[Samba] winbind and Solaris 9 with AD

Fri Jan 23 15:17:02 GMT 2004

-----Original Message-----
Hi Tim,

	I have winbind working with Solaris 9 ok, my only problem came because I have idmap in LDAP and I'd put double quotes around the dn of the LDAP admin account which broke things. Don't think I had to do anything special to compile this, make sure you have installed the latest Solaris 9 patch cluster from sunsolve. I compiled with these options,

./configure --with-kerberos=/usr/local --with-ads --with-acl-support --with-pam --with-winbind

I don't think --with-pam is needed if you only want winbind to work for smb connections to Samba (ie not for telnet etc.). Does wbinfo -u work? thats fundamental to getent working. Also I assume you have MIT kerberos 1.3.1 installed as Samba will not work with Sun kereros,

	thanks Andy.

From: Ganguly, Sapan [mailto:Sapan.Ganguly at thalesgroup.com]
Posted At: 22 January 2004 11:09
Posted To: Samba
Conversation: [Samba] winbind and Solaris 9 with AD
Subject: RE: [Samba] winbind and Solaris 9 with AD

P.S I used the pam.conf that Patrik Gustavsson posted here.

-----Original Message-----
From: Wright, Tim (ANTS) [mailto:tim.wright at ants.co.uk] 
Sent: 21 January 2004 16:37
To: 'Ganguly, Sapan '
Subject: RE: [Samba] winbind and Solaris 9 with AD

hi

I've been looking at my problem and compring the Solaris 9 box to a working
Linux box. I noticed that if I take the winbind entry out of nsswitch.conf
on the linux box then samba will no longer accept connections from users
with no unix account or relevanr username map.

So I'm assuming that if I can get getent working on the Solaris box then the
samba authentication problem will be solved as well.

So would you be able to provide me with a step by step of how you built and
configured samba/winbind on the host where getent works ( including other
stuff like kerberos and openldap compiles )? I can't offer much in return
but if I can get getent working then I will look at getting logging on to
the box working as well ( unless of course you 've already cracked it
yourself ).

anyway any help you could give me would be greatly appreciated.

thanks

tim

-----Original Message-----
From: Ganguly, Sapan [mailto:Sapan.Ganguly at thalesgroup.com] 
Sent: 19 January 2004 13:06
To: 'Unix Service (ANTS)'; 'samba at lists.samba.org'
Subject: RE: [Samba] winbind and Solaris 9 with AD

I'm having trouble with this too but getent works for me, I'm not using AD
though.  

Have you edited nsswitch.conf?  

Passwd: files winbind
Group: files winbind

I'm stuck on getting logging in working...Sun seems to think there may be
some bug with PAM.

-----Original Message-----
From: Unix Service (ANTS) [mailto:Unix.Services at ants.co.uk] 
Sent: 19 January 2004 12:13
To: 'samba at lists.samba.org'
Subject: [Samba] winbind and Solaris 9 with AD

Hi

have been trying to get winbind working on Solaris 9 but to no effect.

version info:

samba: 3.0.0
openldap: 2.1.23
kerberos: MIT 1.3.1

Have followed the instructions in every howto, usenet posting I could
find:

nscd not running
created relevant links in /lib and /lib/security/sparcv9 applied patch for
nsswitch as recommended

kinit -e works
net ads join works
wbinfo -t works
wbinfo -u gives list of all users in all trusted domains
getent doesn't work
samba authentication doesn't work - get the following in winbindd.log:

[2004/01/19 10:59:27, 5] nsswitch/winbindd_pam.c:(379)
  NTLM CRAP authentication for user [DEV]\[test7] returned NT_STATUS_OK
(PAM: 0) [2004/01/19 10:59:27, 3] nsswitch/winbindd_acct.c:(875)
  [ 3551]: create_user: user=>(test7), group=>()
[2004/01/19 10:59:27, 5] nsswitch/winbindd_acct.c:(521)
  wb_getgrnam: Did not find group (nobody)

my smb.conf is:

workgroup = DEV
#workgroup = DEV.ANTS.AD.ANPLC.CO.UK
realm = DEV.ANTS.AD.ANPLC.CO.UK
security = ADS
password server = lonsd010.dev.ants.ad.anplc.co.uk
dns proxy = no
idmap gid = 70000-80000
idmap uid = 800000-900000
winbind cache time = 15
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
encrypt passwords = yes
log level = 9

[temp]
path = /tmp
read list = @users

[docs]
path = /var/tmp/samba-3.0.0
read list = @users

I would appreciate any pointers as to further debugging I could do or
possible problems as being able to use winbind to deal with samba
authentication would make life a great deal easier.

***************************************************************************
This communication (including any attachments) contains confidential
information.  If you are not the intended recipient and you have received
this communication in error, you should destroy it without copying,
disclosing or otherwise using its contents.  Please notify the sender
immediately of the error.

Internet communications are not necessarily secure and may be intercepted or
changed after they are sent.  Abbey National Treasury Services plc does not
accept liability for any loss you may suffer as a result of interception or
any liability for such changes.  If you wish to confirm the origin or
content of this communication, please contact the sender by using an
alternative means of communication.

This communication does not create or modify any contract and, unless
otherwise stated, is not intended to be contractually binding.

Abbey National Treasury Services plc. Registered Office:  Abbey National
House, 2 Triton Square, Regents Place, London NW1 3AN.  Registered in
England under Company Registration Number: 2338548.  Regulated by the
Financial Services Authority (FSA).
***************************************************************************

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

***************************************************************************
This communication (including any attachments) contains confidential
information.  If you are not the intended recipient and you have received
this communication in error, you should destroy it without copying,
disclosing or otherwise using its contents.  Please notify the sender
immediately of the error.

Internet communications are not necessarily secure and may be intercepted or
changed after they are sent.  Abbey National Treasury Services plc does not
accept liability for any loss you may suffer as a result of interception or
any liability for such changes.  If you wish to confirm the origin or
content of this communication, please contact the sender by using an
alternative means of communication.

This communication does not create or modify any contract and, unless
otherwise stated, is not intended to be contractually binding.

Abbey National Treasury Services plc. Registered Office:  Abbey National
House, 2 Triton Square, Regents Place, London NW1 3AN.  Registered in
England under Company Registration Number: 2338548.  Regulated by the
Financial Services Authority (FSA).
***************************************************************************
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

BBCi at http://www.bbc.co.uk/

This e-mail (and any attachments) is confidential and may contain personal views which are not the views of the BBC unless specifically
stated.
If you have received it in error, please delete it from your system. Do not use, copy or disclose the information in any way nor act in
reliance on it and notify the sender immediately. Please note that the BBC monitors e-mails sent or received.
Further communication will signify your consent to this.