[Samba] Troubleshooting help?

[Scott Z.]

I probably should have lead with this, but I did not create or deploy this particular setup, I was charged with keeping it going after the main person left.  I have zero experience with Samba or Centrify, or I should say *had* no experience until this.

So, I frankly have very little idea of what most of these options are for or why they're set the way they are.  I can certainly edit per your suggestions and see if it helps at all.  I have noticed that as people are getting window pop-ups asking them to enter their credentials (which they shouldn't get of course), I'm seeing a corresponding error in the log.smbd file that says "lookup_name_smbconf for <domain>\<user> failed", so I'm trying to see if I can find anything more specific about what might be causing that issue.

Also, I do have samba-winbind-4.8.3 installed and winbind appears to be running (ps -ef |grep winbind returns two lines of "/usr/sbin/winbindd -s /etc/centrifydc/smb2.conf"). As to why this is using Centrify vice any other product, I cannot speak to that.
Thanks much!
Scott

________________________________
From: samba <samba-bounces at lists.samba.org> on behalf of Rowland Penny via samba <samba at lists.samba.org>
Sent: Monday, January 28, 2019 8:35 AM
To: samba at lists.samba.org
Subject: Re: [Samba] Troubleshooting help?

On Mon, 28 Jan 2019 17:19:03 +0000
Scott Z. <sudz28 at hotmail.com> wrote:

> Thank you Rowland!  I guess that's part of my confusion, I'm not sure
> how to best debug where Centrify ends and Samba begins.  But if these
> log.smbd errors indicate Centrify vice Samba, I'm good with that.  My
> global smb.conf is (didn't bother with the commented out stuff):

I have added some comments to your smb.conf:

[global]
security = ADS
realm = <our domain name>
workgroup = <our workgroup name>
netbios name = <the server name> <-- don't really need this
machine password timeout = 0 <-- Why is this turned off ?
passdb backend = tdbsam:/var/lib/samba/private/passdb.tdb <-- you don need anything after 'tdbsam', but you do not need the whole line, it is the default setting
kerberos method = secrets and keytab
server signing = auto <-- bad idea to set this
client ntlmv2 auth = yes <-- Default setting
ntlm auth = yes <-- do you really want to use
client use spnego = yes <-- Default setting
template shell = /bin/bash
winbind use default domain = Yes
winbind enum users = No <-- Default setting
winbind enum groups = No <-- Default setting
winbind nested groups = Yes <-- Default setting
idmap cache time = 0 <-- this turns winbind's cache off
idmap config * : backend = tdb
idmap config * : range = 1000 - 200000000 <-- bad range, you cannot have any local Unix users
idmap config * : base_tdb = 0 <-- what is this ??
enable core files = false <-- if Samba crashes, you will not get any core dumps
log level = 2

Or to put it another way, it only needs to be this:

[global]
security = ADS
realm = <our domain name>
workgroup = <our workgroup name>
kerberos method = secrets and keytab
template shell = /bin/bash
winbind use default domain = Yes
idmap config * : backend = tdb
idmap config * : range = 1000 - 200000000
log level = 2

If this was a normal Samba Unix domain member
it would also have (at least) these two lines:

idmap config <our workgroup name> : backend = rid
idmap config <our workgroup name> : range = 2000000001 - 300000000

You are using Samba 4.8.3, so you need to have winbind running, so now
we come to the big question:

Why do you feel you need Centrify instead of winbind ?

What does it give you that Samba + winbind doesn't ?

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba