LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 10-21-2010, 07:31 AM   #1
winterMB
LQ Newbie
 
Registered: Oct 2010
Posts: 2

Rep: Reputation: 0
samba ROLE_DOMAIN_MEMBER security ads


centoS 5.5

[root@osra ~]# rpm -q samba3x
samba3x-3.3.8-0.52.el5_5.2

[root@osra ~]# rpm -q krb5-workstation
krb5-workstation-1.6.1-36.el5_5.5

domain controller windows 2k3 sp3

i follow those guides:


http://wiki.samba.org/index.php/Samb...tive_Directory
http://www.samba.org/samba/docs/man/...html#ch9-adsdc

i join the domain, i can test the user


[root@osra ~]# wbinfo -a mbottalico%#########
plaintext password authentication succeeded
challenge/response password authentication succeeded

[root@osra ~]# wbinfo -u
administrator
guest
krbtgt

[root@osra ~]# wbinfo -g
utenti wins
dhcp users
dhcp administrators
computer del dominio
controller di dominio

getent passwd and group ok without "DOMAIN+"


kinit e klist ok.


i can browser the samba server, but i can enter on "temp", but not in "test" (access denied)


[root@osra ~]# smbclient \\\\osra\\test -U administrator
Enter administrator's password:
Domain=[DOMAINSHORT] OS=[Unix] Server=[Samba 3.3.8-0.52.el5_5.2]
smb: \> ls
NT_STATUS_NETWORK_ACCESS_DENIED listing \* (I noticed only writing this message)

[root@osra ~]# smbclient \\\\osra\\tmp -U administrator
Enter administrator's password:
Domain=[DOMAINSHORT] OS=[Unix] Server=[Samba 3.3.8-0.52.el5_5.2]
smb: \> dir
. D 0 Wed Oct 20 15:15:23 2010
.. D 0 Wed Oct 20 11:42:23 2010
T0100000160 D 0 Wed Oct 20 12:33:32 2010
t01tty90 D 0 Wed Oct 20 11:42:23 2010
T01port-mb1 D 0 Thu Oct 21 15:21:51 2010
impexp D 0 Wed Jul 14 12:11:44 2010
T0100000140 D 0 Wed Oct 20 12:05:00 2010
dirvuota.txt A 0 Wed Nov 6 08:15:20 1991
t01tty01 D 0 Wed Oct 20 11:42:23 2010
aggiofix A 5237760 Thu Nov 17 20:27:58 2005
t01tty02 D 0 Wed Oct 20 11:42:23 2010
T0100000150 D 0 Wed Oct 20 12:16:10 2010

53488 blocks of size 2097152. 49908 blocks available
smb: \> q


0 blocks of size 0. 511 blocks available

any help?



config file:

/etc/krb5.conf

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
default_tkt_enctypes = des-cbc-crc; des-cbc-md5
default_tgs_enctypes = des-cbc-crc; des-cbc-md5

[realms]

DOMAIN.COM = {
kdc = alpha.DOMAIN.com
admin_server = alpha.domain.com
default_domain = domain.com
}

[domain_realm]
shortdomain = DOMAIN.COM
domain.com = DOMAIN.COM
.domain.com = DOMAIN.COM

[appdefaults]

pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

/etc/smb.conf

[global]
workgroup = SHORTDOMAIN
realm = DOMAIN.COM
preferred master = no
server string = Linux Machine
security = ads
encrypt passwords = yes
log level = 5
log file = /var/log/samba/%m
client use spnego = yes
client ntlmv2 auth = yes
max log size = 50
printcap name = cups
printing = cups
username map = /etc/samba/smbusers
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nested groups = Yes
winbind separator = +
idmap uid = 100-20000
idmap gid = 100-20000
; template primary group = "Domain Users"
template shell = /bin/bash


[printers]
comment = All Printers
path = /var/spool/cups
browseable = no
printable = yes
guest ok = yes

[test]
comment = test
path = /u/test
Valid Users = DOMAIN.COM+user @DOMAIN.COM+group
writable = yes
browseable = yes

[tmp]
comment = test-no-security-ads
path = /tmp
guest ok = yes
public = yes
browseable = yes
read only = no
create mask = 0777
directory mask = 0777

/etc/nsswitch.conf

passwd: files winbind
shadow: files winbind
group: files winbind

hosts: files dns

bootparams: nisplus [NOTFOUND=return] files

ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files

/etc/pam.d/system-auth


auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_succeed_if.so uid < 100 quiet
account sufficient pam_winbind.so use_first_pass
account required pam_permit.so

password requisite pam_cracklib.so retry=3 type=
password sufficient pam_unix.so nullok use_authtok md5 shadow
password sufficient pam_winbind.so use_first_pass
password required pam_deny.so

session required pam_limits.so
session required pam_unix.so
session required pam_winbind.so use_first_pass

Last edited by winterMB; 10-21-2010 at 01:59 PM.
 
Old 10-21-2010, 08:50 AM   #2
winterMB
LQ Newbie
 
Registered: Oct 2010
Posts: 2

Original Poster
Rep: Reputation: 0
closed, risolved by chmod on the fs.

i'm a dumb.

Last edited by winterMB; 10-21-2010 at 01:59 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Samba with security=ADS is getting me stupid PittyB Linux - Server 1 02-06-2009 12:54 AM
Samba with security=ADS is getting me stupid PittyB Linux - Networking 1 02-05-2009 03:42 PM
...of Samba ADS security, Kerberos, and AD on Windows 2003 zerovice Linux - Enterprise 6 10-19-2006 12:07 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 08:11 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration