[Samba] Re: Looping auth problem

John Goerzen jgoerzen at complete.org
Fri Jun 25 20:13:20 GMT 2004

On 2004-06-25, Tomá¹ Polák <Tomas.Polak at jaga.sk> wrote:
>>From my point of view you must provide more informations about you
> environment.
> Acts your Samba as PDC?

Yes, the Samba server in question is the PDC.  Most, but not all, client
PCs are logging in to the domain.

> Which OS have your PCs?

Mostly XP, but as low as Windows 98.  All of the effected PCs are
running XP.

> Do you have Wins servers?


> Which kind of authorisation you are using between Samba and PCs?

Not sure what you mean here.

> Also your smb.conf will be helpfull when seen...

Included below.

# Sample configuration file for the Samba suite for Debian GNU/Linux.
# $Id: smb.conf,v 1.9 2002/11/11 04:20:37 vorlon Exp $
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which 
# are not shown in this example
# Any line which starts with a ; (semi-colon) or a # (hash) 
# is a comment and is ignored. In this example we will use a #
# for commentary and a ; for parts of the config file that you
# may wish to enable
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not many any basic syntactic 
# errors. 

#======================= Global Settings =======================

kernel oplocks = no
# This needed for vserver ctx13 patch with 2.4.19
log level = 2
# admin users = root
printer admin = root
time server = yes
domain logons = yes
domain admin group = root kweaver jgoerzen djschmidt @tempadmins
logon script = GENERIC.BAT
# Change this for the workgroup/NT-domain name your Samba server will part of
   workgroup = LINUX

# server string is the equivalent of the NT Description field
   server string = %h server (Samba %v)

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
   load printers = yes

# lpr(ng) printing. You may wish to override the location of the
# printcap file
;   printing = bsd
;   printcap name = /etc/printcap

# cups printing.  See also the cupsaddsmb(8) manpage
   printing = cups
   printcap name = cups

;   guest account = nobody
;   invalid users = root

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
   max log size = 1000

# If you want Samba to log though syslog only then set the following
# parameter to 'yes'. Please note that logging through syslog in
# Samba is still experimental.
;   syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smb,nmb} instead. If you want to log
# through syslog you should set the following parameter to something higher.
   syslog = 0

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# security_level.txt for details.
;   security = user

# You may wish to use password encryption. Please read ENCRYPTION.html,
# Win95.txt and WinNT.txt in the Samba documentation. Do not enable this
# option unless you have read those documents
   encrypt passwords = true
#   passdb backend = smbpasswd unixsam

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.  
#   passdb backend = ldapsam:ldap://ldap unixsam

ldap admin dn = "cn=admin,dc=excelhustler,dc=com"
ldap server = ldap.internal.excelhustler.com
ldap ssl = off
ldap port = 389
ldap suffix = "ou=People,dc=excelhustler,dc=com"
# ldap passwd sync = yes

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
   socket options = TCP_NODELAY

# --- Browser Control Options ---

# Please _read_ BROWSING.txt and set the next four parameters according
# to your network setup. The defaults are specified below (commented
# out.) It's important that you read BROWSING.txt so you don't break
# browsing in your network!

# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
   local master = yes

# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
;   os level = 20

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
   domain master = yes

# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
   preferred master = yes

# --- End of Browser Control Options ---

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
;   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
   dns proxy = no

# What naming service and in what order should we use to resolve host names
# to IP addresses
;   name resolve order = lmhosts host wins bcast

# Name mangling options
;   preserve case = yes
;   short preserve case = yes

# This boolean parameter controlls whether Samba attempts to sync. the Unix
# password with the SMB password when the encrypted SMB password in the
# /etc/samba/smbpasswd file is changed.
unix password sync = true

# For Unix password sync. to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Augustin Luton <aluton at hybrigenics.fr> for
# sending the correct chat script for the passwd program in Debian Potato).
#   passwd program = /usr/bin/passwd %u
#   passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes

# The following parameter is useful only if you have the linpopup package
# installed. The samba maintainer and the linpopup maintainer are
# working to ease installation and configuration of linpopup and samba.
;   message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

   obey pam restrictions = yes

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   winbind uid = 10000-20000
;   winbind gid = 10000-20000
;   template shell = /bin/bash

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d

#======================= Share Definitions =======================

   comment = Technical Publications
   browseable = yes
   writeable = no
   create mask = 0664
   directory mask = 0775
   write list = @techpubs
   path = /shared/data/techpubs
   force group = techpubs
   oplocks = no
   posix locking = no

   comment = Engineering Scans
   browseable = yes
   writeable = no
   create mask = 0664
   directory mask = 0775
   write list = @scans
   path = /shared/data/scans
   force group = scans

   comment = Administrator Access to Home Dirs
   valid users = @infoservices
   admin users = @infoservices
   write list = @infoservices
   browseable = no
   path = /home

   comment = Applications
   browseable = yes
   writeable = yes
   create mask = 0664
   directory mask = 0775
   path = /shared/apps
   admin users = @infoservices
   # blocking locks = no
   # locking = no
   oplocks = no
   posix locking = no
   #force group = +accounting   # Because the /apps/accounting needs R/W privs

   comment = Data
   browseable = yes
   writeable = yes
   create mask = 0664
   directory mask = 0775
   path = /shared/data
   admin users = @infoservices
   # blocking locks = no
   # locking = no
   oplocks = no
   posix locking = no
   #force group = +accounting   # Because the /apps/accounting needs R/W privs

   comment = Home Directories
   browseable = no
   user = %S
   only user = yes

   oplocks = no
   posix locking = no
   admin users = @infoservices

# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
   writable = yes

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
   create mask = 0644

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
   directory mask = 0775

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
   comment = Network Logon Service
   path = /shared/netlogon
   guest ok = yes
   writable = no
   share modes = no
   oplocks = no

#admin users = root
printer admin = root
   comment = All Printers
   browseable = yes
   path = /tmp
   printable = yes
   public = yes
   guest ok = yes
   writable = no
   create mode = 0700
   printer admin = root

#admin users = root
printer admin = root
   comment = Printer Drivers
   path = /etc/samba/drivers
   browseable = yes
   guest ok = no
   readonly = yes
   write list = root

   comment = User printer drivers
   path = /shared/printdrivers
   browseable = no
   guest ok = no
   readonly = yes
   oplocks = no
   write list = kweaver

   comment = Engineering tests
   path = /shared/data/engtests
   browseable = yes
   guest ok = no
   readonly = no
   oplocks = no
   writeable = yes
   ; write list = @engtests
   read list = @engtests
   create mask = 0664
   directory mask = 0775

# A sample share for sharing your CD-ROM with others.
;   comment = Samba server's CD-ROM
;   writable = no
;   locking = no
;   path = /cdrom
;   public = yes

# The next two parameters show how to auto-mount a CD-ROM when the
#	cdrom share is accesed. For this to work /etc/fstab must contain
#	an entry like this:
#       /dev/scd0   /cdrom  iso9660 defaults,noauto,ro,user   0 0
# The CD-ROM gets unmounted automatically after the connection to the
# If you don't want to use auto-mounting/unmounting make sure the CD
#	is mounted on /cdrom
;   preexec = /bin/mount /cdrom
;   postexec = /bin/umount /cdrom

More information about the samba mailing list