Linux – Must have local user to authenticate Samba to AD

active-directorylinuxsamba

I've got a CentOS 5.3 server with Samba running. I've joined this server to my domain in the hopes of allowing AD users some access to my Samba shares. I've found that this works, but only as long as the AD username that I'm trying to authenticate with is also a local user on the server. In other words, if I'm trying to access a share, and try to authenticate with the AD username "joe", I get errors unless I create a user named 'joe' on the server. I don't have to create a matching password or anything….the local user's password is always blank, so I do know that the authentication is actually happening against the AD.

Here's my smb.conf file:

[global]
    workgroup = <mydomain>
    server string = <snip>
    netbios name = HOME
    security = ADS
    realm = <mydomain.com>
    password server = <snip>
    auth methods = winbind
    log level = 1
    log file = /var/log/samba/%m.log
[amore]
path = /var/www/amore
browseable = yes
writable = yes
valid users = DOMAIN\user1 DOMAIN\user2 DOMAIN\user3 DOMAIN\user4

I would assume that my kerberos settings are fine, as I've joined the domain and can use wbinfo to see users and groups. However, I can provide that info if necessary.

Anyone have any ideas?

Best Answer

Fundamentally, Linux uses UID/GID values in its access control sysetm, while the Windows NT operating system family uses Security Identifiers (SIDs) in its access control system.

The Windows Server 2003 R2 Active Directory along with "Services for Unix" (which provides the RFC2307bis schema) can store UID/GID values for each user in the directory and Samba is capable of using these values (or, so I've read-- I've never actually tried it, but multiple docs I've ready say that it works well).

If you're not storing UID/GID values in a directory service then you'll need a mechanism to deterministically map between these two unlike identifier systems. The "idmap" functionality of "winbind" is typically used to perform this mapping. Have a look at the following articles to get some idea of the functionality:

Identity Mapping (IDMAP) from the Samba HOWTO collection
Winbind: Use of Domain Accounts
Samba & Active Directory: A lot of what you're trying to do

Related Solutions

Linux – Avoid user lookup in active directory trusted domains from samba

It sounds like this functionality regressed from Samba prior to 3.0.26. A patch was proposed and it was re-added to Samba 3.3.

If you're prepared to patch Samba's source code yourself, there is an "only domains" patch, which is the inverse of "ignore domains".

Samba Permissions – I’m going to throw it!

This might help. I do something similar, but only one share is open to the group's users. Other shares are read-only except for a single maintainer user. The [global] section of my smb.conf is almost identical to yours, except I don't use the force create/directory mode directives (in my case, they'd interfere with the other shares).

Here's the share definition:

[shared stuff]
        comment = blah, blah, etc
        path = /path/to/share
        write list = @sambagroup
        force group = +sambagroup
        read only = yes
        directory mask = 0775
        create mask = 0664
        guest ok = yes
        invalid users = root
        case sensitive = True
        default case = lower
        preserve case = yes
        short preserve case = yes

The important stuff here are these:

read only = yes -- by default, read only.
guest ok = yes -- guests can browse.
write list = @sambagroup -- Authenticated members of sambagroup can write.
force group = +sambagroup -- The + means that the force only applies to existing members of sambagroup. They're already the only ones who can write. I think, without the +, guest is given sambagroup credentials, which is not wanted (particularly with the write list directive above).
directory mask = 0775
create mask = 0664

These do exactly what you want yours to do: "drwxrwxr-x" on directories, "rwxrwxr-x" on files, and newly created files are owned by the user and sambagroup. The maintainers of the other shares get the same permissions as everyone else when working in shared stuff, and permissions & groups are normal when they work in the other shares.

My smb.conf has been working with only minor tweaks through several different versions of Samba, and currently is used with Samba 3.2.5. I never had it running on Ubuntu 8.04, but it ran on Ubuntu 7.04 for a long time before getting migrated to a recent Debian Lenny install.

Best Answer

Related Solutions

Linux – Avoid user lookup in active directory trusted domains from samba

Samba Permissions – I’m going to throw it!

Related Topic