[Samba] access samba 3.0 shares from Win2K, Win3K, WinXPProf. using netbios name

Juan José Muñoz samba-cifs at iespana.es
Wed Dec 3 08:41:11 GMT 2003

  I have a Windows 2003 Server Enterprise Ed. as Domain controller, an

current domain functional level is 'Windows Server 2003'.
Also, I have a RedHat Linux 7.3 server with SaMBa (tested with rpm 

samba-3.0.0-2, and compiling the samba source code).
I'd joined the linux server to the AD tree without problems, access from

it to the Win2003 shared resources too, but I have problems when try to 

access to the SaMBa resources from the Win2K, Win3K, WinXPProf machines.
The things I can do are:
 - obtain a kerberos ticket: kinit ADMINISTRATOR at DOMAIN
 - join to the domain using this ticket: smb ads join -k
 - obtain a domain user or group list: wbinfo -u/-s
 - obtain an entire list of the users or groups (Unix+Domain): getent 

 - access from linux server with the kerberos ticket to the Win2003

shares: smblicent //SERVER/share -k
 - Access from Win9x/WinMe/WinXP Home clients to the linux/samba shares,

using the linux name or ip, with the network browser or the net use 

 - Access from Win2K, Win3K, WinXPProf clients to the linux/samba

ONLY USING THE LINUX IP with the network browser or the net use command 

(net use * \\ip\share)

Things I CAN'T do:
 - Access from Win2K, Win3K, WinXPProf clients to the linux/samba

ONLY USING THE LINUX NETBIOS NAME with the network browser or the net

command (net use * \\name\share)
 - access from linux server with the kerberos ticket to the linux+samba 

shares: smblicent //SERVER/share -k

The problem seems to be in the client access to the samba shares with th

kerberos ticket authentication.
When a win9x/winME client access to a share, the authentication mode

is NTLM, and I have not problems with it, and occurs the same ussing the

IP instead the name with any client.
When I use a kerberos ticket obtained in the linux machine to access 

win2003 resources, I have no probles neither.
But when I try to access linux shares with the kerberos authentication 

method, I have problems.

How can I beat this problem??

These are my machines:
->Windows 2003 Server Enterprise Edition 
  Name: w2003srv.ns1.abcdom

->RedHat Linux 7.3
  Name: rhd
  Samba 3.0.0 compiled openldap-2.1.22 and Kerberos 1.3.1 del MIT
  (Also tested with samba 3.0.0-2 rpm package)

These are my configuration files:
  default = FILE:/var/log/krb5/libs.log
  kdc = FILE:/var/log/krb5/kdc.log
  admin_server = FILE:/var/log/krb5/admin.log

  ticket_lifetime = 24000
  default_realm = NS1.ABCDOM
  forwardable = true
  proxiable = true

  NS1.ABCDOM = {
  kdc = w2003srv.ns1.abcdom
  default_domain = ns1.abcdom

  .ns1.abcdom = NS1.ABCDOM
  ns1.abcdom = NS1.ABCDOM

  passwd:     files compat winbind nisplus
  shadow:     files nisplus
  group:      files compat winbind nisplus
  hosts:      files nisplus dns
  bootparams: nisplus [NOTFOUND=return] files
  ethers:     files
  netmasks:   files
  networks:   files
  protocols:  files nisplus
  rpc:        files
  services:   files nisplus
  netgroup:   files nisplus
  publickey:  nisplus
  automount:  files nisplus
  aliases:    files nisplus

  workgroup = NS1
  realm = NS1.ABCDOM
  security = ADS
  password server = w2003srv.ns1.abcdom
  username map = /etc/samba/smbusers
  os level = 10
  dns proxy = No
  idmap uid = 10000-20000
  idmap gid = 10000-20000
  template shell = /bin/bash
  winbind separator = +
  winbind use default domain = Yes

  # Recurso compartido para pruebas
    comment = Temporary file space
    path = /tmp
    read only = no
    public = yes


 - I have the nobody user on the linux server
 - 'ldd /usr/sbin/smbd | grep krb5'
       libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x40014000)
       libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x40026000)
 - 'smbclient -L localhost -U%' works fine
 - 'kinit ADMINISTRATOR at NS1.ABCDOM' works too

 - 'klist'
      Ticket cache: FILE:/tmp/krb5cc_0
      Default principal: ADMINISTRATOR at NS1.ABCDOM

      Valid starting     Expires            Service principal
      11/26/03 10:58:05  11/26/03 20:58:13  rbtgt/NS1.ABCDOM at NS1.ABCDOM

      Kerberos 4 ticket cache: /tmp/tkt0
      klist: You have no tickets cached
 - 'net ads join'
    without '-U administrator' works returning:
      Using short domain name -- NS1
      Joined 'RHD' to realm 'NS1.ABCDOM'
 - from Windows 2003 Server command line:
   'net use * \\rhd\tmp' 
    asks me from user and password authentication, and fails with the
     "The password or the username is invalid for \\rhd\tmp"
   'net use * \\\tmp'
    works fine without prompting user and password authentication
 -  with the browser happens the same, using name fails, but with ip,
works fine.

Juega con Ventura24.es, lotería inteligente y multiplica tus
posibilidades!! http://www.iespana.es/_reloc/email.ventura

Únete a los miles de sin pareja en Meetic... ¡te vas a enamorar!

More information about the samba mailing list