[Samba] Is it EVER needed to set up kerberos manually if you usesamba to join an ADS domain as a domain member?

[Gary Wardell]

Hi,

thank you for this information.  Now if I can actually do it.

I am a long time windows admin and have never had to mess with kerberos.  Always I would simply go to the member machine and join
the domain and everything would work.  I sort of assumed Samba would be as easy and work the same way.  Especially since my
"friend" said that OpenSUSE with Yast would take care of all of the pluming necessary to set things up.  No so, and I have been
fighting with Samba ever since.  I finally got it to sort of work be creating user accounts on the Linux machine that mirrored the
AD accounts that were trying to access it.  But that is far from ideal.

Gary

> -----Original Message-----
> From: samba-bounces at lists.samba.org
> [mailto:samba-bounces at lists.samba.org]On Behalf Of Clayton Hill
> Sent: Thursday, April 22, 2010 17:49
> To: samba at lists.samba.org
> Cc: Duncan Fiander
> Subject: [Samba] Is it EVER needed to set up kerberos manually if you
> usesamba to join an ADS domain as a domain member?
> 
> 
> Hi folks!
> 
>  
> 
> We finally have an answer to a question posted in 2009... and 
> the answer
> is: YES SET UP KERBEROS.
> 
> Here is the original thread:
> 
> http://www.pubbs.net/200910/samba/27283-samba-is-it-ever-neede
> d-to-set-u
> p-kerberos-manually-if-you-use-samba-to-join-an-ads-domain-as-
> a-domain-m
> ember.html
> 
>  
> 
>  
> 
> Now here is the correct answer:
> 
> --------------------------------------------------------------
> ----------
> --------
> 
> Just a quick experiment for you to try.
> 
>  
> 
> Logon to a samba member server that has joined a domain and run the
> following:
> 
>  
> 
> This should show that we have no Kerberos ticket since we did not do a
> kinit.  
> 
> (This is because we used net ads join -U Administrator and joined the
> domain only through the net ads function.)
> 
> #klist
> 
>  
> 
> Now query the domain and check the response
> 
> #net ads user
> 
> #net ads group
> 
>  
> 
> From the Computer Management Snap-In on Windows, connect to the samba
> member server and check to see if you can change ACL's on a 
> Share and if
> it has any effect. 
> 
>  
> 
> Now initialize Kerberos.
> 
> #kinit  -U admin at MYDOMAIN.NET
> 
>  
> 
> Re-run the commands above and note the change
> 
> #klist
> 
> #net ads user
> 
> #net ads group
> 
>  
> 
> From the Computer Management Snap-In on Windows, connect to the samba
> member server and check to see if you can change ACL's on a Share
> 
>  
> 
> You should find that with Kerberos enabled we are able to see 
> objects in
> AD we were not previously able to display.
> 
>  
> 
> Also in the MMC Snap-In if you remove Everyone from  the 
> share you will
> no longer have access to the share.  If you add everyone back in, they
> will have access.
> 
>  
> 
> You can also add ACL's via Windows Explorer as before. 
> 
>  
> 
> As you can see, this is an important ability you miss out on 
> if you only
> use net ads join to get your Kerberos ticket.
> 
> I would hope that a samba team contributor eventually implements this
> into the net ads join function better so this isn't needed.
> 
>  
> 
>  
> 
> -Give credit where it is due-
> 
> Originally Submitted by: 
> 
> Duncan Fiander
> 
>  
> 
>  
> 
>  
> 
>  
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba