LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 02-10-2004, 06:44 AM   #1
loaf
LQ Newbie
 
Registered: Feb 2004
Posts: 3

Rep: Reputation: 0
Angry Samba, Pam, winbind and ADS


Greetings all - I have a frustrating issue which has stumped me. I'd appreciate a few wise suggestions!

I am running Debian (2.4.18-386) with Samba 3.0.2-1, winbind (3.0.2-1) and using PAM authentication against an ADS Win2003 domain. I'm only really using that authentication with Apache (1.3.29.0.1-5) so the users (we're a Windows shop) can use their normal network login to authenticate against my web-server.

So, all is sweetness and light and it works well. Trouble is, this morning I run my normal update/upgrade command (apt-get update ; apt-get dist-upgrade) and it updates Samba and winbind. And now the authentication is bust. The smb.conf file is unchanged. But something else must have happened.

But not completely broken.

I can still mount Windows shares (and see my machine in the Windows network neighbourhood, although not access any of its shares from a Windows box). I can still authenticate using Kerberos (kinit user succeeds, although winbind -a user fails). I can join the realm ok (net ads join).

But wbinfo -u (or -g) returns Error looking up domain users.

A similar issue happened a few weeks ago, with similar footprints. After three days of tweaking it suddenly worked for no obvious reason. (The tweaks seemed to have no effect - I'd left the tweaking for an hour or so and someone reported a successful login attempt.)

So I'm wondering if it's not my machine, it's perhaps something on the ADS server which doesn't like the fact that my Samba/Winbind has been updated and needs to be told. Perhaps it does update itself every once in a while (which is why, before, it 'suddenly' started working out of the blue) but I'd like to be able to tell it explicitly to do it.

Any ideas or suggestions? I'm happy to post logs and conf files as necessary!
 
Old 02-10-2004, 06:16 PM   #2
kylep675
LQ Newbie
 
Registered: Feb 2004
Posts: 2

Rep: Reputation: 0
Try deleting the computer account in AD and rejoin the domain.
 
Old 02-11-2004, 07:19 AM   #3
loaf
LQ Newbie
 
Registered: Feb 2004
Posts: 3

Original Poster
Rep: Reputation: 0
Thanks.

Yes, I did that. Both the sys admin deleting it from the Windows side and I ran net ads leave.

Interestingly net ads user -U user%password succeeds in giving back a list of valid network users, but wbinfo -u, which should do the same, fails with Error looking up domain users

Can I configure Apache to use the ADS rather than winbind? Or I am totally confused?


cheers!
 
Old 02-11-2004, 11:03 AM   #4
kylep675
LQ Newbie
 
Registered: Feb 2004
Posts: 2

Rep: Reputation: 0
There is some info on Apache authentication with ads at this like that might be useful...

http://www.wlug.org.nz/ActiveDirecto...nticationNotes

Let me know if this helps.

good luck!

Kyle
 
Old 02-12-2004, 11:06 AM   #5
loaf
LQ Newbie
 
Registered: Feb 2004
Posts: 3

Original Poster
Rep: Reputation: 0
And, all of its own accord, it suddenly started working again.

I'm not sure if it was connected, but I'd just run wbinfo -D workground_name which seemed to hang, but I went to do something else, forgetting that is was hanging.

Only it wasn't. Eventually it came back with correct answers, at which point, wbinfo -u|g worked and the authentication was back, too.

I don't know if that was all coincidence, that the wbinfo -D was a cause of the fix or just the first thing to happen once it fixed itself.

I am still suspicious that the apt-get upgrade changed something which, eventually, got reset.


So, any easy ways of getting apt-get to update everything apart from a specific list of exceptions?

cheers!
 
Old 08-17-2004, 08:46 PM   #6
DragonHawk
LQ Newbie
 
Registered: Aug 2004
Posts: 1

Rep: Reputation: 0
Quote:
Originally posted by loaf

I'm not sure if it was connected, but I'd just run wbinfo -D workground_name which seemed to hang, but I went to do something else, forgetting that is was hanging. Only it wasn't. Eventually it came back with correct answers, at which point, wbinfo -u|g worked and the authentication was back, too.
Wow. Weird. I was trying to get Samba and winbind working for Squid today. Most wbinfo tests seemed fine, but "wbinfo -u" and "wbinfo -g" kept giving that "Error looking up domain users" (or groups) error. I found your post, and tried running "wbinfo -D domain_name", just to see if it made a difference. While it did not hang on my system (returned info immediately), after that, "wbinfo -u" and "wbinfo -g" started working. So whatever's going on, that "-D" switch seems to help unwedge things somehow.

Magic.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
winbind + ADS + PAM paul_mat Linux - Networking 2 08-26-2005 01:02 AM
Problem with Winbind+PAM zcorpio Linux - Networking 1 06-25-2004 08:53 PM
Qpopper not getting email (using PAM/Samba Winbind Auth) Josh_T_2 Linux - Networking 8 12-19-2003 01:52 PM
Cyrus/Winbind/Pam taggedd Linux - Software 0 10-27-2003 08:28 AM
Slackware, Samba, Winbind & PAM; Oh My! BulletSponge Slackware 3 06-20-2003 06:01 PM


All times are GMT -5. The time now is 03:54 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration