AD integration Samba issues

[kinitsu]

I have been trying to configure Samba version 2:3.4.7~dfsg-1ubuntu3.1 so that I can get this computer on the existing AD and integrate it with Squid. I already have Squid configured and running on its own so that is off to the side, and I will worry about getting Squid working with the AD once I can actually get on the AD.

Back to samba... after running the command net ads join -U jphillips I get the output

[2010/08/31 10:46:38, 0] lib/smbldap.c:690(smb_ldap_start_tls)
Failed to issue the StartTLS instruction: Server is unavailable
[2010/08/31 10:46:39, 0] lib/smbldap.c:690(smb_ldap_start_tls)
Failed to issue the StartTLS instruction: Server is unavailable
[2010/08/31 10:46:42, 0] lib/smbldap.c:690(smb_ldap_start_tls)
Failed to issue the StartTLS instruction: Server is unavailable
Using short domain name -- JUDICIALSERVICE
Joined 'LINUXBOXTEST' to realm 'judicialservices.net'
No DNS domain configured for linuxboxtest. Unable to perform DNS Update.
DNS update failed!

Here is some info from my smb.conf file.

[global]
#--authconfig--start-line--

# Generated by authconfig on 2010/08/24 14:34:55
# DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
# Any modification may be deleted or altered by authconfig in future

workgroup = judicialservice
password server = JCSCORP000.judicialservices.net
realm = JUDICIALSERVICES.NET
security = ads
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false

#--authconfig--end-line--

client ldap sasl wrapping = sign
winbind enum groups = yes
winbind enum users = yes
usershare allow guests = yes
obey pam restrictions = yes
allow trusted domains = no
idmap backend = idmap_rid:judicialservice=16777216-33554431

If more info is required or you want me to try something just ask. I am tired of banging my head against the keyboard trying to solve this problem.



Also, I have literally just tried a different method of configuring Samba, using the GADMIN GUI. And under this configuration when i do net ads join -U jphillips I receive the output

[2010/08/31 11:18:55, 0] libsmb/cliconnect.c:1607(cli_negprot_recv)
cli_negprot: SMB signing is mandatory and we have disabled it.
Failed to join domain: failed to lookup DC info for domain 'JUDICIALSERVICES.NET' over rpc: Access denied

Here is the global from the smb.conf under the GADMIN config

[global]
[global]
netbios name = Samba24
server string = Samba file and print server
workgroup = JUDICIALSERVICE
password server = JCSCORP000.judicialservices.net
realm = JUDICIALSERVICES.NET
security = ads
hosts allow = 127.192.168.0
interfaces = 127.0.0.1/8 192.168.0.0/24
bind interfaces only = yes
remote announce = 192.168.0.255
remote browse sync = 192.168.0.255
printcap name = cups
load printers = yes
cups options = raw
printing = cups
guest account = smbguest
log file = /var/log/samba/samba.log
max log size = 1000
null passwords = no
username level = 6
password level = 6
encrypt passwords = yes
unix password sync = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
local master = no
domain master = no
preferred master = no
domain logons = no
os level = 33
logon drive = m:
logon home = \\%L\homes\%u
logon path = \\%L\profiles\%u
logon script = %G.bat
time server = no
name resolve order = wins lmhosts bcast
wins support = no
wins proxy = no
dns proxy = no
preserve case = yes
short preserve case = yes
client use spnego = no
client signing = no
client schannel = no
server signing = no
server schannel = no
nt pipe support = yes
nt status support = yes
allow trusted domains = no
obey pam restrictions = yes
enable spoolss = yes
client plaintext auth = no
disable netbios = no
follow symlinks = no
update encrypted = yes
pam password change = no
passwd chat timeout = 120
hostname lookups = no
username map = /etc/samba/smbusers
smb passwd file = /etc/samba/smbpasswd
passwd program = /usr/bin/passwd '%u'
passwd chat = *New*password* %n\n *ReType*new*password* %n\n *passwd*changed*\n
add user script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null '%u'
add user to group script=/usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null -g '%g' '%u'
add group script = /usr/sbin/groupadd '%g'
delete user script = /usr/sbin/userdel '%u'
delete user from group script = /usr/sbin/userdel '%u' '%g'
delete group script = /usr/sbin/groupdel '%g'
add machine script = /usr/sbin/useradd -d /dev/null -g sambamachines -c 'Samba Machine Account' -s /dev/null -M '%u'
machine password timeout = 120
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = yes
winbind separator = +
winbind cache time = 360
winbind trusted domains only = yes
winbind nested groups = no
winbind nss info = no
winbind refresh tickets = no
winbind offline logon = no

So now I wonder which one I should stick with and how to get onto the AD with the one I stick with?

[scorp123]

I'd recommend LikeWise Open .... it just works everytime. I can only recommend it. You just fill in the details for the AD domain and the administrator... and the rest happens automatically.

http://www.likewise.com/products/likewise_open/

There is also a forum ... so if you'd need to adjust things then their forums are a good place to ask about such things.

[kinitsu]

Thank you. Likewise did the trick.

[guimenez]

Please how you do that?

i've installed likewise-open and after lots of problem i've joined the domain. but i can't make the login work.

if i make kinit user@DOMAIN.LOCAL it works well, but with ssh or gui logon it always gives me autentication errors.

any help please?

thanks

[guimenez]

Please, can any one help on this error?

i've successfully join to AD but can't login, even if i try DOMAIN\user

nothing

thanks

[luvshines]

@guimenez

What error do you get in the ssh logs for those users ??

Also what do you get with this:

wbinfo -a <domain>\\<username>%<passwd>

I hope you configured your sshd and system to use Domain authentication

Please start another thread with logs since this thread is already marked [SOLVED], ppl will ignore it mostly

[guimenez]

@guimenez

What error do you get in the ssh logs for those users ??

Also what do you get with this:

wbinfo -a <domain>\\<username>%<passwd>

I hope you configured your sshd and system to use Domain authentication

Please start another thread with logs since this thread is already marked [SOLVED], ppl will ignore it mostly

Thanks for the help

the command wbinfo doesn't work because i don't use winbind, i'm using likewise-open

this my new post: http://ubuntuforums.org/showthread.p...83#post9952083

thanks