0

I am experimenting with Samba as active directory controller in my home network for the last two weeks.

I installed samba on ubuntu server 22.04 following a couple of guides and videos, but this page covers it for most of it. I am able to join computers to the domain, both windows and linux. I can list the joined computers using samba-tool computer list.

I created users and groups successfully using the samba tool. From windows clients I can login using these accounts.

From linux (ubuntu 23.04 and 23.10) I can join the domain following official ubuntu docs, but I am unable to login.

bp@bas-hp:samba (master) % sudo login                   
bas-hp login: [email protected]
Password: 

Login incorrect
bas-hp login: [email protected]
Password: 

Login incorrect

I am able to create a kerberos ticket

bp@bas-hp:samba (master) % klist           
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting     Expires            Service principal
16-04-24 22:26:57  17-04-24 08:26:57  krbtgt/[email protected]
    renew until 17-04-24 22:26:53

The results of my trying the Testing section in the document I'm following seem to start well:

bp@legion-ubuntu:~ % getent passwd [email protected]
[email protected]:*:1494001108:1494000513:Bas Prins:/home/[email protected]:/bin/bash
bp@legion-ubuntu:~ % getent passwd [email protected] 
[email protected]:*:1494001104:1494000513:bp:/home/[email protected]:/bin/bash

But when I issue the groups command I do see some concerning result

bp@legion-ubuntu:~ % groups [email protected]       
[email protected] : domain [email protected] denied rodc password replication [email protected] [email protected] enterprise [email protected] domain [email protected]
bp@legion-ubuntu:~ % groups [email protected]
[email protected] : domain [email protected] denied rodc password replication [email protected] [email protected] enterprise [email protected] domain [email protected]

I am googling in parallel when "denied rodc password replication" means and if/how I need to fix that.

Full sssd.conf

[sssd]
domains = sb.lan
config_file_version = 2
services = nss, pam

[domain/sb.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = SB.LAN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = sb.lan
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
timeout = 20
ldap_uri = ldap://dc.sb.lan
ldap_search_base = dc=sb,dc=lan
auth_provider = krb5
krb5_server = dc.sb.lan
krb5_passwd = dc.sb.lan
krb5_validate = True

I am hoping that somebody with more knowledge on samba/AD can give me some pointers how best to troubleshoot this issue. Are there tools I can use to drill down to the root cause?

Update 2

After adding the following line in sssd.conf on ubuntu client computer

ad_gpo_access_control = permissive

I can finally login through command line sudo login. But, unfortunately, after a successful login it tries to download policies I think, which fails.

Last login: Wed Apr 17 14:15:01 CEST 2024 on pts/2
Applying machine settings
ERROR Error from server: error while updating policy: can't get policies for "legion-ubuntu": failed to retrieve the list of GPO (exited with 1): exit status 1
Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to connect to 'ldap://dc.sb.lan' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER') 

Failure setting user credentials

I am troubleshooting this in parallel, of course hoping for a carry where somebody just tells me what to fix where ;-). If I manage to figure this out by myself I will update the question.

Improve this question
6
  • @ChrisDavies I updated my question with the results of testing part. Also getent wasn't working, it only showed local users. I managed to fix that by googling and extending the /etc/sssd/sssd.conf. The groups command shows a problem which might very well relate to not being able to login.
    – bas
    Commented Apr 17 at 9:16
  • Your getent passwd is good. And your groups is good too - it's just that there's a group named denied rodc password replication group that is possibly confusing the output
    – Chris Davies
    Commented Apr 17 at 12:39
  • What I'd do now is look in the authentication log files under /var/log for reasons why you can't log in with [email protected]. You seem to have two similar domain accounts, [email protected] and [email protected] - are you sure you're using the correct password when testing?
    – Chris Davies
    Commented Apr 17 at 12:43
  • @ChrisDavies that was good advice, thanks for that. I got a little further. Logs revealed authentication had issues with "pam". Googling revealed a workaround (serverfault.com/questions/872542/…). Setting ad_gpo_access_control = permissive in sssd.conf which solves that problem. Now I am stuck with the next error.... haha. Victory must be sweet some day.... I will update the question, hoping this is the last hurdle....
    – bas
    Commented Apr 18 at 13:41
  • Ah, the GPO issue :-( well at least you're on your way a little further now
    – Chris Davies
    Commented Apr 18 at 13:58

1 Answer 1

Reset to default
0

After reinstalling ubuntu on my client PC and going over all the steps one more time I managed to fix the problem. I now can login to my samba AD server.

Two things I had to do that are deviating from official docs:

  • fix krb5.conf before joining
  • after joining, patch the sssd.conf

First step, I need to disable reverse dns in krb5 on ubuntu client.

[libdefaults]
    rdns = false

Next, after successfully joining the domain with sudo realm -v join <domain-name> I had to add the following line in sssd.conf on ubuntu client

# THIS IS MANDATORY to fix "permission denied" when PAM tries to authenticate
# https://serverfault.com/questions/872542/debugging-sssd-login-pam-sss-system->
# suggested work around in question
ad_gpo_access_control = permissive

Once I did that, and restarted sssd

sudo systemctl restart sssd

I can login

bp@legion-ubuntu:~ % sudo login                   
legion-ubuntu.sb.lan login: SB\bp
Password: 
Welcome to Ubuntu 23.04 (GNU/Linux 6.2.0-37-generic x86_64)

No errors occur anymore. When I log off the local user I can finally login as AD user

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .