Samba 4: domain joined, but all users are mapped to nobody, and shares are inaccessible from Windows clients

authenticationlinux-networkingsamba4winbind

I've got a Debian/Jessie Samba 4.2.14 running as an AD member. ADC is a Windows2008R2 server. Join worked without problem.

# net ads testjoin
Join is OK

wbinfo -u and wbinfo -g work perfectly and provides a list of users and groups from the AD as expected. wbinfo -i <user> works too:

# wbinfo -i TESTAD\\testuser
TESTAD\testuser:*:4294967295:4294967295:testuser:/home/TESTAD/testuser:/bin/false

Edit: something's wrong here, because wbinfo -i maps all users and groups to the id 4294967295 which is, as @TheSkunk remarked, 2^32 -1.

Edit 2: wbinfo --sid-to-uid TESTAD\\testuser fails. Surely I must set up explicitely some idmap parameters (the defaults apparently don't work at all) but how?

Edit 3: I've added these 2 lines to smb.conf:

idmap config * : backend = tdb
idmap config * : range = 10000-30000

And now ẁbinfo -i TESTDOMAIN\testuserreports a valid id, and a different one for each and every user. However I still have the same problems (all users mapping to nobody,idandgetent` not knowing of AD users, etc).

However getent passwd TESTAD\\testuser fails:

# getent passwd TESTAD\\testuser
# echo $? 
2

I can connect to the server with any AD account using smbclient:

# smbclient //srv1/data -U TESTAD\\testuser
Enter TESTAD\testuser's password: 
Domain=[TESTAD] OS=[Windows 6.1] Server=[Samba 4.2.14-Debian]
smb: \> ls
  .                                   D        0  Fri Feb 17 16:23:04 2017
  ..                                  D        0  Wed Feb  1 16:47:02 2017
  test.txt                            N        5  Fri Feb 17 14:38:21 2017
  popo                                D        0  Fri Feb 17 16:23:04 2017

                117125466112 blocks of size 1024. 117052392484 blocks available
smb: \>

However the connection is mapped to nobody/nogroup, and created files are owned by nobody too.
Windows machines fail to connect using any AD account. However if I create a local account with smbpasswd -a <user>, they can connect using it. However, their connection parameters, files, etc. are all mapped to nobody though the account exists locally too.

Here's the current smb.conf (as close to default as possible):

[global]
        workgroup = TESTAD
        realm = TESTAD.lan
        server role = member server
        security = ADS
        map to guest = Bad User
        obey pam restrictions = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        dns proxy = No
        usershare allow guests = Yes
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb
        inherit permissions = Yes
        inherit acls = Yes


[DATA]
        path = /mnt/raid/
        read only = No
        guest ok = Yes

here is /etc/nsswitch.conf (I've tried adding and removing 'winbindd from shadow, no change at all):

# cat /etc/nsswitch.conf 
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat winbind
gshadow:        files

hosts:          files mdns4_minimal [NOTFOUND=return] dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

I don't understand why authentication never seems to go through winbind. I'm getting desperate, any ideas?

Best Answer

I've found the core problem: a missing package. Unfortunately it's not easy to get right: here is the final, working configuration (thanks to Rowland Penny from samba.org):

get sure you installed all the necessary packages (the missing one was libnss-winbind):

apt-get install samba acl attr quota fam winbind libpam-winbind \
libpam-krb5 libnss-winbind krb5-config krb5-user ntp dnsutils ldb-tools

stop the services

service smbd stop
service nmbd stop
service winbind stop

set up a proper smb.conf (particularly the idmap parameters):

[global]
    workgroup = TESTAD
    security = ADS
    realm = TESTAD.LAN

    dedicated keytab file = /etc/krb5.keytab
    kerberos method = secrets and keytab
    server string = Data %h

    winbind use default domain = yes
    winbind expand groups = 4
    winbind nss info = rfc2307
    winbind refresh tickets = Yes
    winbind offline logon = yes
    winbind normalize names = Yes

    ## map ids outside of domain to tdb files.
    idmap config *:backend = tdb
    idmap config *:range = 2000-9999
    ## map ids from the domain  the ranges may not overlap !
    idmap config TESTAD : backend = rid
    idmap config TESTAD : range = 10000-999999
    template shell = /bin/bash
    template homedir = /home/TESTAD/%U

    domain master = no
    local master = no
    preferred master = no
    os level = 20
    map to guest = bad user
    host msdfs = no

    # user Administrator workaround, without it you are unable to set privileges
    username map = /etc/samba/user.map

    # For ACL support on domain member
    vfs objects = acl_xattr
    map acl inherit = Yes
    store dos attributes = Yes

    # Share Setting Globally
    unix extensions = no
    reset on zero vc = yes
    veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
    hide unreadable = yes

    # disable printing completely
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes

In that configuration, there is a required additional /etc/samba/user.map file containing the following line:

!root = TESTAD\Administrator TESTAD\administrator Administrator administrator

Don't forget to properly fill in /etc/krb5.conf:

[libdefaults]
    default_realm = TESTAD.LAN
    dns_lookup_realm = false
    dns_lookup_kdc = true

Be careful, krb5.conf must be owned by root and readable by everyone (644 rights).

Edit /etc/nsswitch.conf and add winbind to the passwd and group lines:

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat files winbind
group:          compat files winbind
shadow:         compat files 

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Now join the domain:

# net ads join -U Administrator
Using short domain name -- TESTAD
Joined 'DEBMEMBER' to dns domain 'TESTAD.example.com'

Finally start the services:

service smbd start
service nmbd start
service winbind start

getent passwd should work with AD users now:

# getent passwd testuser
testuser:*:11107:10513:testuser:/home/TESTAD/testuser:/bin/bash

CAVEAT As I had previously joined the AD without having installed the necessary libraries, I had to reboot the system to get the system after this setup to properly authenticate users!

Related Topic