Joined Domain, can't login as domain user
Hi everybody, it's been a while since I lasted posted here, unfortunately. I got a new job that puts me more in the windows world than I might have liked, but it pays the bills and provides great experience, so I'll suck it up. Because I am in this windows shops, however, I figured it was prime real estate for figuring out how I can get Linux to operate seemlessly within its walls. I've managed to configure Samba, winbind, and kerberos. A kinit [user]@DOMAIN works fine, a Samba net ads join starts off okay, and then says some shpeel about "found glibc" and goes into a memory dump, but after that, when I try a wbinfo -u or -g, it spits back the correct information, so I figure it's still working okay. My next step was to create a local user which mirrors my domain user, minus password. When I attempt to login with this account, it fails, and my logs spit back the NT_NO_SUCH_USER or something along those lines. When I query ADS in my windows box, as the domain admin, my linux box shows up as a Domain Controller, which I'd like to change some how. Does anybody have any suggestions why everything would work except for user authentication, and why would my linux box show up as a domain controller when it should be a workstation? I've googled, and followed the docs to the T. Also, can anybody recommend some good ADS managment tools, command line is preferred. I am removing and adding users/computers to the domain on a daily basis and need this functionality if I'm to switch to Linux. Thanks in advance!
Mike. |
Mikey,
I'm no pro, but when I added 2 new Linux boxes to my network and had to force them to talk to the Windows monster, I added Samba, Kerberos and the likes...but nothing worked until WINS was enabled and RUNNING on the monster box. For some reason Samba likes the WINS protocol. Can't hurt to try it. As for your DC problem, thats strange...but if your windows box is listed as a Backup Domain Controller you should be able to promote it to DC after taking the Linux box down for a minute. I get eventvwr logs all the time that say my Linux boxes are fighting over control, but they don't win. Hope this helps a bit or at least causes you to have your own brain-snap! |
If you're using AD to authenticate users, why do you need to create user on the local Linux machine?
Anyways, did you make the necessary changes in the following files? smb.conf nsswitch.conf krb5.conf pam_unix2.conf PAM configuration files for login, xdm (KDE login) or gdm (Gnome login) |
Thanks for the replies guys!
I don't think it has to do with WINS, I am able to resolve things okay, the issue relates to my PDC responding with a NT_NO_SUCH_USER or some such error. This box is only a workstation, and as such should be added under that role, regardless of how it actually works on the network, is there something in smb.conf that deligates what it should join as? I know I have edited the following files, and can post them if needed: smb.conf krb5.conf /etc/pam.d/login I'm not certain about nsswitch.conf, I'm not in linux at the moment so I can't tell. I read somewhere that adding a local user is necessary, even when authenticating via AD, truthfully, it didn't make sense to me either, but I was trying anything. Also, having a local user will allow me to login when the PDC is inaccessable. Thanks again for the replies, I will post errors, and conf files in a bit. |
Updates
Okay, here are my configs:
smb.conf: Code:
[global] Code:
passwd: compat winbind Code:
[logging] Code:
kinit -U [USERNAME]@[MY.DOMAIN.CONTROLLER] Code:
#%PAM-1.0 Code:
[root@hostname etc]# net ads join -U [USERNAME] And finally, here's the actual error in my /var/log/messages: Code:
Aug 16 16:23:16 [HOSTNAME] pam_winbind[2464]: request failed: No such user, PAM error was 10, NT error was NT_STATUS_NO_SUCH_USER Mike. |
I just found this in my /var/log/samba/winbindd.log:
Code:
[2005/08/16 17:19:51, 3] nsswitch/winbindd_pam.c:winbindd_pam_auth(259) And, when I do: getent passwd I can grep for my domain user: Code:
[root@[HOST] samba]# getent passwd | grep [USERNAME] |
k, some progress! When I did getent passwd I noticed that the format of each user was:
[DOMAIN]\[USERNAME] So, I tried logging in with that format, and it worked, but I didn't have the perms to create the users directory so I'm working on that now. |
WOOHOO! I got it! When I finally for getent passwd printing the correct information, I tried logging in, and the screen simply flashed. This was because somewhere, the default user directory for new users was /home/[DOMAIN/[USERNAME]. The user didn't have permissions to create /home/[DOMAIN], so, creating it as root allowed the user permissions to create their user directory in /home/[DOMAIN]. This got me access to the console. Then, I couldn't log into X-windows. This was because my /etc/pam.d/gdm didn't reflect the same changes in /etc/pam.d/login. By making my /etc/pam.d/gdm the following:
Code:
#%PAM-1.0 |
Just as a note, you always have to login from the Linux machine using the DOMAIN\username format because Windows has to know which domain the user belongs to. The reason we don't do this in Windows is because it has a Domain field on the login box that specifies the domain to which we're logging in.
|
gotcha. Any ideas why ntlm wouldn't function properly, and is there a way to make it so a domain user can log on when the system isn't connected to the domain? Thanks!
|
I can only think that you would need the Name Service Caching Daemon (nscd) running to cache previous logins if you want users to login when not connected to the domain. I haven't tested this myself as many people stated nscd should be turned off when using Samba authentication to AD. I don't remember why though
|
linux logon to domain problem
Hi,
I am very new to linux system. What i am trying to do now is to set up a server that is similar to windows server. My situation is as following: I got eight linux machine, one installed fedora 4 (set as server) and the other seven is fedora 2 (no time to reinstall). I got another 4-5 winXP machines. What i want to know is, how can i setup the linux server such that all the user accounts are only created/deleted inside the server instead of creating the user account in every machines? Using samba?NIS? And after the server is setup, how can i configure the linux clients such that i can choose which domain i want to log on? Thank you for responses and hope can find help here. Mike |
First, your best chance of getting help with an issue like this is to open a new thread, rather than posting in a thread that has a totally different focus. People will read this thread to help with the question at hand, which is what they would do if they saw a new thread with your own heading. Go here, and read through the document, it will tell you everything you need to know:
http://us3.samba.org/samba/docs/man/...ion/index.html |
All times are GMT -5. The time now is 04:34 AM. |