[Samba] AD4Unix & Samba-3.0.20b+winbind (UPDATE)

[Jason Gerfen]

Ok in my test environment I just got done updating the schema on the 
Win2K domain to include the AD4Unix package and I am still able to 
authentication and view all users from any container including the 
CN=Users (default) and a new OU=authenticated.  Can someone please help 
me out on this?  The only major difference between the test domain and 
the live domain is the number of users at this point and the container 
setup in AD.

Jason Gerfen wrote:

> Scenario:  Samba-3.0.20b domain member server on SuSE 9.3 (w/ all 
> available patches applied) providing kerberos authentication through a 
> Windows 2000 domain with AD4Unix services installed.
>
> Problem(s):
> 1. Can only view users from one OU in Active Directory (default is: 
> CN=Users, problem container is: OU=authenticated)
> 2. According to log.winbind and log.smbd authentication fails with 
> error:   check_ntlm_password:  Authentication for user [testj] -> 
> [testj] FAILED with error NT_STATUS_WRONG_PASSWORD.  Is this error due 
> to falling back to NTLM authentication vs. Kerberos TGT systems?
>
> Troubleshooting performed:
> 1. Used 'net ads leave' to remove from domain, updated Samba+Winbind 
> from 3.0.13 to 3.0.20b
> 2. Manually removed machine trust account from active directory
> 3. Manually removed cache files for Samba prior to upgrade
> 4. Attempted using 3.0.21rc1 release with same results
> 5. Created a Win 2K test domain w/o AD4Unix and Samba-3.0.13 ADS 
> member server which would authenticate via Kerberos without problems.
> 6. Upgraded Samba to 3.0.20b and still worked fine on test domain w/o 
> AD4Unix setup
> 7. Am in the process of upgrading Win2K domain server (in test env.) 
> to provide AD4Unix services to see if it breaks.
>
> Any help, insight into this is definately appreciated
>
> Here is the pertinent configuration files:
>
> [smb.conf]
> [global]
>        workgroup = DOMAIN
>        realm = DOMAIN.COM
>        server string = new-odin.domain.com
>        security = ADS
>        update encrypted = Yes
>        encrypt passwords = yes
>        password server = *
>        preferred master = No
>        domain master = No
>        idmap uid = 500-500000
>        idmap gid = 500-500000
>        winbind trusted domains only = yes
>        winbind separator = /
>        winbind cache time = 5
>        winbind use default domain = Yes
>        winbind nested groups = Yes
>        log level = 2
>        interfaces = eth*
>        bind interfaces only = yes
>        socket options = IPTOS_LOWDELAY TCP_NODELAY
>
> [images]
>        comment = ODIN
>        user = %S
>        path = /odin/images
>        inherit acls = Yes
>        browseable = yes
>        writeable = yes
>        read only = no
>        public = yes
>
>
> [home]
>        comment = User Home Directories
>        user = %S
>        path = /odin/home/%S
>        inherit acls = Yes
>        writeable = yes
>        read only = no
>        public = no
>        browseable = yes
>
> [krb5.conf]
> [libdefaults]
> default_realm = DOMAIN.COM
> clockskew = 300
>
> [realms]
> UTAH.EDU = {
> kdc = 192.168.0.10
> default_domain = domain.com
> admin_server = 192.168.0.10
> }
>
>
> [logging]
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmin.log
> default = FILE:/var/log/krb5lib.log
>
> [domain_realm]
> .domain.com = DOMAIN.COM
> domain.com = DOMAIN.COM
>
> [appdefaults]
> pam = {
> ticket_lifetime = 1d
> renew_lifetime = 1d
> forwardable = true
> proxiable = false
> retain_after_close = false
> minimum_uid = 0
> }
>
> [nsswitch.conf]
> passwd: files winbind
> shadow: files winbind
> group:  files winbind
>
> hosts:  files dns winbind
> networks:       files dns
>
> services:       files
> protocols:      files
> rpc:    files
> ethers: files
> netmasks:       files
> netgroup:       files
> publickey:      files
>
> bootparams:     files
> automount:      files nis
> aliases:        files
>


-- 
Jason Gerfen

"Oh I have seen alot of what
 the world can do, and its
 breaking my heart in two..."
 ~ Wild World, Cat Stevens