3

This is what I have:

  • Group of computers under DOMAIN.LOCAL and all users provided by Active Directory in Windows Server
  • Debian server
  • Windows AD, DC server

What I need:

  • Share a folder from my DebianServer to the other computers so they authenticate with their own users provided by windows AD

What I have already done:

  • My DebianServer is already in the DOMAIN.LOCAL
  • I can login to DebianServer with all the AD users from windows

What I can't:

  • Access the shared folder with the DOMAIN.LOCAL users

Important files:

/etc/nsswitch.conf

passwd:         compat sss
group:          compat sss
shadow:         compat sss
gshadow:        files
hosts:          files mdns4_minimal [NOTFOUND=return] dns
networks:       files
protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files
netgroup:       nis sss
sudoers:        files sss

/etc/sssd/sssd.conf

[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL

[domain/DOMAIN.LOCAL]
id_provider = ad
override_homedir = /home/%d/%u
access_provider = simple

/etc/krb5.conf

[libdefaults]
        default_realm = DOMAIN.LOCAL
        ticket_lifetime=24h
        renew_lifetime=7d
        dns_lookup_realm = false
        dns_lookup_kdc = false
        #estaba en TRUE arriba
# The following krb5.conf variables are only for MIT Kerberos.
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        fcc-mit-ticketflags = true

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log


[realms]
DOMAIN.LOCAL = {
        kdc=192.168.0.180:88
        admin_server=192.168.0.180:464
        default_domain=domain.local
}

[domain_realm]
        .domain.local=DOMAIN.LOCAL
        domain.local=DOMAIN.LOCAL

/etc/samba/smb.conf

[global]
        workgroup = DOMAIN
        security = ads
        realm = DOMAIN.LOCAL
        template homedir = /home/%D/%U
        template shell = /bin/bash
        client signing=yes
        client use spnego=yes
        kerberos method=secrets and keytab
[homes]
   comment = Home Directories
   browseable = no
   read only = yes
   create mask = 0700
   directory mask = 0700
   valid users = %S
[Compartido]
path=/home/DebianUser/Compartido
comment=compartido
browseable=yes
read only=no
valid users=@"DOMAIN.LOCAL\usersgroup"
  • Have you set up domain permissions on the individual directories? – Raman Sailopal Feb 1 '18 at 12:48
  • The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work – arturo.mj Feb 1 '18 at 12:57
  • Can you see the domain users with "getent passwd" – Raman Sailopal Feb 1 '18 at 13:05
  • No. But I can login and I try "kinit user" "klist" and works fine. – arturo.mj Feb 1 '18 at 21:51
  • If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users – arturo.mj Feb 2 '18 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.