3

I'm having trouble to log in to Linux using a trusted Active Directory.

The machine is connected to an Active Directory that we are responsible for in the project, but most of the users who will use the machine are in the organization's AD.

I can login with user accounts that are hosted on our project-AD, but we can not log in with users in the company's AD

smb.conf

# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
[global]
    workgroup = PROJECTDOMAIN
    passdb backend = tdbsam
    printing = cups
    printcap name = cups
    printcap cache time = 750
    cups options = raw
    map to guest = Bad User
    include = /etc/samba/dhcp.conf
    logon path = \\%L\profiles\.msprofile
    logon home = \\%L\%U\.9xprofile
    logon drive = P:
    usershare allow guests = No
    security = ADS
    idmap gid = 10000-20000
    idmap uid = 10000-20000
    realm = MYPROJECT.MYCOMPANY.COM
    template homedir = /home/%D/%U
    winbind refresh tickets = yes
    template shell = /bin/bash
    usershare max shares = 100
    winbind offline logon = yes
[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes
[profiles]
    comment = Network Profiles Service
    path = %H
    read only = No
    store dos attributes = Yes
    create mask = 0600
    directory mask = 0700
[users]
    comment = All users
    path = /home
    read only = No
    inherit acls = Yes
    veto files = /aquota.user/groups/shares/
[groups]
    comment = All groups
    path = /home/groups
    read only = No
    inherit acls = Yes
[printers]
    comment = All Printers
    path = /var/tmp
    printable = Yes
    create mask = 0600
    browseable = No
[print$]
    comment = Printer Drivers
    path = /var/lib/samba/drivers
    write list = @ntadmin root
    force group = ntadmin
    create mask = 0664
    directory mask = 0775

krb5.conf

[libdefaults]
    default_realm = MYPROJECT.MYCOMPANY.COM
    clockskew = 300
#   default_realm = EXAMPLE.COM 

[realms]
SAG.GOT.CAPGEMINI.COM = {
    kdc = ad02.myproject.mycompany.com
    default_domain = myproject.mycompany.com
    admin_server = ad02.myproject.mycompany.com
}
#   EXAMPLE.COM = {
#                kdc = kerberos.example.com
#       admin_server = kerberos.example.com
#   }

[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON
[domain_realm]
    .myproject.mycompany.com = MYPROJECT.MYCOMPANY.COM
[appdefaults]
pam = {
    ticket_lifetime = 1d
    renew_lifetime = 1d
    forwardable = true
    proxiable = false
    minimum_uid = 1
    external = sshd
    use_shmem = sshd
    validate = false
}

If I try to this (corp is the domain for the company AD)

> wbinfo -a corp\\username

I get following:

plaintext password authectication failed
Could not authenticate user corp\\username whit plaintext password
challenge/response password authentication failed
error code was NT code 0xc0000413 (0xc0000413)
error message was: NT code 0xc0000413
Could not authenticate user corp\username with challenge/response

But it is possible to do this:

kinit username@CORP.MYCOMPANY.COM

  • Have you Configured the Kerberos Policies on the live server to accept plain-text passwords, or vice versa. Configure Samba/Kerberos to accept NTLM? – eyoung100 Nov 11 '14 at 14:46
  • I'm in the same boat as you, so I will be keeping an eye on your question. If you sudo wbinfo -a, do the password checks succeed? For me, without sudo the plaintext succeeds but the challenge/response fails. With sudo both succeed. Yet I still can't log in locally using DOMAIN+username. – Dave Nov 14 '14 at 21:25
  • I found the solution to this. In my AD I had set that all all users in a group in CORP.MyCompany.com can log on to the Linux machine. But when I instead changed to a group in myproject.mycompany.com, it suddenly works. Do not ask me why. – magol Nov 17 '14 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.