Very stupid, but here we go: pam_mount + samba share = access denied?

Thakowbbery · 05-17-2005, 03:23 PM

Okay
I'm using pam_mount to mount a samba share at login time (and dismount it at logoff).
I'm using samba + winbind user login (Windows 2000 AD Domain Controller network) and after logging in, after pam_mount mounts the share, I can access the share but can't write to it: Access denied!!

Any help?

Sern · 05-18-2005, 02:39 PM

Can you login your domain users graphicaly?

Thakowbbery · 05-19-2005, 10:24 AM

Yep, I can

cowanrl · 05-19-2005, 10:56 AM

What command are you using to mount the share? If you don't provide a uid or gid parameter to your mount command, only root will have write access to the share.

This link will show how to use the uid or gid parameter with mount:

http://www.justlinux.com/nhf/Filesys...rmanently.html

Sern · 05-19-2005, 03:20 PM

Quote:

Originally posted by Thakowbbery
Yep, I can

How did you get it to , cause i can't for the life of me

Thakowbbery · 05-20-2005, 10:06 AM

Quote:

Originally posted by cowanrl
What command are you using to mount the share? If you don't provide a uid or gid parameter to your mount command, only root will have write access to the share.

This link will show how to use the uid or gid parameter with mount:

http://www.justlinux.com/nhf/Filesys...rmanently.html

actually I've already managed to do it, but thanks anyway

and Sern, check here, tell me if you see anything different from yours:

/etc/samba/smb.conf:

[global]
log file = /var/log/samba/samba.log.0l001
load printers = yes
printing = cups
idmap gid = 10000-60000
read list = @"SRSP/UsersSRSP"
allow trusted domains = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
write list = @"SRSP/UsersSRSP"
hosts allow = 10.11.8.28, 10.11.8.32
encrypt passwords = yes
winbind use default domain = yes
realm = SRSP.DPF
template shell = /bin/bash
dns proxy = no
template primary group = "SRSP/UsersSRSP"
netbios name = 0l001
server string = Samba Server 0l001
winbind enum users = yes
idmap uid = 10000-60000
password server = 10.11.8.28
template homedir = /home/%U
workgroup = SRSP
winbind enum groups = yes
printcap name = /etc/printcap
valid users = @"SRSP/UsersSRSP"
security = ads
winbind separator = +

---------------------------------------------------------------------------------------------------------------------------
/etc/krb5.conf:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = SRSP.DPF
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
SRSP.DPF = {
kdc = 10.11.8.28
default_domain = srsp.dpf
}

[domain_realm]
.srsp.dpf = SRSP.DPF
srsp.dpf = SRSP.DPF

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

-----------------------------------------------------------------------------------------------------------------------------------
/etc/nsswitch:

passwd: files winbind
shadow: files winbind
group: files winbind
(there is more for nsswitch, but the rest really doesn't matter)
-----------------------------------------------------------------------------------------------------------------------------------
/etc/pam.d/system-auth:

auth required pam_env.so
auth sufficient pam_winbind.so
auth sufficient pam_unix.so likeauth nullok use_first_pass
auth required pam_deny.so

account sufficient pam_winbind.so
account required pam_unix.so

password required pam_cracklib.so retry=3 minlen=2 dcredit=0 ucredit=0
password sufficient pam_unix.so nullok use_authtok md5 shadow
password sufficient pam_winbind.so use_authtok
password required pam_deny.so

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required pam_limits.so
session required pam_unix.so

------------------------------------------------------------------------------------------------------------------------------------

Did you added the machine to the domain?
Is the smb, nmbd and winbindd daemons running?

Sern · 05-20-2005, 10:43 AM

yea wayyyy diffrent...

smb.conf

Code:

[root@WHB-LinuxBackup ~]# grep -v "^#" /etc/samba/smb.conf

[global]
        workgroup = DUNNPC
        realm = DUNNPC.COM
        server string = WHBLinuxServer
        security = ADS
        password server = 192.168.20.2
        log file = /var/log/samba/%m.log
        max log size = 50
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        printcap name = /etc/printcap
        local master = No
        domain master = Yes
        dns proxy = No
        idmap uid = 16777216-33554431
        idmap gid = 16777216-33554431
        template shell = /bin/bash
        winbind use default domain = Yes
        cups options = raw

[homes]
        read only = No
        create mask = 0777
        valid users = dunnpc\%U
        directory mask = 0777
        guest ok = no
        browseable = yes
        writeable = yes

[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No

[html]
        path = /var/www/html
        valid users = dunnpc\azabielski,dunnpc\droach
        read only = No

krb5.conf

Code:

[root@WHB-LinuxBackup ~]# grep -v "^#" /etc/krb5.conf
  [logging]
    default = FILE:/var/log/krb5/libs.log
    kdc = FILE:/var/log/krb5/kdc.log
    admin_server = FILE:/var/log/krb5/admin.log

  [libdefaults]
    ticket_lifetime = 24000
 default_realm = DUNNPC.COM
    default_tgs_enctypes = des-cbc-crc des-cbc-md5
    default_tkt_enctypes = des-cbc-crc des-cbc-md5
    forwardable = true
    proxiable = true
 dns_lookup_realm = true
 dns_lookup_kdc = true

  [realms]
    dunnpc.com = {
      kdc = 192.168.20.2
    }

 DUNNPC.COM = {
 }

 DUNNPC.COM = {
  kdc = 192.168.20.2
 }

  [domain_realm]
    .dunnpc.com = DUNNPC.COM
    dunnpc.com = DUNNPC.COM

  [kdc]
    profile = /var/kerberos/krb5kdc/kdc.conf

  [pam]
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false

system-auth

Code:

[root@WHB-LinuxBackup ~]# grep -v "^;" /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_krb5.so use_first_pass
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        sufficient    /lib/security/$ISA/pam_smb_auth.so use_first_pass nolocal
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account     [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_krb5.so
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow nis
password    sufficient    /lib/security/$ISA/pam_krb5.so use_authtok
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_krb5.so
session     optional      /lib/security/$ISA/pam_ldap.so

Sern · 05-23-2005, 10:16 AM

I did excatly what you did, changing my info respectively of course , and now it just says invaild username or password for domain users

Sern · 05-23-2005, 11:43 AM

ok it starts to log me on and then it fails and says
Unable to create ~/.gnome directory permission denied