[Samba] Samba 3.5.6 pam problems

Andrew Lyon andrew.lyon at gmail.com
Wed Oct 20 06:10:16 MDT 2010


On Wed, Oct 20, 2010 at 12:46 PM, Andrew Lyon <andrew.lyon at gmail.com> wrote:
> Hi,
>
> I've setup Samba 3.5.6 as a member server in a 2003R2 domain with a
> single dc, idmapping is by rfc2307 with a tdb backend for builtin
> accounts etc, I can list users and groups using wbinfo and I can
> create shares and access them from the windows server, files and
> folders owned by ad users show the correct user and group names so
> mapping appears to be working, I can su to ad accounts but I am unable
> to ssh into the system as a AD user.
>
> Relevant config files:
>
> cat /etc/samba/smb.conf
>
>
> [global]
> debug hires timestamp = yes
>        workgroup = SAMBATEST
>        security = ADS
>        winbind use default domain = true
>        realm = SAMBATEST.LOCAL
>        server string = Samba file and print server
>        log level = 3
>        max log size = 4192
>        printcap name = cups
>        idmap config SAMBATEST : backend  = ad
>        idmap config SAMBATEST : range = 10000-10020
>        idmap config SAMBATEST : schema_mode = rfc2307
>        idmap config SAMBATEST : default = yes
>        idmap backend = tdb
>        idmap uid = 10100-10110
>        idmap gid = 10100-10110
>        winbind separator = +
>        winbind enum users = Yes
>        winbind enum groups = Yes
>        winbind refresh tickets = Yes
>        winbind normalize names = Yes
>        winbind nested groups = Yes
>        client ntlmv2 auth = yes
>        encrypt passwords = yes
>        password server = w2k3r2svr.sambatest.local
>        template shell = /bin/bash
> [homes]
>        comment = Home Directories
>        read only = No
>
> [printers]
>        comment = All Printers
>        guest ok = Yes
>        printable = Yes
>        browseable = No
>        available = No
>
> cat /etc/pam.d/sshd
> auth       include      system-remote-login
> account    include      system-remote-login
> password   include      system-remote-login
> session    include      system-remote-login
>
> cat /etc/pam.d/system-remote-login
> auth            include         system-login
> account         include         system-login
> password        include         system-login
> session         include         system-login
>
> cat /etc/pam.d/system-login
> auth            required        pam_tally.so onerr=succeed
> auth            required        pam_shells.so
> auth            required        pam_nologin.so
> auth            include         system-auth
>
> account         required        pam_access.so
> account         required        pam_nologin.so
> account         include         system-auth
> account         required        pam_tally.so onerr=succeed
>
> password        include         system-auth
>
> session         required        pam_env.so
> session         optional        pam_lastlog.so
> session         include         system-auth
> session         optional        pam_ck_connector.so nox11
> session         optional        pam_motd.so motd=/etc/motd
> session         optional        pam_mail.so
>
> file /etc/pam.d/system-auth
> /etc/pam.d/system-auth: symbolic link to `system-auth-winbind'
>
>  cat /etc/pam.d/system-auth-winbind
> #%PAM-1.0
> # $Header: /var/cvsroot/gentoo-x86/net-fs/samba/files/3.5/system-auth-winbind.pam,v
> 1.1 2010/03/01 16:19:54 patrick Exp $
>
> auth        required      pam_env.so
> auth        sufficient    pam_winbind.so
> auth        sufficient    pam_unix.so likeauth nullok use_first_pass
> auth        required      pam_deny.so
>
> account     sufficient    pam_winbind.so
> account     sufficient    pam_unix.so
>
> password    required      pam_cracklib.so retry=3
> password    sufficient    pam_unix.so nullok use_authtok md5 shadow
> password    required      pam_deny.so
>
> session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022
> session     required      pam_limits.so
> session     sufficient    pam_unix.so
>
> Trust is ok:
>
> wbinfo -t
> checking the trust secret for domain SAMBATEST via RPC calls succeeded
>
>
> I can authenticate the user using kerberos
>
> kinit testuser
> Password for testuser at SAMBATEST.LOCAL:
> klist
> Ticket cache: FILE:/tmp/krb5cc_0
> Default principal: testuser at SAMBATEST.LOCAL
>
> Valid starting     Expires            Service principal
> 10/20/10 12:28:11  10/20/10 19:08:11  krbtgt/SAMBATEST.LOCAL at SAMBATEST.LOCAL
>
> And with wbinfo:
>
>
> wbinfo -a testuser%abcABC123
> plaintext password authentication failed
> Could not authenticate user testuser%abcABC123 with plaintext password
> challenge/response password authentication succeeded
>
> When authenticating with wbinfo the following events are logged to log.winbindd
>
> [2010/10/20 12:39:25.902284,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 2329]: request interface version
> [2010/10/20 12:39:25.902435,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 2329]: request location of privileged pipe
> [2010/10/20 12:39:25.902626,  3] winbindd/winbindd_pam.c:818(winbindd_pam_auth)
>  [ 2329]: pam auth testuser
> [2010/10/20 12:39:25.911435,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 2329]: request interface version
> [2010/10/20 12:39:25.911533,  3] winbindd/winbindd_misc.c:340(winbindd_info)
>  [ 2329]: request misc info
> [2010/10/20 12:39:25.911628,  3]
> winbindd/winbindd_misc.c:373(winbindd_netbios_name)
>  [ 2329]: request netbios name
> [2010/10/20 12:39:25.911724,  3]
> winbindd/winbindd_misc.c:362(winbindd_domain_name)
>  [ 2329]: request domain name
> [2010/10/20 12:39:25.911816,  3]
> winbindd/winbindd_misc.c:244(winbindd_domain_info)
>  [ 2329]: domain_info [SAMBATEST]
> [2010/10/20 12:39:25.912161,  3]
> winbindd/winbindd_pam.c:1768(winbindd_pam_auth_crap)
>  [ 2329]: pam auth crap domain: [SAMBATEST] user: testuser
>
>
> But when I try to ssh into the samba server as testuser the
> authentication fails, the winbindd log entries are:
>
> [2010/10/20 12:41:39.712313,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:41.208210,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 6462]: request interface version
> [2010/10/20 12:41:41.208378,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 6462]: request location of privileged pipe
> [2010/10/20 12:41:41.208596,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:41.209050,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:55.790569,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 6889]: request interface version
> [2010/10/20 12:41:55.790795,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 6889]: request location of privileged pipe
> [2010/10/20 12:41:55.791038,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:55.795625,  3]
> winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send)
>  getgroups testuser
> [2010/10/20 12:41:55.798148,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 6891]: request interface version
> [2010/10/20 12:41:55.798304,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 6891]: request location of privileged pipe
> [2010/10/20 12:41:55.798580,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:55.799019,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:57.789992,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 6891]: request interface version
> [2010/10/20 12:41:57.790115,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 6891]: request location of privileged pipe
> [2010/10/20 12:41:57.790277,  3] winbindd/winbindd_pam.c:818(winbindd_pam_auth)
>  [ 6891]: pam auth testuser
> [2010/10/20 12:41:57.807080,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:59.716477,  3]
> winbindd/winbindd_misc.c:352(winbindd_interface_version)
>  [ 7019]: request interface version
> [2010/10/20 12:41:59.716632,  3]
> winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
>  [ 7019]: request location of privileged pipe
> [2010/10/20 12:41:59.716828,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
> [2010/10/20 12:41:59.717221,  3]
> winbindd/winbindd_getpwnam.c:55(winbindd_getpwnam_send)
>  getpwnam testuser
>
>
> log.wb-SAMBATEST (the name of the windows dc) logs the following errors:
>
> [2010/10/20 12:43:15.749729,  3]
> winbindd/winbindd_pam.c:1466(winbindd_dual_pam_auth)
>  [ 2769]: dual pam auth SAMBATEST+testuser
> [2010/10/20 12:43:15.750852,  2]
> winbindd/winbindd_pam.c:1722(winbindd_dual_pam_auth)
>  Plain-text authentication for user SAMBATEST\testuser returned
> NT_STATUS_NO_SUCH_USER (PAM: 10)
>
>
> I've tried using ssh -l testuser and ssh -l SAMBATEST+testuser, it
> makes no difference to the result or the log entries.
>
> getent passwd/group returns only local users, perhaps a clue as to
> what is wrong?
>
> Any suggestions would be appreciated, I've been trying to get this
> working for quite a while but I seem to have hit a wall.
>
> Andy
>

Trypical, try to fix something for 2 days and a few mins after posting
the problem I figured it out, it appears that winbind separator = +
causes pam authentication to fail, after commenting out that line I
can login using ssh.

Looks like I'm not the only person to hit this problem
http://www.linuxquestions.org/questions/linux-server-73/getting-pam-working-with-samba-with-active-directory-authentication-639165/
, perhaps it is a bug after all? winbind should know what separator is
being used shouldn't it?

Andy


More information about the samba mailing list