[Samba] Winbind problem revisited

[Brian Kesting]

Okay,

 

I started over from scratch with my samba server rebuild, but I am still
getting some weird issues.  Here are my config files of importance:

 

--------------/etc/samba/smb.conf--------------------

# Samba Configuration File

[global]

        workgroup = WAYNE

        realm = WAYNE.LOCAL

        server string = Samba Server

        security = ADS

        password server = police.wayne.local

        encrypt passwords = yes

        idmap uid = 10000-20000

        idmap gid = 10000-20000

        template shell = /bin/bash

        winbind separator = +

        client signing = no

        client use spnego = no

 

[users]

        comment = Users on Linux

        path = /home/WAYNE

        read only = No

        browseable = Yes

 

-----------/etc/nsswitch.conf---------------------

passwd: compat winbind

group:  files dns compat winbind

shadow: files winbind

 

hosts:          dns winbind files lwres

networks:       files dns

 

services:       files

protocols:      files

rpc:            files

ethers:         files

netmasks:       files

netgroup:       files

publickey:      files

 

bootparams:     files

automount:      files winbind nis

aliases:        files winbind

 

------------/etc/pam.d/login--------------

#%PAM-1.0

auth     requisite      pam_unix2.so            nullok #set_secrpc

auth     required       pam_securetty.so

auth     required       pam_nologin.so

auth     sufficient     pam_winbind.so          use_first_pass use_authtok

#auth    required       pam_homecheck.so

auth     required       pam_env.so

auth     required       pam_mail.so

account  required       pam_unix2.so

account  sufficient     pam_winbind.so          use_first_pass use_authtok

password required       pam_pwcheck.so          nullok

password required       pam_unix2.so            nullok use_first_pass
use_authtok

password sufficient     pam_winbind.so          use_first_pass use_authtok

session  required       pam_unix2.so            none # debug or trace

session  sufficient     pam_winbind.so          use_first_pass use_authtok

session  required       pam_limits.so

session  required       pam_resmgr.so

------------/etc/krb5.conf---------------

[libdefaults]

        default_realm = WAYNE.LOCAL

        clockskew = 300

        dns_lookup_realm = false

        dns_lookup_kdc = false

        default_etypes = des-cbc-crc des-cbc-md5

        default_etypes_des = des-cbc-crc des-cbc-md5

 

[realms]

        WAYNE.LOCAL = {

                kdc = 192.168.1.11

                default_domain = WAYNE.LOCAL

                admin_server = police.wayne.local

                kpasswd_server = police.wayne.local

        }

 

[domain_realm]

        .WAYNE.LOCAL = WAYNE.LOCAL

        WAYNE.LOCAL = WAYNE.LOCAL

        .wayne.local = WAYNE.LOCAL

        wayne.local = WAYNE.LOCAL

 

[logging]

        default = SYSLOG:NOTICE:DAEMON

        kdc = FILE:/var/log/kdc.log

        kadmind = FILE:/var/log/kadmind.log

 

[appdefaults]

        pam = {

                ticket_lifetime = 1d

                renew_lifetime = 1d

                forwardable = true

                proxiable = false

                retain_after_close = false

                minimum_uid = 0

                debug = false

 

I have joined the AD successfully and have gained a Kerberos ticket.  I can
resolve windows user names and groups with the following conditions:  If I
leave the "default_etypes" lines in krb5.conf, then I get this in my
/var/log/samba/log.smbd file and I am unable to access the samba shares:

[2004/12/21 13:32:13, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)

  Failed to verify incoming ticket!

[2004/12/21 13:32:23, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)

  Failed to verify incoming ticket!

[2004/12/21 13:32:33, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)

  Failed to verify incoming ticket!

 

If I comment the etype lines out, the smb log file looks good and I can
access samba shares, but the /var/log/samba/log.winbind looks like this:

 

[2004/12/21 12:59:01, 1] nsswitch/winbindd_group.c:winbindd_getgroups(1059)

  user 'root' does not exist

[2004/12/21 13:00:01, 1] nsswitch/winbindd_group.c:winbindd_getgroups(1059)

  user 'root' does not exist

[2004/12/21 13:32:04, 1] libsmb/clikrb5.c:ads_krb5_mk_req(313)

  krb5_cc_get_principal failed (No such file or directory)

 

I also had this show up in /var/log/samba/log.winbind:  

[2004/12/21 13:26:26, 1] libads/ldap_utils.c:ads_do_search_retry(77)

  ads_search_retry: failed to reconnect (Invalid credentials)

 

Any interpretations?

 

Thanks.

Brian