LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 01-13-2013, 04:31 PM   #1
jmusbach
LQ Newbie
 
Registered: Oct 2012
Posts: 4

Rep: Reputation: Disabled
Question Active Directory with pam_krb5 getpwnam failed for <user>


Hello, I'm trying to get my Linux box bound with kerberos... For my /etc/krb5.conf I have:

Code:
DOMAIN = {
  kdc = kdc-server.domain.com
  admin_server = kdc-server.domain.com
  default_domain = DOMAIN
}
In the "[realms]" section. Under "[domain_realm]" I have:

Code:
.domain.com = KDC-SERVER.DOMAIN.COM
domain.com = KDC-SERVER.DOMAIN.COM
Then in /etc/samba/smb.conf I have:

Code:
workgroup = DOMAIN
netbios name = DEB
security = ads
realm = DOMAIN
password server = KDC-SERVER.DOMAIN.COM
template homedir = /home/%D/%U
template shell = /bin/bash
winbind separator=+
winbnd use default domain=Yes
idmap_rid:DOMAIN=10000-100000
idmap uid=10000-20000
idmap gid=10000-20000
My /etc/nsswitch.conf contains:

Code:
passwd: compat winbind
group: compat winbind
shadow: compat winbind
When I do "kinit Administrator@DOMAIN.COM" it works ok as well as the "net ads join -U Administrator" command. However login fails as shown below (excerpt from /var/log/auth.log -- running Debian):

Code:
(login:auth): user Administrator authenticated as Administrator@DOMAIN
pam_env(login:session): No such user!?
pam_env(login:session): No such user!?
pam_mkhomedir(login:session): User unknown.
pam_krb5(login:session): (user Administrator) getpwnam failed for Administrator
pam_unix(login:session): session opened for user Administrator by LOGIN(uid=0)
User not known to the underlying authentication module
What can cause getpwnam to fail? Thanks for your help.

Last edited by jmusbach; 01-13-2013 at 09:48 PM.
 
Old 01-13-2013, 08:47 PM   #2
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
I don't have a kerberos client handy but your "[domain_realm]" section may be wrong, from memory I think it should be:

Code:
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
.. you might want to check the man page - 'man 5 krb5.conf'.

I'm not sure what distro you're running but when configuring authentication by hand it can be tricky to get everything right, I'd recommend using the 'authconfig' command if available or a graphical tool.
 
Old 01-13-2013, 08:59 PM   #3
jmusbach
LQ Newbie
 
Registered: Oct 2012
Posts: 4

Original Poster
Rep: Reputation: Disabled
Hmm I'll try that thanks, I'm running Debian 6 btw. Any other thoughts on what could possibly be wrong?
 
Old 01-13-2013, 09:25 PM   #4
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
Sorry, I'm not a fan of Samba .. I usually go with kerberos/ldap/sssd combo. Maybe have a read here and see if you missed anything .. p.s. you missed scrubbing a domain name in smb.conf
 
Old 01-15-2013, 12:39 AM   #5
jmusbach
LQ Newbie
 
Registered: Oct 2012
Posts: 4

Original Poster
Rep: Reputation: Disabled
Thanks for your help, I tried making that change in krb5.conf and nothing changed. I checked my pam.d conf files and those seem ok too. I guess I'll try compiling pam_krb5 from the latest source tarball to see if the binary deb is foobar somehow. Can't hurt eh?
 
Old 01-15-2013, 02:06 AM   #6
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
I'd find it highly unlikely .. chances are about %99.99 the config is wrong somewhere, it's just a matter of finding where
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Migrating User Profiles From MS Active Directory walidch Linux - Server 1 01-28-2011 03:23 AM
Active Directory Authentication FC12 New user logins jgoodyear Linux - Security 0 03-11-2010 07:59 AM
Active Directory User Cannot Write to Samba Home Directory jonwatson Linux - Networking 2 12-19-2006 12:40 PM
/home rights for Active Directory user? cwhitmore Linux - Security 1 09-22-2006 12:57 PM
Linux User from Active directory wincrk Linux - Networking 2 05-15-2006 11:13 PM


All times are GMT -5. The time now is 08:05 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration