0

While using Debian and Windows in mixed environments for a huge amount of time now I am stuck on trying to use cached credentials for logging in within a domain environment. Once I used the credentials to login, I still want to login when the machine isn't connected to the domain controller anymore.

This behaviour is implemented by Windows clients, so that a laptop user can still login. Only mount points can't be used unless a connection is there. I want to achieve the same on my Debian/GNU Linux client.


Further explanation

The workstation is using Debian Buster with GUI (Xorg, XFCE, LightDM) and Samba (Winbind). It's a pretty much default installation.

:~$ uname -a
Linux client-ph-wkst 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1 (2020-01-26) x86_64 GNU/Linux
:~$ sudo samba -V
Version 4.9.5-Debian

The workstation is sucessfully connected to a domain controller (Samba 4). Everything is working fine. I'm using this setup since Jessie and it's nice. All domain users can login on that machine, are having an auto-created home directory and so on. The only exception to that is the missing offline authentication.

According to the Samba Wiki (https://wiki.samba.org/index.php/PAM_Offline_Authentication) the smb.conf has been modified to contain winbind offline logon = yes.

While testing this it works as expected. When setting winbind to offline manually(sudo smbcontrol winbind offline), I can verify that PAM is using cached credentials. Even by unplugging the cable physically I can achieve the same.

Problem

But when I unplug the cable and reboot the system, I can't login. It hangs on LightDM logon screen. I can switch to console by pressing Ctrl+Alt+F1. I can logon with the system's root account, because this doesn't request the domain controller. When I look into the services with root I can see, that nmbd is not running. By examining it's logs with journalctl -xe I see, that it's not starting because of No local IPv4 non-loopback interfaces available.

The default network configuration tool in Debian's GUI installation is NetworkManager. With nmcli general I can see that I'm not connected.

Solution quick-and-dirty

Without plugging in the cable physically I manually activate the interface by entering nmcli connection up pewpewdefaultconnection. I restart samba and nmbd service. Voilà! It's working. I can enter my credentials, even restart lightdm service and enter everything with my cached credentials.

Solution nice and clean to be found

Since I don't want such an ugly solution as described before I am asking you to help me. Is there anyone who as accomplished this in a clean way? I would really appreciate any help.

I don't want to setup a script that makes the calls, that I described before, since they seem to be ugly. I'd like to prefer something in a configuration style if possible.

Note: I tried to use auto eth0 in network interfaces and make it being grabbed by NetworkManager's configuration file with managed=true. This doesn't show any improvement.

1 Answer 1

0

I reverted everything and only left winbind offline logon = yes in smb.conf. Some days later when the eth cable was unplugged I recognized it's working. Huh!?

On another client computer in the network I did the same configuration change in smb.conf and I can confirm it's working there, too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .