Linux

Ask something
Discussion Locked

NT Domain Authentication with Samba

0 helpful
5 replies

by bowieb 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am trying to setup Samba to use Domain Authentication so I can give our domain users a home directory on the Linux storage server.

The problem is that I can't figure out how to connect Samba to the PDC. Whenever I use smbpasswd to try to join the domain, it says "Unable to join domain".

Does anyone have any pointers on doing this? Are there any good documents on it? The Samba docs are not very clear on this procedure.

5 replies

by rouse

Try this in your smb.conf:
[global]
workgroup = HOME
netbios name = LINUX
server string = Samba Server
encrypt passwords = Yes
obey pam restrictions = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *passwd:*all*authentication*tokens*updated*successfully*
unix password sync = Yes
log file = /var/log/samba/%m.log
max log size = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 dns proxy = No
domain logons = yes
logon script=logon.bat
printing = lprng

[netlogon]
comment = Initialization Scripts
path=/home/netlogon
read only =yes
public = no
writeable = no
guest ok = no
browseable = yes
locking = no
force create mode = 0644
force directory mode = 0755

Workgrout & netbios needs to be your own. I think the biggie is the "domain logons = yes". Also, I find the the order of the parameters is important.
The [netlogon] section is optional, but if you want to map some linux drives, you can do it in the netlogon. Be sure the path exists, ie \home\netlogon and give it permissions 0755. I'm also exploring this, but I've got so far works great!
On the windows side, besure you've got the logon to windows domain checked in the client for microsoft networks, and the domain = home, or whatever you set in your smb.conf under 'workgroup ='
Have fun,
Keith

by bowieb

I'm not really interested in having the Samba server be a domain controller. I have a few NT4 domain controllers and I would like to let them continue to service the domain logins.

All I want the Samba server to do is let me control access to shares based on a username/password which is authenticated by my NT4 domain controllers.

by rouse

Ok, I found this on: http://us1.samba.org/samba/docs/Samba-HOWTO-Collection.html#AEN393
Hope it works for you...
Make Samba a member of an MS Windows NT security domain
This method involves additon of the following paramters in the smb.conf file:

encrypt passwords = Yes
security = domain
workgroup = "name of NT domain"
password server = *

The use of the "*" argument to "password server" will cause samba to locate the domain controller in a way analogous to the way this is done within MS Windows NT.

In order for this method to work the Samba server needs to join the MS Windows NT security domain. This is done as follows:

On the MS Windows NT domain controller using the Server Manager add a machine account for the Sambaserver.

Next, on the Linux system execute: smbpasswd -r PDC_NAME -j DOMAIN_NAME

Use of this mode of authentication does require there to be a standard Unix account for the user in order to assign a uid once the account has been authenticatedby the remote Windows DC. This account can be blocked to prevent logons by other than MS Windows clients by things such as setting an invalid shell in the /etc/passwd entry.

An alternative to assigning UIDs to Windows users on a Samba member server is presented in the Winbind Overview chapter in this HOWTO collection.

'luck

by bowieb

Perfect! I had it working with 'security=server', but it wouldn't work with 'security=domain'. Apparently the 'encrypt passwords' setting is what I was missing. Now I need to do some research on the difference between 'server' and 'domain'.

Thanks!

This discussion is closed to new replies.