[Samba] Configuring RHEL6 Samba4 DC for local accounts

[Rowland Penny]

On 26/01/14 19:42, Michael Brown wrote:
> On 14-01-26 02:10 PM, Rowland Penny wrote:
>> Well if you don't count the removal of the sernet-samba packages as a 
>> technical problem, then OK, see here:
>>
>> https://lists.samba.org/archive/samba/2013-December/177449.html 
> Well no, I'd call that a packaging problem (semantics, really). On 
> Ubuntu. Fortunately I'm on RHEL today so it's not an issue.
>
> Anyways, I've followed the example at 
> https://wiki.samba.org/index.php/Local_user_management_and_authentication/sssd 
> exactly (exactly at first, and I've made some modifications with no 
> effect):
>
> # samba-tool domain exportkeytab /etc/krb5.sssd.keytab 
> --principal=exfile01$
> # klist -k /etc/krb5.sssd.keytab
> Keytab name: FILE:/etc/krb5.sssd.keytab
> KVNO Principal
> ---- 
> --------------------------------------------------------------------------
>    1 exfile01$@AD.EXAMPLE.COM
>    1 exfile01$@AD.EXAMPLE.COM
>    1 exfile01$@AD.EXAMPLE.COM
>
> # cat /etc/sssd/sssd.conf
> [sssd]
> services = nss, pam
> config_file_version = 2
> domains = ad.example.com
>
> [nss]
>
> [pam]
>
> [domain/ad.example.com]
> ad_hostname = exfile01.ad.example.com
> ad_server = ad.example.com
> ad_domain = ad.example.com
>
> ldap_schema = rfc2307bis
> id_provider = ldap
> access_provider = simple
> enumerate = true
> auth_provider = krb5
> chpass_provider = krb5
> ldap_sasl_mech = gssapi
> ldap_sasl_authid = exfile01$@AD.EXAMPLE.COM
> krb5_realm = AD.EXAMPLE.COM
> krb5_server = ad.example.com
> krb5_kpasswd = ad.example.com
> ldap_krb5_keytab = /etc/krb5.sssd.keytab
> ldap_krb5_init_creds = true
>
> ldap_referrals = false
> ldap_uri = ldap://ad.example.com
> ldap_search_base = dc=ad,dc=example,dc=com
>
> dyndns_update=false
>
> ldap_id_mapping=false
>
> ldap_user_object_class = user
> ldap_user_name = samAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
>
> ldap_group_object_class = group
> ldap_group_name = cn
> ldap_group_member = member
>
> But when I start sssd I get:
>
> Jan 26 14:31:22 exfile01 sssd_be: GSSAPI Error: Unspecified GSS 
> failure.  Minor code may provide more information (Server not found in 
> Kerberos database)
>
> My krb5.conf looks like:
> [libdefaults]
>  default_realm = AD.IRPRUBBER.COM
>  dns_lookup_realm = false
>  dns_lookup_kdc = true
>  #rdns = false
>
> I tried with and without rdns=false. Then I fixed forward/reverse for 
> the host so they were identical. No luck :(
>
> I'm stumped - anyone know where to go from here?
>
> M.
>
> -- 
> Michael Brown               | `One of the main causes of the fall of
> Systems Consultant          | the Roman Empire was that, lacking zero,
> Net Direct Inc.             | they had no way to indicate successful
> ☎: +1 519 883 1172 x5106    | termination of their C programs.' - Firth
Is your DC really called ad.example.com or is it 
hostname.ad.example.com? either way I do not think your sssd.conf is 
going to work, also is there any chance you can update sssd to the 
latest 1.11 series?

Rowland