1

On my Linux I created a samba share like this, it was working fine.

[global]
    security = user
    passdb backend = tdbsam
    map to guest = Bad User
    guest account = mcms

[mml-t1]
    path = /var/lib/mcms/exports/TPMD01/mml
    writable = no
    guest ok = yes
    guest only = yes

Now, with new Windows 10 users get an error due to stricter security policies:

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.

I like to permit users based on groups in our Active Directory. I tried this one:

[mml-t1]
        path = /var/lib/mcms/exports/TPMD01/mml
        valid users = @T_UNIX_MCMS
        force user = mcms
        browseable = yes
        read only = yes
        guest ok = no

But it is not working, i.e. no connection. I also tried valid users = +"DOMAIN\T_UNIX_MCMS"

I need to configure the share properly.

Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml

I am running Samba version 4.7.1

Update

Here is my log:

[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)
  Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)
  Attempting to register auth backend guest
[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)
  Successfully added auth method 'guest'
[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)
  Attempting to register auth backend sam
[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)
  Successfully added auth method 'sam'
[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)
  Attempting to register auth backend sam_ignoredomain
[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)
  Successfully added auth method 'sam_ignoredomain'
[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)
  Attempting to register auth backend sam_netlogon3
[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)
  Successfully added auth method 'sam_netlogon3'
[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)
  Attempting to register auth backend winbind
[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)
  Successfully added auth method 'winbind'
[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)
  load_auth_module: Attempting to find an auth method to match guest
[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)
  load_auth_module: auth method guest has a valid init
[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'gssapi_spnego' registered
[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'gssapi_krb5' registered
[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'gssapi_krb5_sasl' registered
[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'spnego' registered
[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'schannel' registered
[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'naclrpc_as_system' registered
[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'sasl-EXTERNAL' registered
[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'ntlmssp' registered
[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'ntlmssp_resume_ccache' registered
[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'http_basic' registered
[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'http_ntlm' registered
[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)
  GENSEC backend 'http_negotiate' registered
[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
  Starting GENSEC submechanism ntlmssp
[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)
  Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)
  load_auth_module: Attempting to find an auth method to match guest
[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)
  load_auth_module: auth method guest has a valid init
[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
  Starting GENSEC submechanism ntlmssp
[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)
  Got NTLMSSP neg_flags=0xe2088297
    NTLMSSP_NEGOTIATE_UNICODE
    NTLMSSP_NEGOTIATE_OEM
    NTLMSSP_REQUEST_TARGET
    NTLMSSP_NEGOTIATE_SIGN
    NTLMSSP_NEGOTIATE_LM_KEY
    NTLMSSP_NEGOTIATE_NTLM
    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
    NTLMSSP_NEGOTIATE_VERSION
    NTLMSSP_NEGOTIATE_128
    NTLMSSP_NEGOTIATE_KEY_EXCH
    NTLMSSP_NEGOTIATE_56
[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)
  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326
[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)
  Mapping user [SWI]\[domscheit] from workstation [CWP1101]
[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)
  attempting to make a user_info for domscheit (domscheit)
[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)
  making strings for domscheit's user_info struct
[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)
  making blobs for domscheit's user_info struct
[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)
  check_ntlm_password:  Checking password for unmapped user [SWI]\[domscheit]@[CWP1101] with the new password interface
[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)
  check_ntlm_password:  mapped user is: [SWI]\[domscheit]@[CWP1101]
[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)
  check_sam_security: Couldn't find user 'domscheit' in passdb.
[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)
  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)
  No such user domscheit [SWI] - using guest account
[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)
  server session key is invalid (len == 0), cannot do KEY_EXCH!
[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)
  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED

Instead of using a group name I tried for testing with my personal account valid users = SWI\\domscheit (and some more variants). However always the same error.

getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.

Update 2

I think I found one important topic - the server uses SSSD. I assume that's the reason why the server messed up when I installed "winbind" as suggested by many "how to..." pages. I had to restore the server from backup to make it running again.

  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name. – telcoM Dec 20 '18 at 12:40
  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names. – telcoM Dec 20 '18 at 12:44
  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again. – roaima Dec 21 '18 at 22:19
  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully. – roaima Dec 21 '18 at 22:31
  • @roaima, please see my update. – Wernfried Domscheit Dec 25 '18 at 13:27
1

Here you go.

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)
check_sam_security: Couldn't find user 'domscheit' in passdb.

What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.

  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one. – Wernfried Domscheit Dec 25 '18 at 18:40
  • Sure. But not on Christmas Day :-) – roaima Dec 25 '18 at 20:40
  • I am not in the office either. Maybe a link or a description next year would be great. – Wernfried Domscheit Dec 25 '18 at 22:07
0

Have a look at:

https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member

30 character minimum.

  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with. – Wernfried Domscheit Dec 29 '18 at 21:18
0

I had a chat with one of our Linux administrators. Looks like that samba + sssd + winbind are not good friends with each others, i.e. they are not working together. But in newer Red Hat version (> 7.2) it seems to be possible but the configuration is a bit tricky.

We have many servers in our premises and we don't want a single server which configured specially. I will wait until we get a common and well engineered solution for our entire Linux environment. In the meantime I go for different solution with our Isilon storage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.