1

Hello linux newbie here.

What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain.

I have the following setup:

                       +----------------+               +---------------+
+-----------+          |  Forest B      |               |   Forest A    |
|  User in  |          |                | one-way trust |               |
|  domain B +----------+  Domain B      +<--------------+    Domain A   |
|           |          |    b.net       |               |     a.net     |
+-----------+          |                |               |               |
                       |                |               |               |
                       +----------------+               +-------+-------+
                                                                |
                                                                |
                                                                |
                                                                |
                                                                |
                                                        +-------+-------+
                                                        |               |
                                                        |  Ubuntu 16.04 |
                                                        |  samba 4.7.12 |
                                                        |               |
                                                        |               |
                                                        |               |
                                                        +---------------+

I have successfully joined my Ubuntu 16.04 to Active Directory domain A with samba winbind, but I am unable to login to the machine with user account that exists in domain B. Domain A and domain B are Active Directory domains and they have one-way trust so that domain A trusts domain B, but domain B does not trust domain A.

Here are my smb.conf, krb5.conf and nsswitch.conf

/etc/samba/smb.conf

[global]
   workgroup = A
   security = ADS
   realm = A.NET
   encrypt passwords = yes
   idmap config *:range = 16777216-33554431
   allow trusted domains = yes

   winbind trusted domains only = no
   kerberos method = secrets and keytab
   winbind refresh tickets = yes

   template shell = /bin/bash
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700

[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no

/etc/krb5.conf

[libdefaults]
        default_realm = A.NET
        dns_lookup_kdc = false
        krb4_config = /etc/krb.conf
        krb4_realms = /etc/krb.realms
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        v4_instance_resolve = false
        v4_name_convert = {
                host = {
                        rcmd = host
                        ftp = ftp
                }
                plain = {
                        something = something-else
                }
        }
        fcc-mit-ticketflags = true

[realms]
        ATHENA.MIT.EDU = {
                kdc = kerberos.mit.edu:88
                kdc = kerberos-1.mit.edu:88
                kdc = kerberos-2.mit.edu:88
                admin_server = kerberos.mit.edu
                default_domain = mit.edu
        }
        MEDIA-LAB.MIT.EDU = {
                kdc = kerberos.media.mit.edu
                admin_server = kerberos.media.mit.edu
        }
        ZONE.MIT.EDU = {
                kdc = casio.mit.edu
                kdc = seiko.mit.edu
                admin_server = casio.mit.edu
        }
        MOOF.MIT.EDU = {
                kdc = three-headed-dogcow.mit.edu:88
                kdc = three-headed-dogcow-1.mit.edu:88
                admin_server = three-headed-dogcow.mit.edu
        }
        CSAIL.MIT.EDU = {
                kdc = kerberos-1.csail.mit.edu
                kdc = kerberos-2.csail.mit.edu
                admin_server = kerberos.csail.mit.edu
                default_domain = csail.mit.edu
                krb524_server = krb524.csail.mit.edu
        }
        IHTFP.ORG = {
                kdc = kerberos.ihtfp.org
                admin_server = kerberos.ihtfp.org
        }
        GNU.ORG = {
                kdc = kerberos.gnu.org
                kdc = kerberos-2.gnu.org
                kdc = kerberos-3.gnu.org
                admin_server = kerberos.gnu.org
        }
        1TS.ORG = {
                kdc = kerberos.1ts.org
                admin_server = kerberos.1ts.org
        }
        GRATUITOUS.ORG = {
                kdc = kerberos.gratuitous.org
                admin_server = kerberos.gratuitous.org
        }
        DOOMCOM.ORG = {
                kdc = kerberos.doomcom.org
                admin_server = kerberos.doomcom.org
        }
        ANDREW.CMU.EDU = {
                kdc = kerberos.andrew.cmu.edu
                kdc = kerberos2.andrew.cmu.edu
                kdc = kerberos3.andrew.cmu.edu
                admin_server = kerberos.andrew.cmu.edu
                default_domain = andrew.cmu.edu
        }
        CS.CMU.EDU = {
                kdc = kerberos.cs.cmu.edu
                kdc = kerberos-2.srv.cs.cmu.edu
                admin_server = kerberos.cs.cmu.edu
        }
        DEMENTIA.ORG = {
                kdc = kerberos.dementix.org
                kdc = kerberos2.dementix.org
                admin_server = kerberos.dementix.org
        }
        stanford.edu = {
                kdc = krb5auth1.stanford.edu
                kdc = krb5auth2.stanford.edu
                kdc = krb5auth3.stanford.edu
                master_kdc = krb5auth1.stanford.edu
                admin_server = krb5-admin.stanford.edu
                default_domain = stanford.edu
        }
        UTORONTO.CA = {
                kdc = kerberos1.utoronto.ca
                kdc = kerberos2.utoronto.ca
                kdc = kerberos3.utoronto.ca
                admin_server = kerberos1.utoronto.ca
                default_domain = utoronto.ca
        }
        A.NET = {
                admin_server = dc.a.net
                kdc = dc.a.net
        }
        B.NET = {
                admin_server = dc.b.net
                kdc = dc.b.net
        }

[domain_realm]
        .mit.edu = ATHENA.MIT.EDU
        mit.edu = ATHENA.MIT.EDU
        .media.mit.edu = MEDIA-LAB.MIT.EDU
        media.mit.edu = MEDIA-LAB.MIT.EDU
        .csail.mit.edu = CSAIL.MIT.EDU
        csail.mit.edu = CSAIL.MIT.EDU
        .whoi.edu = ATHENA.MIT.EDU
        whoi.edu = ATHENA.MIT.EDU
        .stanford.edu = stanford.edu
        .slac.stanford.edu = SLAC.STANFORD.EDU
        .toronto.edu = UTORONTO.CA
        .utoronto.ca = UTORONTO.CA
        a.net = A.NET
        .a.net = A.NET
        b.net = B.NET
        .b.net = .B.NET

[login]
        krb4_convert = true
        krb4_get_tickets = false

/etc/nsswitch.conf

passwd:         compat winbind
group:          compat winbind
shadow:         compat
gshadow:        files
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

Most of the modification are based on these instructions, though I added the domain b to krb5.conf: https://docs.citrix.com/en-us/linux-virtual-delivery-agent/7-15-ltsr/installation-overview/ubuntu.html

I have tried the following wbinfo commands:

wbinfo --online-status shows domain A online, but domain B offline.

wbinfo -n B\administrator returns a SID and wbinfo -s SID returns the name

wbinfo -m BUILTIN MYLINUX A B

wbinfo -K B\user%password returns the following error message:

wbcLogonUser(B\user): error code was NT_STATUS_NO_LOGON_SERVERS (0xc000005e)
error message was: No logon servers are currently available to service the logon request.
Could not authenticate user [B\user%password] with Kerberos (ccache: FILE)

I would really appreciate if someone could help me to solve this. How would I start to troubleshoot this issue?

1

Only Samba 4.8.x+ supports such trust.

Only thing I am aware that you need to do is to configure idmap for the trusted domain in the [global] section of your smb.conf :

idmap config <trusted_domain> : backend = rid
idmap config <trusted_domain> : range = ?????- ?????

make sure the range doesn't overlap with the range you currently defined for the (local) domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.