We were able to use Samba and NIS on Samba 3.0.8 on Solaris 10 U5. When we update system to Solaris 10 U11, samba version became 3.6.12. And we are unable to authenticate like old style.
I did not include some parameters on below(create directory mask,etc...)
Old smb.conf
[global]
workgroup = WORKGROUPNAME
server string = Samba Server
security = SERVER
password server = dc6n, dc7n
username map = /etc/sfw/username.map
local master = No
dns proxy = No
wins server = dc6n, dc7n
kernel oplocks = No
host msdfs = No
map archive = No
oplocks = No
level2 oplocks = No
old nsswitch.conf
passwd files nis
hosts files nis
We try to set same configuration to Samba 3.6.12, but it did not work. So I decided to use security = ADS with Kerberos. This is worked but the way we did not want. Because, only windows domain users were able to login and NIS users not.
New /etc/smb.conf
workgroup = WORKGROUPNAME
realm = domain.com
security = ADS
password server = dc6n.domain.com
utmp = Yes
idmap config *:backend = tdb
idmap config *:range = 5000-9999
idmap config NETADM:backend = tdb
idmap config NETADM:range = 10000-90000
idmap uid = 100000-500000
idmap gid = 100000-500000
template homedir = /home/%U
template shell = /bin/tcsh
winbind cache time = 1800
winbind enum users = No
winbind enum groups = No
winbind use default domain = Yes
winbind separator = /
create krb5 conf = No
local master = yes
domain login = yes
domain master = yes
preferred master = yes
New /etc/nsswitch.conf
passwd files winbind nis
hosts files winbind nis
New /etc/krb5.conf
[libdefaults]
domain.com = domain.com
dns_lookup_kdc = true
[realms]
symantec.local = {
kdc = dc6n.domain.com
admin_server = dc6n.domain.com
}
[domain_realm]
.domain.com = domain.com
I am able to get users info from AD and NIS with wbinfo and genent commands.
How can we authenticate like old style again?
