba-debuginfo-3.2.3

krb5-workstation-1.5-17
krb5-libs-1.5-17
krb5-devel-1.5-17
krb5-auth-dialog-0.7-1
pam_krb5-2.2.11-1
krb5-devel-1.5-17
krb5-libs-1.5-17
pam_krb5-2.2.11-1

ii) Configure Kerberos
cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = TESTDOMAIN.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
TESTDOMAIN.LOCAL = {
kdc = 172.16.4.10
default_domain = TESTDOMAIN.LOCAL
}

[domain_realm]
.testdomain = TESTDOMAIN.LOCAL
testdomain = TESTDOMAIN.LOCAL
.localdomain = TESTDOMAIN.LOCAL
localdomain = TESTDOMAIN.LOCAL
sol.datadirectnet.com = TESTDOMAIN.LOCAL
testdomain.local = TESTDOMAIN.LOCAL
.testdomain.local = TESTDOMAIN.LOCAL

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

iii) Authenticate a user against AD via Kerberos
kinit Administrator@TESTDOMAIN.LOCAL
Password for Administrator@TESTDOMAIN.LOCAL:

iv) List Kerberos Tickets
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@TESTDOMAIN.LOCAL

Valid starting Expires Service principal
11/26/08 14:54:36 11/27/08 00:54:39 krbtgt/TESTDOMAIN.LOCAL@TESTDOMAIN.LOCAL
renew until 11/27/08 14:54:36


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached


v) Configure WinBind +PAM

/etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind

cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so

account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_winbind.so
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session optional pam_mkhomedir.so skel=/etc/skel umask=0644
session required pam_unix.so

vi) Windbind started and can see users in AD
/etc/init.d/winbind status
winbindd (pid 14574 14562 14561 14459 14458) is running...

wbinfo -t
checking the trust secret via RPC calls succeeded

wbinfo -u list
D1950-01+kums
D1950-01+tristan
TESTDOMAIN+administrator
TESTDOMAIN+guest
TESTDOMAIN+krbtgt
TESTDOMAIN+testuser

wbinfo -g
TESTDOMAIN+domain computers
TESTDOMAIN+domain controllers
TESTDOMAIN+schema admins
TESTDOMAIN+enterprise admins
TESTDOMAIN+cert publishers
TESTDOMAIN+domain admins
TESTDOMAIN+domain users

wbinfo -a TESTDOMAIN+testuser%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

vii) Modify /etc/pam.d/samba
/etc/pam.d/samba
auth required pam_stack.so service=system-auth
auth required pam_env.so
auth sufficient pam_krb5 use_first_pass
auth include /lib/security/pam_winbind.so
auth required pam_deny.so

session required pam_stack.so service=system-auth

account required pam_stack.so service=system-auth
account include /lib/security/pam_winbind.so

password required pam_stack.so service=system-auth


viii) Configure smb.conf
[global]
workgroup = TESTDOMAIN
realm = TESTDOMAIN.LOCAL
security = ADS
password server = 172.16.4.10
client NTLMv2 auth = Yes
log file = /var/log/samba/log.%m
max log size = 50
smb ports = 445
use mmap = No
dns proxy = No
socket address = 192.168.97.5
idmap backend = ad
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind separator = +
winbind enum users = Yes
winbind enum groups = Yes
nfs4:acedup = merge
nfs4:chown = yes
nfs4:mode = special
force unknown acl user = Yes

[global-share]
path = /mnt/global
read only = No
inherit permissions = Yes
inherit acls = Yes

ix) Samba running
/etc/init.d/smb status
smbd (pid 32010 32006) is running...
nmbd (pid 31998) is running...

lsof -i TCP:445
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
winbindd 31799 root 17u IPv4 8034872 TCP D1950-01.sol.datadirectnet.com:57534->172.16.4.10:microsoft-ds (ESTABLISHED)
winbindd 31800 root 17u IPv4 8034855 TCP D1950-01.sol.datadirectnet.com:57532->172.16.4.10:microsoft-ds (ESTABLISHED)
smbd 32006 root 19u IPv4 8035491 TCP node1:microsoft-ds (LISTEN)


x) Join to AD is successful
net ads testjoin
Join is OK

xi) Authentication of AD user seems to work fine
ntlm_auth --request-nt-key --domain=TESTDOMAIN --username=testuser
password:
NT_STATUS_OK: Success (0x0)


xii) /etc/init.d/iptables status
Firewall is stopped.

xiii)Analyze Network Traffic on SMBD port

Login as TESTDOMAIN\testuser (in Windows System)

10.844796 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
10.844932 192.168.97.2 -> 192.168.97.5 SMB Trans2 Request, GET_DFS_REFERRAL, File: \192.168.97.5\global-share
10.844993 192.168.97.5 -> 192.168.97.2 SMB Trans2 Response, GET_DFS_REFERRAL, Error: STATUS_NOT_FOUND
10.849712 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
10.849800 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
10.849969 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: TESTDOMAIN\testuser
10.853302 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, Error: STATUS_LOGON_FAILURE
11.033663 192.168.97.2 -> 192.168.97.5 TCP capmux > microsoft-ds [ACK] Seq=1616 Ack=1172 Win=15213 Len=0
20.944057 192.168.97.2 -> 192.168.97.5 SMB Logoff AndX Request
20.944152 192.168.97.5 -> 192.168.97.2 SMB Logoff AndX Response
20.944231 192.168.97.2 -> 192.168.97.5 SMB Tree Disconnect Request
20.944360 192.168.97.5 -> 192.168.97.2 SMB Tree Disconnect Response

Login as D1950-01\kums (in Windows System)

163.625577 192.168.97.2 -> 192.168.97.5 TCP 4746 > microsoft-ds [ACK] Seq=1024 Ack=855 Win=15530 Len=0
166.059399 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
166.059551 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
166.059746 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: D1950-01\kums
166.068297 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
166.068500 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\global-share
166.068787 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response


xiv) Winbind Error
[2008/11/26 15:22:58, 1] libsmb/clikrb5.c:ads_krb5_mk_req(680)
ads_krb5_mk_req: krb5_get_credentials failed for dc$@TESTDOMAIN (Cannot find KDC for requested realm)
[2008/11/26 15:22:58, 1] libsmb/cliconnect.c:cli_session_setup_kerberos(626)
cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: Cannot find KDC for requested realm


----

Thanks in Advance,
-Kums
 
Old 02-19-2009, 01:52 AM   #2
fngreno
LQ Newbie
 
Registered: Dec 2008
Distribution: CentOS
Posts: 3

Rep: Reputation: 0
I just discovered Likewise - after watching the last of my hair fall out after tweaking winbindd for another distro. I have used successfully on FC, CentOs and Ubuntu.

I want my hair back winbindd
 
Old 02-19-2009, 07:33 AM   #3
farslayer
Guru
 
Registered: Oct 2005
Location: Willoughby, Ohio
Distribution: linuxdebian
Posts: 7,228
Blog Entries: 5

Rep: Reputation: 189Reputation: 189
The OP may not realize that you are telling him that Likewise Open may help him authenticate against AD.. you might want to include a link next time.

OP's post was back in November,. I sure hope he got it all sorted out before now..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Authenticate Active Directory with Mandrake 10.1? johnson8707 Mandriva 2 10-29-2008 07:18 AM
Using Active Directory to authenticate Apache users kenneho Linux - Server 4 09-10-2008 06:24 AM
Does anyone here authenticate against Active Directory? humbletech99 Linux - Security 6 04-25-2008 10:49 AM
SQUID Authenticate from Windows Active Directory mhm Linux - Server 0 04-05-2008 09:38 AM
apache authenticate to Active Directory zuessh Linux - Software 1 07-08-2005 03:29 PM


All times are GMT -5. The time now is 05:09 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration