3

I have a samba4 server:

[global]
    workgroup = MYWG
    realm = MYWG.ORG
    netbios name = MYWGADM
    server role = active directory domain controller
    dns forwarder = 8.8.8.8
    idmap_ldb:use rfc2307 = yes
    log level = 3
    template shell    = /bin/bash
    template homedir  = /home/%D/%U

[netlogon]
    path = /var/lib/samba/sysvol/mywg.org/scripts
    read only = No

[sysvol]
    path = /var/lib/samba/sysvol
    read only = No

[home]
    path = /data/share/home/
    read only = No

And an ubuntu 14.04 client joined to domain:

[global]
    workgroup = MYWG
    realm = MYWG.ORG
    netbios name = pcl01
    security = ADS
    encrypt passwords = yes
    idmap config MYWG:backend = ad
    idmap config MYWG:schema_mode = rfc2307
    idmap config MYWG:range = 10000-39999
    idmap config *:backend = tdb
    idmap config *:range = 40000-49999
    winbind nss info = rfc2307
    winbind trusted domains only = no
    winbind use default domain = yes
    winbind enum users = yes
    winbind enum groups = yes
    winbind refresh tickets = yes
    kerberos method = system keytab
    template homedir = /home/MYWG.ORG/%U
    template shell = /bin/bash
    log level = 3

wbinfo -u shows:
    administrator
    usrtest
    krbtgt
    guest
wbinfo -g shows:
    allowed rodc password replication group
    enterprise read-only domain controllers
    denied rodc password replication group
    read-only domain controllers
    group policy creator owners
    ras and ias servers
    domain controllers
    enterprise admins
    domain computers
    cert publishers
    dnsupdateproxy
    domain admins
    domain guests
    schema admins 
    domain users
    dnsadmins

net ads info shows:
    LDAP server: 10.0.0.1
    LDAP server name: mydc.mywg.org
    Realm: MYWG.ORG
    Bind Path: dc=MYWG,dc=ORG
    LDAP port: 389
    Server time: mar., 29 mars 2016 17:22:19 CEST
    KDC server: 10.0.0.1
    Server time offset: 20

wbinfo -a usrtest%mypassword shows:
    plaintext password authentication succeeded
    challenge/response password authentication succeeded

If I try to authenticate domain users (eg: usrtest) via console login screen, I get this error message (and user does not log in):

Mar 29 17:16:48 pcl01 login[1971]: pam_unix(login:auth): authentication  failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty2 ruser= rhost=  user=usrtest
Mar 29 17:16:48 pcl01 login[1971]: pam_winbind(login:auth): getting password (0x00000388)
Mar 29 17:16:48 pcl01 login[1971]: pam_winbind(login:auth): pam_get_item returned a password
Mar 29 17:16:48 pcl01 login[1971]: pam_winbind(login:auth): user 'usrtest' granted access
Mar 29 17:16:48 pcl01 login[1971]: Authentication service cannot retrieve authentication info

Here is my /etc/pam.d/login file:

auth       optional   pam_faildelay.so  delay=3000000
auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad   default=die] pam_securetty.so
auth       requisite  pam_nologin.so
session [success=ok ignore=ignore module_unknown=ignore default=bad]  pam_selinux.so close
session       required   pam_env.so readenv=1
session       required   pam_env.so readenv=1 envfile=/etc/default/locale
@include common-auth
auth       optional   pam_group.so
session    required   pam_limits.so
session    optional   pam_lastlog.so
session    optional   pam_motd.so  motd=/run/motd.dynamic noupdate
session    optional   pam_motd.so
session    optional   pam_mail.so standard
@include common-account
@include common-session
@include common-password
session [success=ok ignore=ignore module_unknown=ignore default=bad]  pam_selinux.so open

and my /etc/pam.d/common-auth file(generated by pam-auth-update):

auth    [success=3 default=ignore]  pam_unix.so nullok_secure
auth    [success=2 default=ignore]  pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    [success=1 default=ignore]  pam_sss.so use_first_pass
auth    requisite           pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so

common-account file:

account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so 
account [success=1 new_authtok_reqd=done default=ignore]    pam_winbind.so 
account requisite           pam_deny.so
account required            pam_permit.so
account sufficient          pam_localuser.so 
account [default=bad success=ok user_unknown=ignore]    pam_sss.so

common-session file:

session [default=1]         pam_permit.so
session requisite           pam_deny.so
session required            pam_permit.so
session optional            pam_umask.so
session required pam_mkhomedir.so umask=0077 skel=/etc/skel
session required    pam_unix.so 
session sufficient          pam_winbind.so 
session optional            pam_sss.so 
session optional    pam_systemd.so 
session optional            pam_ck_connector.so nox11

And common-password file:

password    requisite           pam_pwquality.so retry=3
password    [success=3 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    [success=2 default=ignore]  pam_winbind.so use_authtok try_first_pass
password    sufficient          pam_sss.so use_authtok
password    requisite           pam_deny.so
password    required            pam_permit.so
password    optional    pam_gnome_keyring.so 

I can't explain error message (in auth.log), and don't know what I can check more, so ... any help would be really appreciated.

Cheers.

0

You must log in to answer this question.

Browse other questions tagged .