[Samba] Pam-logon failure for AD users

L.P.H. van Belle belle at bazuin.nl
Wed Dec 16 13:15:02 UTC 2015


I see 2 things here which are strange. 

Self compiled samba 
> >> /usr/local/samba/bin/wbinfo --pam-logon="DOMAIN\testusr1"

Debian samba ? or older version installed and not latest. 
> >> Samba version : 4.1.17

Which is it? self compiled or debian samba? 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens VigneshDhanraj G
> Verzonden: woensdag 16 december 2015 13:25
> Aan: Rowland penny
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] Pam-logon failure for AD users
> 
> Thanks rowland, I understand that there was a mess. and now i changed the
> smb.conf with the above as you instructed to be. But still i found same
> issue. I have two systems which connect to same AD. i found to different
> winbind logs. One uses pam_auth and other one which is not working uses
> pam_auth_crap while using pam logon. I browsed on this but unfortunately i
> am not able to find anything useful.
> 
> May i know please, whats the difference between pam_auth and
> pam_auth_crap.
> may this would be the problem?
> 
> could you please help me regarding this.
> 
> Regards,
> 
> Vigneshdhanraj G
> 
> On Sat, Dec 12, 2015 at 3:05 PM, Rowland penny <rpenny at samba.org> wrote:
> 
> > On 12/12/15 08:53, VigneshDhanraj G wrote:
> >
> >> sorry for the late response Rowland,
> >>
> >> I didn't change the smb.conf with the same smb.conf, i configured new
> AD
> >> that works fine. Do you need to change the smb.conf could you please
> tell
> >> me what i need to change specifically. And i also suspect that problem
> with
> >> my AD server. But i am not able to find the exact problem, The
> confusion is
> >> Ftp works with same pam working fine but cifs always shows access
> denied.
> >> if password is wrong it shows Wrong password.
> >>
> >> Regards,
> >>
> >> Vigneshdhanraj G
> >>
> >> On Thu, Dec 10, 2015 at 2:41 PM, Rowland penny <rpenny at samba.org
> <mailto:
> >> rpenny at samba.org>> wrote:
> >>
> >>     On 10/12/15 07:49, VigneshDhanraj G wrote:
> >>
> >>         Hi,
> >>
> >>         This issue not solved, ftp and cifs using same way of
> >>         authentication. but
> >>         when trying to access cifs it always shows the same
> >>         ACCESS_DENIED error.
> >>
> >>         Regards,
> >>
> >>         Vigneshdhanraj G
> >>
> >>
> >>         On Tue, Nov 3, 2015 at 6:36 PM, Rowland Penny
> >>         <rowlandpenny241155 at gmail.com
> >>         <mailto:rowlandpenny241155 at gmail.com>>
> >>
> >>         wrote:
> >>
> >>             On 03/11/15 12:25, VigneshDhanraj G wrote:
> >>
> >>                 Hi Team,
> >>
> >>                 when i am running this command i am getting the
> >>                 following error
> >>                 /usr/local/samba/bin/wbinfo --pam-
> logon="DOMAIN\testusr1"
> >>
> >>                 Enter DOMAIN\testusr1's password:
> >>                 plaintext password authentication failed
> >>                 error code was NT_STATUS_ACCESS_DENIED (0xc0000022)
> >>                 error message was: Access denied
> >>                 pam_logon failed for DOMAIN\testusr1
> >>
> >>                 FTP and Cifs uses pam. Ftp authentication using domain
> >>                 working fine. But,
> >>                 Cifs showing ACCESS_DENIED error.
> >>
> >>                 Samba version : 4.1.17
> >>
> >>                 In winbindd.log i could see
> >>                 [2015/11/03 11:59:46.377088, 10, pid=435, effective(0,
> >>                 0), real(0, 0),
> >>                 class=winbind]
> >>                 ../source3/winbindd/winbindd.c:755(wb_request_done)
> >>                     wb_request_done[559:PAM_AUTH_CRAP]:
> >>                 NT_STATUS_ACCESS_DENIED
> >>
> >>                 My smb.conf is
> >>
> >>                 available= yes
> >>                 restrict anonymous= 0
> >>                 server string= LenovoEMC™ px6-300d
> >>                 Workgroup= DOMAIN
> >>                 netbios name= Debian
> >>                 realm= DOMAIN.LOCAL
> >>                 password server= 192.168.1.100, *
> >>                 idmap backend= tdb
> >>                 idmap uid= 5000-9999999
> >>                 idmap gid= 5000-9999999
> >>                 security= ADS
> >>                 name resolve order= wins host bcast lmhosts
> >>                 client use spnego= yes
> >>                 dns proxy= no
> >>                 winbind use default domain= no
> >>                 winbind nested groups= yes
> >>                 inherit acls= yes
> >>                 winbind enum users= yes
> >>                 winbind enum groups= yes
> >>                 winbind separator= \\
> >>                 winbind cache time= 300
> >>                 winbind offline logon= true
> >>                 template shell= /bin/sh
> >>                 map to guest= Bad User
> >>                 host msdfs= yes
> >>                 strict allocate= yes
> >>                 encrypt passwords= yes
> >>                 passdb backend= smbpasswd
> >>                 printcap name= lpstat
> >>                 printable= no
> >>                 load printers= yes
> >>                 max smbd processes= 500
> >>                 getwd cache= yes
> >>                 syslog= 0
> >>                 use sendfile= yes
> >>                 log level= 0
> >>                 max log size= 50
> >>                 unix extensions= no
> >>                 dos charset= ascii
> >>                 state directory= /mnt/system/samba/system
> >>
> >>
> >>                 Windows client from which i am trying to access cifs
> >>                 is also connected to
> >>                 the domain.
> >>
> >>
> >>
> > Lets be honest, your original smb.conf was a mess, it uses a lot of
> > default settings and a lot of settings that really shouldn't be there,
> this
> > is what it really should have looked like:
> >
> > [global]
> >     Workgroup= DOMAIN
> >     security= ADS
> >     realm= DOMAIN.LOCAL
> >     netbios name= Debian
> >     server string= LenovoEMC™ px6-300d
> > dedicated keytab file = /etc/krb5.keytab
> > kerberos method = secrets and keytab
> > idmap config *:backend = tdb
> > idmap config *:range = 2000-4999
> > idmap config DOMAIN:backend = rid
> > idmap config DOMAIN:range = 5000-9999999
> > winbind nss info = template
> >     winbind enum users  = yes
> >     winbind enum groups = yes
> > winbind refresh tickets = Yes
> >     winbind offline logon= true
> >     dns proxy= no
> >     template shell= /bin/sh
> >     map to guest= Bad User
> >     strict allocate= yes # really meant to be used in a share
> >     printcap name = lpstat
> >     max smbd processes= 500
> >     syslog= 0
> >     max log size= 50
> >     use sendfile= yes
> >     unix extensions= no
> >     state directory= /mnt/system/samba/system # why are you moving this
> to
> > what I presume is a share
> >                             on another system?????
> > vfs objects = acl_xattr
> > map acl inherit = yes
> > store dos attributes = yes
> >
> > The 'tabbed' lines are yours, the others are what I would add.
> >
> >
> > Rowland
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba





More information about the samba mailing list