[Samba] Re: authentication against win2k3 server

[Kevin Kobb]

Carissa Srugis wrote:

> I've been trying to setup Samba to authenticate users against accounts
> existing on a Windows 2003 Server without any backwards capability. 
> Ideally, this needs to be done without any changes to the Windows 2003
> Server.  Users will not be logging into the Samba shares at all.  This
> is merely for authentication.
> 
> I'm running FreeBSD 4.10-Relase #4 with Samba 3.0.8.
> 
> This is my smb.conf file:
> [global]
>       realm = WIN2K3.DOMAIN.LOCAL
>       security = ads
>       auth methods = winbind
>       winbind separator = +
>       encrypt passwords = yes
>       workgroup = DOMAIN.LOCAL
>       netbios name = FREEBSD_Machine
>       winbind uid = 10000-20000
>       winbind gid = 10000-20000
>       winbind enum users = yes
>       winbind enum groups = yes
>       idmap uid = 10000-20000
>       idmap gid = 10000-20000
>       password server = WIN2K3.DOMAIN.LOCAL
> 
> So once winbindd is running, I type the following and get these results:
> 
> freebsd_machine# net ads join member -I 192.168.0.1 -U administrator
> administrator's password: *password*
> [2004/11/16 14:27:06, 0] libsmb/nmblib.c:send_udp(793)
>   Packet send failed to 127.255.255.255(137) ERRNO=Permission denied
> [2004/11/16 14:27:07, 0] libsmb/nmblib.c:send_udp(793)
>   Packet send failed to 127.255.255.255(137) ERRNO=Permission denied
> [2004/11/16 14:27:07, 0] utils/net_ads.c:ads_startup(186)
>   ads_connect: Permission denied
> 
> In the winbindd log I've also gotten the following error messages at
> one point or another:
> 
> Could not fetch sid for our domain WIN2K3.DOMAIN.LOCAL
> Packet send failed to 127.255.255.255(137) ERRNO=Permission denied
> ads_connect for domain WIN2K3.DOMAIN.LOCAL failed: Permission denied
> get_trust_pw: could not fetch trust account password for my domain DOMAIN.LOCAL
> 
> The odd part is when I try to use wbinfo to verify connections.  If I
> type "wbinfo -g" it will display the correct group listing from the
> win2k3 server.  But nothing else seems to work:
> 
> freebsd_machine# wbinfo -t
> checking the trust secret via RPC calls failed
> error code was NT_STATUS_INTERNAL_ERROR (0xc00000e5)
> Could not check secret
> 
> freebsd_machine# wbinfo -u
> Error looking up domain users
> 
> freebsd_machine# wbinfo --domain-info=DOMAIN.LOCAL
> Name              : WIN2K3.DOMAIN.LOCAL
> Alt_Name          : DOMAIN.LOCAL
> SID               : S-0-0
> Active Directory  : No
> Native            : No
> Primary           : Yes
> Sequence          : -1
> 
> I'm obviously missing something, but I am at a loss.  Any help is
> greatly appreciated!
> 
> Carissa Srugis
> 
> 

You might try looking at FreeBSD 5.3. I don't believe 4.10 has a working 
nsswitch which I think you will need if you want to login into FreeBSD 
without a local account, but just a AD account.

I have done this on our Windows domain and FreeBSD 5.3 and it works OK. 
Join the machine to the domain, modify pam files, and nsswitch.conf, and 
  it worked.