[Samba] L2tp and winbind - server role active directory domain controller

[Achim Gottinger]

Am 30.08.2016 um 15:05 schrieb Gilberto Nunes via samba:
> Hello list...
>
> I have samba 4.1.17 installed and in the same server, I have l2tp.
> Samba it configurated as active directory domain controller.
>
> I am trying authetication against samba with winbind.
> I want to know how to restrict authentication for certain group.
> I put this line in the end of l2tp conf file:
>
> ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1
> --require-membership-of="domain\\VPN"'
>
> But I get this in the log.windbindd:
>
>   server role = 'active directory domain controller' not compatible with
> running the winbindd binary.
>    You should start 'samba' instead, and it will control starting the
> internal AD DC winbindd implementation, which is not the same as this one
>
> And seem to me group restriction do not work!
> Instead, any usser can connect via l2tp vpn.
>
> Somebody can help??
>
> Thanks a lot
>
> Gilberto Ferreira
You can use freeradius with mschap (ntlm_auth) and ldap (for group 
memebership requirements) configured to connect to you ad server. Then 
configure l2tp to use that freeradius server for authentification.