[Samba] Windows pre-requisites for login with winbind?

A. James Lewis james at fsck.co.uk
Mon Aug 21 16:47:24 UTC 2017

August 21, 2017 5:34 PM, "Rowland Penny via samba" <samba at lists.samba.org> wrote:

> On Mon, 21 Aug 2017 15:37:03 +0000
> "A. James Lewis" <james at fsck.co.uk> wrote:
>> OK, obviously I am slightly sanitising the output here, but I'm
>> preserving the case, and just replacing local names with generic ones
>> as I did for the config.
> Not a problem with doing that ;-)
>> # more /etc/hosts
>> localhost
>> hostname01
> OK, does this computer get its ip via dhcp ?
> if it does, just remove the '' line.
> If it doesn't, remove the '' line and add a line:
Yes, it is an lxc container, so currently it does get it's IP from DHCP... none of that config was added by me, except the winbind in nsswitch.conf.

> <ip for hostname01> hostname01.domain.local hostname01
>> # more /etc/resolv.conf
>> search domain.local
>> nameserver
> Is '' the ipaddress of the AD DC (or something that will get
> you to the AD DC ?
It's the resolveconf DNS server on the machine hosting LXC, but yes, it is definitely able to resolve the AD server.

Everything seems to work as expected:-

# nslookup LOCAL_AD03.domain.local

Non-authoritative answer:
Name:	LOCAL_AD03.domain.local
Address: 10.x.x.x

# telnet LOCAL_AD03.domain.local 88
Trying 10.x.x.x...
Connected to LOCAL_AD03.domain.local.
Escape character is '^]'.
Connection closed by foreign host.

# getent passwd jlewis
jlewis:*:54239:5513:Lewis, James:/home/DOMAIN/jlewis:/bin/bash

Clearly it picked up the "LOCAL_AD03.domain.local" from somewhere, since that's not in the configuration, and I can look up (and log in as my own user).

I don't know however why kinit is now having a problem (it did not when I explicitly specified the KDC servers).

The 3 most recently added users simply cannot authenticate, and this is where I'm convinced it is related to their AD accounts:-

# getent passwd otheruser

That said, I would much prefer not to explicitly specify stuff in the config if possible, since that's one less thing to maintain!


> Rowland
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba

A. James Lewis (james at fsck.co.uk)
"Engineering does not require science. Science helps a lot but people
built perfectly good brick walls long before they knew why cement works."

More information about the samba mailing list