HOWTO: Active Directory Authentication

[stevea1210]

$wmarchewka:
Is this the line you put in your /etc/pam.d/common-auth?

auth    sufficient    pam_krb5.so

instead of having

auth     sufficient      pam_winbind.so

Of cource after installing libpam-krb5.

I wasn't getting a ticket at logon either, and making the above changes took care of it for me. I now get one at each logon. BTW, I didn't touch my common-account for this.

[dingbatca]

Just trying to get the base packages for binding to AD. I get an error, any ideas? Clean install of 5.10. I also updated the system with apt-get update, and upgrade.

root@cslinux4:~# apt-get install winbind samba
Reading package lists... Done
Building dependency tree... Done
Package winbind is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
E: Package winbind has no installation candidate
root@cslinux4:~#

root@cslinux4:~# apt-get install krb5-user
Reading package lists... Done
Building dependency tree... Done
Package krb5-user is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
krb5-doc
E: Package krb5-user has no installation candidate

[Swab]

Just trying to get the base packages for binding to AD. I get an error, any ideas? Clean install of 5.10. I also updated the system with apt-get update, and upgrade.

root@cslinux4:~# apt-get install winbind samba
Reading package lists... Done
Building dependency tree... Done
Package winbind is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
E: Package winbind has no installation candidate
root@cslinux4:~#

root@cslinux4:~# apt-get install krb5-user
Reading package lists... Done
Building dependency tree... Done
Package krb5-user is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
krb5-doc
E: Package krb5-user has no installation candidate

I think winbind and krb5-user are both in the universe repository

[dingbatca]

I am well versed in Gentoo and Redhat/Fedora/CentOS, but I must state that I have no clue how to use apt-get. How do I switch to the "universe repository"?

[Swab]

I am well versed in Gentoo and Redhat/Fedora/CentOS, but I must state that I have no clue how to use apt-get. How do I switch to the "universe repository"?

You can add repositores by following either of these wiki pages... should get you up and running.

https://wiki.ubuntu.com/AddingRepositoriesCliHowto
https://wiki.ubuntu.com/AddingRepositoriesHowto

[dingbatca]

OK, all 6 of my client systems are up and running with graphical log in and pam_mount running. Now I am stuck on a new issue. When ever I log into a different system my UID & GID changes. Any ideas?

[StRobo]

No great ideas other than modifying the
idmap uid = 500-10000000
idmap gid = 500-10000000
values a bit.

You could probably get different uid/gid values if you have a different amount of local users on the different systems. You could try to set
idmap uid = 1000-10000000
idmap gid = 1000-10000000

This is just in theory though as I can not try it right now and I have not tried it before either.

HTH

[sigtau66]

I have a good one for everybody to see if they can figure out. When I try to join the domain with my box, I get this unique error:

[2006/04/05 21:59:27, 0] utils/net_ads.c:ads_startup(191)
  ads_connect: Invalid credentials

This is after I enter my password and hit enter. Now, here comes the wrinkle.

When I first did this on my box, it was successful, BUT I had misconfigured my smb.conf file in a major way. For the NETBIOS name, I stupidly typed in my domain controller's name. DOH! So it told me the host account already exists, but it was modifying it..blah, blah, blah. Well, I don't seem to have messed up my domain as all my windows boxes can log in.

Now, though, I can't join this machine to the domain. I've changed the smb.conf file to reflect the right netbios name. I've reset the administrator password for the domain admin. Hell, I've even created a new domain admin account and got a ticket for that account and it still doesn't work. I've renamed all the /var/lib/samba/*.tdb files and restarted samba and winbind.

At this point, google isn't helping me so I was wondering if any of you have ran into and what the solution is.

Anybody?

[intangible]

Manage your active directory and remove delete any references to the old computer name and the new one and then try to rejoin.

[sigtau66]

Manage your active directory and remove delete any references to the old computer name and the new one and then try to rejoin.

Did that too.

Right now, this isn't a problem because I just rebuilt my box again. The funny thing is that right after I posted that last night, I wanted to try a reboot. Once I rebooted, I COULDN'T login. All my credentials were wrong. It was an odd issue. So, seeing no way around it and since nothing was on it, I just rebuilt.

I'm going to try this again later today and MAKE sure not to screw up my smb.conf file.