Hello Louis
and thank you for your very long tutorial.
I tried to fix my 'wrong' smb.conf on my existing machine but that gave
trouble.
So I tried to setup a fresh stretch box step by step (had to change some
things but I had a look at
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member,
too) but after some days and a reboot I see the problem again, it just
appears less often till now.
CONFIG
======
> Setup jessie:
I did stretch.
> # Choose expert install, and at taskselect choose only ssh server.
I did so and used dhcp:
$ cat /etc/hosts
127.0.0.1 localhost
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
$ cat /etc/resolv.conf
domain WORK.COMPANY
search WORK.COMPANY
nameserver 172.16.0.2
$ cat /etc/network/interfaces.
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug enp0s25
iface enp0s25 inet dhcp
> # Check all these.
$ hostname -s
sambawb
$ hostname -d
WORK.COMPANY
$ hostname -f
sambawb.WORK.COMPANY
$ hostname -i
172.16.0.209
> # install samba winbind and needed extras.
> apt-get install samba smbclient samba-dsdb-modules samba-vfs-modules
winbind libpam-winbind libnss-winbind krb5-user ntp bind9-host
libpam-krb5
I did so.
> When questions come, fill in :
No questions came.
> # AD DC ipnumbers at ntp questions
added 'server 172.16.0.2 iburst' to /etc/ntp.conf (thats my AD DC
ipnumber)
> # krb5-user fill in your REALM in CAPS. ! CAPS YES !
$ cat /etc/krb5.conf
[libdefaults]
default_realm = WORK.COMPANY
> # Change your /etc/nsswitch.conf
$ cat /etc/nsswitch.conf
passwd: compat winbind
group: compat winbind
shadow: compat
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
# kinit administrator
worked great.
> Setup a "correct smb.conf" like this one.
I don't know whats "correct" in your sense. I did:
## ---------- START AD MEMBER SMB.CONF --------- ##
# /etc/samba/smb.conf
[global]
security = ads
realm = WORK.COMPANY
workgroup = WORK
netbios name = sambawb
preferred master = no
domain master = no
host msdfs = no
# speeds up name resolving, (WINS), through dns.
dns proxy = yes
# local master = no
# I left out bind interfaces
#bind interfaces only = yes
#interfaces = enp0s25 127.0.0.1
# I've added these, mustly same as the defaults, but this explains things
for others
# if they have auth problems.
# mandatory will still require SMB2 clients to use signing
server signing = mandatory
# if ntlm and lanman auth are both disabled, then only NTLMv2 logins will
be permited
ntlm auth = no
lanman auth = no
# TODO: I skipped TLS keys!
name resolve order = lmhosts host bcast
idmap config * : backend = tdb
idmap config * : range = 2000-9999
# https://wiki.samba.org/index.php/Idmap_config_rid
idmap config WORK : backend = rid
idmap config WORK : range = 10000-999999
template homedir = /home/%D/%U
template shell = /bin/bash
winbind nss info = template
# renew the kerberos ticket
winbind refresh tickets = yes
# Changed to not use winbind trusted domains only
winbind trusted domains only = no
# and to use default domain
winbind use default domain = yes
winbind enum groups = yes
winbind enum users = yes
# Enable offline logins, if needed. I don't want it.
winbind offline logon = no
# left out: winbind max domain connections = 10
kerberos method = secrets and keytab
dedicated keytab file = /etc/krb5.keytab
winbind expand groups = 4
# User Administrator workaround, without it you are unable to set
# username map = /etc/samba/samba_usermapping
# disable usershares creating, no log errors.
usershare path =
# Disable printing completely, no log errors.
# Disable printing completely, no log errors.
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
# For ACL support on member servers with shares (oblicated member
setting)
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes
# Share Setting Globally
veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
hide unreadable = yes
# From debian default config:
# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m
# Cap the size of the individual log files (in KiB).
max log size = 1000
# Do something sensible when Samba crashes: mail the admin
panic action = /usr/share/samba/panic-action %d
## ---------- END AD MEMBER SMB.CONF --------- ##
> net ads join -S hostname-DC.work.company -k
successfull
> # Setup pam configs for ssh krb5 and winbind, needed for your ssh logins.
> pam-auth-update --force
> # setup the SePrivileges then reboot the server.
I tried to but I didn't really understand. So I think for my problem its not
neccessary.
> net cache flush
> systemctl restart samba
Failed to restart samba.service: Unit samba.service is masked.
so I did:
systemctl restart nmbd; systemctl restart smbd
> systemctl restart winbind
RESULT
======
Sometimes. Caught just after a reboot:
FYI: 172.16.0.1 is the ssh tunnel exit point in my companys network.
Jun 07 21:33:14 sambawb nmbd[469]: STATUS=daemon 'nmbd' finished starting up
and ready to serve connections
...
Jun 07 21:33:14 sambawb winbindd[519]: STATUS=daemon 'winbindd' finished
starting up and ready to serve connections
Jun 07 21:33:14 sambawb systemd[1]: Started Samba Winbind Daemon.
Jun 07 21:33:14 sambawb systemd[1]: Reached target Multi-User System.
Jun 07 21:33:14 sambawb systemd[1]: Reached target Graphical Interface.
Jun 07 21:33:14 sambawb systemd[1]: Starting Update UTMP about System Runlevel
Changes...
Jun 07 21:33:14 sambawb systemd[1]: Started Update UTMP about System Runlevel
Changes.
Jun 07 21:33:14 sambawb systemd[1]: Startup finished in 3.973s (kernel) +
15.752s (userspace) = 19.725s.
Jun 07 21:33:18 sambawb sshd[502]: pam_krb5(sshd:auth): authentication failure;
logname=domainuser uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.1
Jun 07 21:33:18 sambawb sshd[502]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.1 user=domainuser
Jun 07 21:33:18 sambawb sshd[502]: pam_winbind(sshd:auth): getting password
(0x00000388)
Jun 07 21:33:18 sambawb sshd[502]: pam_winbind(sshd:auth): pam_get_item
returned a password
Jun 07 21:33:19 sambawb sshd[502]: pam_winbind(sshd:auth): request wbcLogonUser
failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7),
NTSTATUS_LOGON_FAILURE, Error message was: Logon failure
Jun 07 21:33:19 sambawb sshd[502]: pam_winbind(sshd:auth): user 'domainuser'
denied access (incorrect password or invalid membership)
Jun 07 21:33:20 sambawb sshd[502]: Failed password for invalid user domainuser
from 172.16.0.1 port 54474 ssh2
I also noticed that in this cases 'wbinfo -u' or 'kinit domainuser' succeeds,
but 'getent passwd' only shows local users.
And yes, libpam-winbind and libnss-winbind are installed and nsswitch.conf has
'passwd: compat winbind'
Interestingly my fresh installed sambawb shows less bugs than my reconfigured
elderly but config updated FAI-Clients.
What else do you need? sambalog at loglevel xyz?
Christian
PS: I don't know if it's related but sometimes I see error messages like:
Jun 07 09:31:58 fai-server winbindd[18389]: [2017/06/07 09:31:58.322153, 0]
../source3/winbindd/winbindd.c:279(winbindd_sig_term_handler)
Jun 07 09:31:58 fai-server winbindd[18389]: Got sig[15] terminate
(is_parent=0)
Jun 07 09:31:58 fai-server winbindd[18387]: [2017/06/07 09:31:58.322378, 0]
../source3/winbindd/winbindd.c:279(winbindd_sig_term_handler)
Jun 07 09:31:58 fai-server winbindd[18387]: Got sig[15] terminate
(is_parent=1)
