Joined server linux02
runing SUSE enterprise linux server service pack 3 to a Windows active directory domain example.com
no problem.
Users, like fred
from the domain can login no problem via ssh EXAMPLE\\[email protected]
When logged in as domain user, running groups
command shows all domain groups no problem.
Logout fred
and reboot linux02
On Windows domain controller, make fred
a member of group linux_sudoers
fred
logs into linux02
and runs groups
command, but only all the old groups are displayed. Problem: fred
doesn't appear to be a member of linux_sudoers
Now when running wbinfo --group-info=EXAMPLE\\linux_sudoers
, low and behold he appears to be a member:
EXAMPLE\linux_sudoers:x:10073:EXAMPLE\fred
But when running groups
again, the new group still isn't in the list.
Now back on the Windows domain controller, I create a new user john
and make him a member of linux_sudoers
john
is now able to login to linux02
no problem, and when running the groups
command shows he is a member of linux_sudoers
Subsequent tests show that a user is essentially locked into the domain group memberships that existed at the time of first login to linux02
and no changes from the domain will ever reflect regardless of logging out or even rebooting the server. I'm out of ideas. Any hints out there?
Answer:
@David King was right! Specifically, I needed to run these commands:
service smbfs stop
service winbind stop
rm -rf /var/lib/samba/*tdb
I didn't have any files in /var/cache/samba/
service smbfs start
service winbind start
Logged in with fred
and ran groups
and sure enough he shows as a member of linux_sudoers
Thanks @David King!