[Samba] cannot login as with domain userid's on AIX

Thu Feb 17 11:22:35 GMT 2005

Hi 

I am trying to configure Samba with ADS integration on AIX 5.2.

I am unable to login to the Aix server using credentials of Domain user.

I am able to join to windows Domain and able to fetch list of windows
domain users with the command

/usr/local/samba/bin/wbinfo -u and also the groups with
usr/local/samba/bin/wbinfo -g .

I have added the below line methods.cfg

WINBIND

        program = /usr/lib/security/WINBIND

        options = authonly

Also included 

Default:

            SYSTEM = "WINBIND or compat" in /etc/security/user file.

/usr/local/samba/bin/smbclient -k -U administrator -L
mailsrvr.restore.com  - works fine too

Kinit works fine.

Output of klist is : 

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: administrator at RESTORE.COM

Valid starting     Expires            Service principal

02/17/05 15:37:01  02/18/05 01:37:04  krbtgt/RESTORE.COM at RESTORE.COM

        renew until 02/18/05 15:37:01

02/17/05 16:07:14  02/18/05 01:37:04  mailsrvr$@RESTORE.COM

        renew until 02/18/05 15:37:01

Kerberos 4 ticket cache: /tmp/tkt0

klist: You have no tickets cached

The /var/log/samba/winbindd.log has the following: 

[2005/02/17 16:30:50, 3] nsswitch/winbindd_ads.c:trusted_domains(832)

  ads: trusted_domains

[2005/02/17 16:30:50, 3] libads/ldap.c:ads_connect(247)

  Connected to LDAP server 10.80.0.120

[2005/02/17 16:30:50, 3] libads/ldap.c:ads_server_info(2432)

  got ldap server name mailsrvr at RESTORE.COM, using bind path:
dc=RESTORE,dc=COM

[2005/02/17 16:30:50, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(109)

  IPC$ connections done anonymously

[2005/02/17 16:30:50, 3] libsmb/cliconnect.c:cli_start_connection(1382)

  Connecting to host=MAILSRVR

[2005/02/17 16:30:50, 3] lib/util_sock.c:open_socket_out(752)

  Connecting to 10.80.0.120 at port 445

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(713)

  Doing spnego session setup (blob length=109)

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 48018 1 2 2

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2 3

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 3 6 1 4 1 311 2 2 10

[2005/02/17 16:30:50, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(745)

  got principal=mailsrvr$@RESTORE.COM

[2005/02/17 16:30:51, 2]
libsmb/cliconnect.c:cli_session_setup_kerberos(538)

  Doing kerberos session setup

[2005/02/17 16:30:51, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(319)

  Ticket in ccache[MEMORY:cliconnect] expiration Fri, 18 Feb 2005
02:31:08 PAKST

[2005/02/17 16:35:51, 3] nsswitch/winbindd_ads.c:trusted_domains(832)

  ads: trusted_domains

[2005/02/17 16:35:51, 3] libads/ldap.c:ads_connect(247)

  Connected to LDAP server 10.80.0.120

[2005/02/17 16:35:51, 3] libads/ldap.c:ads_server_info(2432)

  got ldap server name mailsrvr at RESTORE.COM, using bind path:
dc=RESTORE,dc=COM

[2005/02/17 16:35:51, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(109)

  IPC$ connections done anonymously

[2005/02/17 16:35:51, 3] libsmb/cliconnect.c:cli_start_connection(1382)

  Connecting to host=MAILSRVR

[2005/02/17 16:35:51, 3] lib/util_sock.c:open_socket_out(752)

  Connecting to 10.80.0.120 at port 445

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(713)

  Doing spnego session setup (blob length=109)

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 48018 1 2 2

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 2 840 113554 1 2 2 3

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)

  got OID=1 3 6 1 4 1 311 2 2 10

[2005/02/17 16:35:51, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(745)

  got principal=mailsrvr$@RESTORE.COM

[2005/02/17 16:35:51, 2]
libsmb/cliconnect.c:cli_session_setup_kerberos(538)

  Doing kerberos session setup

[2005/02/17 16:35:51, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(319)

Ticket in ccache[MEMORY:cliconnect] expiration Fri, 18 Feb 2005 02:41:08
PAKST

I am looking for the steps that need to be followed on the PAM / krb
side to be able to login to AIX

Server with the windows domain user credentials

Here are my smb.conf and krb5.

Any help on this would be great.

Smb.conf

[        workgroup = restore

        server string = Samba Server

        log file = /var/log/samba/%m.log

        log level = 3

        max log size = 50

        security =  ADS

        realm = RESTORE.COM

        use kerberos keytab = Yes

        password server =  10.80.0.120

        winbind separator = #

        idmap uid = 10000-20000

        idmap gid = 10000-20000

        winbind cache time = 15

        winbind enum users = yes

        winbind enum groups = yes

        template homedir = /home/%D/%U

        template shell = /bin/bash

        winbind use default domain = yes

        obey pam restrictions = yes

[homes]

        comment = Home Directories

        browseable = no

        writeable = yes

        create mask = 0640

krb5.conf

[libdefaults]

        default_realm = RESTORE.COM

        ticket_lifetime = 24000

        dns_lookup_realm = true

        dns_lookup_kdc = true

        krb4_config = /usr/krb5-1.3.6/src/config-files/krb.conf

#       krb4_realms = /usr/kerberos/lib/krb.realms

[realms]

        RESTORE.COM  = {

                admin_server = mailsrvr.restore.com

                kdc = mailsrvr.restore.com

                default_domain = RESTORE.COM

        }

[kdc]

 profile = /usr/krb5-1.3.6/src/config-files/kdc.conf

[domain_realm]

        .restore.com = RESTORE.COM

         restore.com = RESTORE.COM

[domain_realm]

        .restore.com = RESTORE.COM

[logging]

#       kdc = CONSOLE

 default = FILE:/var/log/krb5libs.log

 kdc = FILE:/var/log/krb5kdc.log

 admin_server = FILE:/var/log/kadmind.log

[appdefaults]

 pam = {

   debug = true

   ticket_lifetime = 36000

   renew_lifetime = 36000

   forwardable = true

   krb4_convert = false

 }

Any help would be greatly appreciated.

Regards,

Shaista 

DISCLAIMER:
This message contains privileged and confidential information and is intended only for the individual named.If you are not the intended recipient you should not disseminate,distribute,store,print, copy or deliver this message.Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted,corrupted,lost,destroyed,arrive late or incomplete or contain viruses.The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.