SMB / Winbind woes

cmor84 · 08-04-2022, 09:04 AM

Hello Everyone

At work we have a large mixed Windows, Solaris and Linux environment.

We have a couple of samba servers to provide access to various Linux shares from Office PCs. The current Samba servers are running on Scientific Linux 7 / Samba ersion 4.10.16. The current setup is very simple. No Winbind in use. User ID information is provided by NIS and Samba authentication is via Active Directory. The AD user simply maps to the relevant NIS user and everything works beautifully. However, these servers are used on a different part of the network and a need has arisen to create some new Samba servers. As Scientific Linux is end of life and due to the new support cycle of CentOS, we are moving towards Rocky Linux.

The new servers I am setting up are Rocky Linux 8 / Samba 4.15.5. It seems that the simple Samba only config is no longer supported. Whenever I try to to connect without Winbind, authentication fails and I get numerous NT_STATUS_NO_LOGON_SERVERS errors along with various complaints about Winbind not running. I can get this working with Winbind enabled but it allocates UIDs from the range specified. This is not the behaviour I want. I want it to match the username to the user in NIS and use the NIS UID, eg. someuser@pc.mycompany.com = someuser.

There just seems to be no way of achieving the old standalone Samba behaviour through Winbind. It all seems to be oriented around mapping SIDs to UIDs. I cannot find any documentation on this. I'm hoping there is a simple way to do this. So far, Winbind is an utter headache and I've found the documentation to be not very helpful.

Any help appreciated, thanks.

smb.conf is below:

Code:

# Global parameters
[global]
        log level = 2 auth:5
        workgroup = MYCOMPANY
        REALM = PC.MYCOMPANY.COM
        security = ads
        server string = Samba Server Version %v
        mangled names = no
        strict locking = no
        passdb backend = tdbsam
        template shell=/bin/bash
        min protocol = SMB3
        idmap config PC.MYCOMPANY.COM : backend = nss
        idmap config * : range = 1000-999999
; Following is to exclude the domain controller in azure, which we have seen to give us problems
        password server = DC1.MYCOMPANY.COM,DC2.MYCOMPANY.COM

; Following to allow wide links and unix extensions
        allow insecure wide links = yes
        wide links = yes

        debug level = 5

        load printers = yes
        cups options = raw

; Force signed SMB access
        server signing = mandatory
; Disable any login with a non-user
        map to guest = Never
; Disable recon potential
        restrict anonymous = 2
; Prevent shares being accessed by non-user
        usershare allow guests = no
        guest ok = no

[share1]

[share2]

[share3]

JP3 · 08-12-2022, 10:37 PM

Quote:

Originally Posted by cmor84

The current setup is very simple. No Winbind in use. User ID information is provided by NIS and Samba authentication is via Active Directory. The AD user simply maps to the relevant NIS user and everything works beautifully. However, these servers are used on a different part of the network and a need has arisen to create some new Samba servers.

Without getting into any Winbind/NIS/AD config, perhaps this is the area that needs some focus?!?!? Am I understanding correctly that you're trying to recreate what you already have working smoothly on one network, just with a different OS/SAMBA versions??? Could it simply be an issue with SAMBA reaching out to NIS/AD on the original network? Perhaps you're going down the Windbind rabbit hole for no reason and driving yourself crazy in the process? Just a thought...

ferrari · 08-13-2022, 01:09 AM

Quote:

The new servers I am setting up are Rocky Linux 8 / Samba 4.15.5. It seems that the simple Samba only config is no longer supported. Whenever I try to to connect without Winbind, authentication fails and I get numerous NT_STATUS_NO_LOGON_SERVERS errors along with various complaints about Winbind not running.

I'm not experienced with using samba in a domain environment, so can only offer general advice here. Why were you attempting to run without winbind? In your samba config, you have

Code:

idmap config PC.MYCOMPANY.COM : backend = nss

The "backend = nss" means idmap_nss Backend for Winbind
https://www.samba.org/samba/docs/cur...map_nss.8.html

ferrari · 08-13-2022, 01:12 AM

Just in case the following samba references are of value to you...
https://wiki.samba.org/index.php/Set...figuring_Samba
https://wiki.samba.org/index.php/Idmap_config_ad

cmor84 · 08-19-2022, 04:43 AM

Quote:

Originally Posted by ferrari

I'm not experienced with using samba in a domain environment, so can only offer general advice here. Why were you attempting to run without winbind? In your samba config, you have

Code:

idmap config PC.MYCOMPANY.COM : backend = nss

The "backend = nss" means idmap_nss Backend for Winbind
https://www.samba.org/samba/docs/cur...map_nss.8.html

Hi. On our older Samba servers, we didn't need Winbind, it just worked and produced the desired behaviour. I compiled an earlier version of Samba, 4.10.18. Whilst this version DOES require Winbind, it does what I want. However my boss doesn't want to be stuck on an older version.

I'm a little bit confused as to what the backend = nss actually does. I was hoping this would produce the desired behaviour.

ferrari · 08-19-2022, 05:16 AM

I can only point you to the documentation, (the main winbind backends are ad, autorid, and rid)...
https://wiki.samba.org/index.php/Set..._idmap_backend
The nss backend (NOT mentioned above) is discussed as per the link I provided in post #3. It doesn't appear to be in common use these days. Hopefully others can comment further here.

Let's see if we can get a working config without winbind (not sure if that is viable), and providing the following requirement...

Quote:

I want it to match the username to the user in NIS and use the NIS UID, eg. someuser@pc.mycompany.com = someuser.

ferrari · 08-19-2022, 05:22 AM

This may be helpful as an overview...
https://wiki.samba.org/index.php/Sam...on#File_server

ferrari · 08-19-2022, 05:33 AM

An example of a samba server (no winbind) working with Windows clients in an Active Directory environment...
https://www.hexblot.com/blog/centos-...tory-and-samba