1

We were able to use Samba and NIS on Samba 3.0.8 on Solaris 10 U5. When we update system to Solaris 10 U11, samba version became 3.6.12. And we are unable to authenticate like old style.

I did not include some parameters on below(create directory mask,etc...)

Old smb.conf

    [global]
    workgroup = WORKGROUPNAME
    server string =  Samba Server
    security = SERVER
    password server = dc6n, dc7n
    username map = /etc/sfw/username.map
    local master = No
    dns proxy = No
    wins server = dc6n, dc7n
    kernel oplocks = No
    host msdfs = No
    map archive = No
    oplocks = No
    level2 oplocks = No

old nsswitch.conf

    passwd files nis
    hosts  files nis 

We try to set same configuration to Samba 3.6.12, but it did not work. So I decided to use security = ADS with Kerberos. This is worked but the way we did not want. Because, only windows domain users were able to login and NIS users not.

New /etc/smb.conf

    workgroup = WORKGROUPNAME
    realm = domain.com
    security = ADS
    password server = dc6n.domain.com
    utmp = Yes
    idmap config *:backend = tdb
    idmap config *:range = 5000-9999
    idmap config NETADM:backend = tdb
    idmap config NETADM:range = 10000-90000
    idmap uid = 100000-500000
    idmap gid = 100000-500000
    template homedir = /home/%U
    template shell = /bin/tcsh
    winbind cache time = 1800
    winbind enum users = No
    winbind enum groups = No
    winbind use default domain = Yes
    winbind separator = /
    create krb5 conf = No
    local master = yes
    domain login = yes
    domain master = yes
    preferred master = yes

New /etc/nsswitch.conf

    passwd files winbind  nis
    hosts  files winbind  nis 

New /etc/krb5.conf

    [libdefaults] 
        domain.com = domain.com
        dns_lookup_kdc = true 

    [realms] 
        symantec.local = { 
            kdc = dc6n.domain.com
            admin_server = dc6n.domain.com
        } 

    [domain_realm] 
    .domain.com = domain.com

I am able to get users info from AD and NIS with wbinfo and genent commands.

How can we authenticate like old style again?

  • What did you mean old style authentication?Old style auth is samba users sync with Unix users.Is it? I didnt know samba can use NIS for Authentication.Samba can use LDAP/Kerberos for authentication. – supriady Jan 10 '17 at 14:09
  • Solaris used NIS server for Authentication.You can sync samba users with unix users.You log in to samba using unix users. – supriady Jan 10 '17 at 14:15
0

Make sure you have an entry for winbind sessions in your /etc/pam.d/system-auth-ac file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.