I am implementing LDAP authentication against Samba 4 AD for admins login to our Linux servers.

I successfully configured PAM with libpam-ldapd and libnss_ldapd with auto creation of the home directories of the users. I am facing now the problem that users have their mapped samba gidNumber as primary group which do not exist locally any way. The current situation is the /home directory looks like this (notice the users primary group):

drwxr-xr-x 2 user 1005 4096 Okt 13 16:01 user/

The problem with the sssd is that it requires a domain join to Samba 4 AD, which is not the case now and will not be at all. Since we have several hundreds of these Ganeti VM's, and most of them are very critical!

The admin login to these machines is allowed for admins (member of a specific AD group) and who have a signed SSH public key.

What I was asking for is to rename the group according to the user and automatically create these groups locally. I read somewhere it should be possible to rename them by using wbinfo and rip map. But I have no idea how to do this. Creating the groups locally is secondary, since I will create an admin group and add them all to it.

The main question is:

How could the users primary groups be renamed from gidNumber to uid?

Thanks a lot.


1 Answer 1


I found the answer, I just didn't find the time to post it. Here is a complete how to implement password authentication for users against samba 4 AD:

  • install libnss-ldapd
  • get the certificate of the samba 4 AD and add it to your CA
  • update-ca-certificates
  • check with ldapsearch the connectivity
  • pam-auth-update and select the services that should use LDAP
  • use create home on login if needed
  • open /etc/nslcd.conf and modify it as follows:

    # /etc/nslcd.conf
    # nslcd configuration file. See nslcd.conf(5)
    # for details.
    # The user and group nslcd should run as.
    uid nslcd
    gid nslcd
    # The location at which the LDAP server(s) should be reachable.
    uri ldaps://dc.example.com:636/
    # The search base that will be used for all queries.
    base DC=example,DC=com
    # The LDAP protocol version to use.
    #ldap_version 3
    # The DN to bind with for normal lookups.
    #binddn nslcd
    binddn CN=binduser,CN=Users,DC=example,DC=com
    bindpw yourpassword
    # The DN used for password modifications by root.
    #rootpwmoddn cn=admin,dc=example,dc=com
    # SSL options
    #ssl start_tls
    #tls_reqcert never
    ssl on
    tls_cacertfile /etc/ssl/certs/ca.pem
    #tls_cacertfile /etc/ssl/certs/ca-certificates.crt
    # The search scope.
    scope sub
    filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
    map    passwd   uid                 sAMAccountName
    map    passwd   homeDirectory       unixHomeDirectory
    map    passwd   gecos               displayName
    filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
    map    shadow   uid                 sAMAccountName
    map    shadow   shadowLastChange    pwdLastSet
    filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
    map    group    cn                  sAMAccountName
    map    group    gidNumber           uidNumber
    map    group    memberUid           sAMAccountName
  • test the login and you will see:

    user@test [Home]:~$  ll /home/
    drwxr-xr-x  3 user user 4096 May 20 01:41 user/
    user@test [Home]:~$
    user@test [Home]:~$
    user@test [Home]:~$  ll /home/user/
    total 28
    drwxr-xr-x 3 user user 4096 May 20 01:41 ./
    drwxr-xr-x 4 root root 4096 May 19 23:35 ../
    -rw-r--r-- 1 user user  220 May 19 23:35 .bash_logout
    -rw-r--r-- 1 user user 3771 May 19 23:35 .bashrc
    drwx------ 2 user user 4096 May 19 23:35 .cache/
    -rw-r--r-- 1 user user  655 May 19 23:35 .profile
    -rw------- 1 user user  568 May 20 01:41 .viminfo

For the public key authentication either you copy the public keys of all users to all servers and every new user as well, which is hard to achieve and very error-prone or you just sign all users ssh public key and all hosts public keys as well, which sounds difficult as well. I created a users CA and hosts CA and deployed them to all servers and signed all hosts public keys with puppet, users should be responsible for signing their keys, maybe place the users CA in a web app and use curl.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .