Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

To start off, shit's about to hit the fan and i need your help! I'm so short of time that i can't begin to describe everything i've done and not done, but i have a problem and hope you can help!

  1. OpenLDAP (working with ldapsearch and php scripts)
  2. Working samba without LDAP

I'm trying to connect these two dots, I'm not sure what exactly you need but i'll give it to you if you as long as you ask!

This is waht my access.log says (where all my smb data gets dumped):

[2013/02/10 19:41:25, 2] passdb/init_sam_from_ldap(545): Entry found for user: ***<username>***
[2013/02/10 19:41:25, 0] passdb/pdb_get_group_sid: Failed to find Unix account for ***<username>***
[2013/02/10 19:41:25, 1] auth/make_server_info_sam(589):  User ***<username>*** in passdb, but getpwnam() fails!
[2013/02/10 19:41:25, 0] auth/check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER'
[2013/02/10 19:41:25, 2] auth/check_ntlm_password:  Authentication for user [***<username>***] -> [***<username>***] FAILED with error NT_STATUS_NO_SUCH_USER

It's like the password hashes in the OpenLDAP database doesn't match what samba assumes it should recieved, or something along those lines. note: When supplying a wrong password, it says wrong password.. these logs are for a perfect authentication using correct credentials, or at least i try to (via gnome filebrowser, username: username, workgroup: WORKGROUP, password: plain text password)

Here's my smb.conf:

[global]
        unix charset = LOCALE
        netbios name = test
        server string = test
        passdb backend = ldapsam:"ldap://<ip>"
        username map = "/etc/samba/smbusers"
        log level = 2
        syslog = 0
        log file = /var/log/samba/access.log
        max log size = 0
        name resolve order = hosts dns
        load printers = No
        add user script = /usr/bin/smbldap-useradd -m '%u'
        delete user script = /usr/bin/smbldap-userdel '%u'
        add group script = /usr/bin/smbldap-groupadd -p '%g'
        delete group script = /usr/bin/smbldap-groupdel '%g'
        add user to group script = /usr/bin/smbldap-groupmod -m '%g' '%u'
        delete user from group script = /usr/bin/smbldap-groupmod -x '%g' '%u'
        add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
        set primary group script = /usr/bin/smbldap-usermod -g '%g' '%u'
        domain logons = Yes
        domain master = Yes
        wins support = Yes

        ldap admin dn = cn=admin,dc=test,dc=local
        ldap group suffix = ou=Groups
        ldap user suffix = ou=People
        ldap suffix = dc=test,dc=local
        ldap ssl = no
        ldap passwd sync = yes

Here's my ldap.conf

** Server is down so i don't have this atm**

According to wireshark OpenLDAP sends the correct information when searching for the uid, but when doing the actual login i think that samba says something about "singelLevel" which i think might be relevant, this is where it fails and the "wrong" data is sent back to samba.

Again, I'm shit out of luck and time is against me and i've tried everything and anything, but samba just refuses to use any LDAP login.

shares:

They work without LDAP, so the share's fine! (even with non-ldap auth)


Add a unix user

This works... Then i can access the share, but i've explicitly told samba to not use local authentication, i've chosen LDAP?

share|improve this question
    
Again, i'm terribly sorry for any missleading information, type-o or if i'm unclear or missing anything.. I'm just about on the edge of panicing >_< –  Torxed Feb 10 '13 at 18:57
add comment

1 Answer

I had a similar problem where samba used LDAP for a backend, yet still required a local Unix account for the user in order to allow domain logons.

The problem for me was to do with the /etc/nsswitch.conf file which lists the databases to query for user accounts and groups etc. You have not specified what Linux OS you are using, so I will give you the steps I used to resolve the issue on my Ubuntu box.

First I had to install the libnss-ldap package:

sudo apt-get install libnss-ldap

There were also several dependencies, one of which is ldap-auth-config. If the ACLs on your OpenLDAP server prevent anonymous searches then you will need to specify an ldap account e.g. cn=admin,dc=example,dc=com that has access to the LDAP database, during the configuration of this package.

Following that, edit the /etc/nsswitch.conf file. Add 'ldap' to three entries for passwd, group and shadow as shown below. Some systems use 'compat' and others 'files', so you can just leave the first bit alone.

passwd: compat ldap
group: compat ldap
shadow: compat ldap

The change should take effect immediately. You can confirm that it worked by issuing the getent command:

getent passwd

It should list all local and LDAP user accounts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.