Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have spent several days attempting to solve this- none of the answers on this forum or any other were able to help. I tried everything. I read the entire Samba manual. Nothing worked.

Happily, I have solved it and would like to share the answer with the community.

Here was my specific issue:
I have Samba 3.6.3 running on Ubuntu Server 12.04. The server is joined to my company domain with PowerBroker Identity Services Open Edition (they purchased Likewise). I followed the manual and set up a share using AD group permissions. It was accessible from Linux and Mac using AD permissions. From Windows 7, it was accessible only on machines not joined to the domain. Once joined to the domain it was only accessible via IP- short hostname and FQDN would respond with a password error.

share|improve this question

Clearly, there was an issue with group security policy on the domain- but it was not an option to change security policy for one network share. Based on my research, the issue was related to how AD created Kerberos tickets- and the domain policy was to only use Kerberos. Samba works with NTMLv2 but Samba was not responsible for authentication- AD was, and PBIS was responsible for making that happen.

The issue was stemming from Samba not accessing PBIS' keytab file. I resolved that by entering this in smb.conf under [global]:

Kerberos method = dedicated keytab
dedicated keytab file = /etc/krb5.keytab

The default for Kerberos method is secrets only which uses a tdb file for tickets- that doesn't work with PBIS. You have to tell Samba to only use the keytab file that PBIS uses. Once I did that- authentication worked correctly with IP, short hostname, and FQDN.

You can find which keytab file PBIS is using by checking the krb5.conf file (usually /etc/krb5.conf) and checking the default_keytab_name setting.

For reference, here is my smb.conf:

security = ADS
workgroup = DOMAIN
realm = DOMAIN.COM
machine password timeout = 0
server string = %h
local master = no
encrypt passwords = yes
Kerberos method = dedicated keytab
dedicated keytab file = /etc/krb5.keytab
deadtime = 20
log level = 20
debug pid = true
debug class = yes
log file = /var/log/samba-pbis.log

comment = test
path = /test
browseable = yes
read only = no
writeable = yes
valid users = @DOMAIN\user1 @DOMAIN\domain^users
admin users = @DOMAIN\domain^admins
guest ok = yes
create mask = 0774
directory mask = 0774
inherit acls = yes
inherit permissions = yes
share|improve this answer
If you want a single user, you need to remove the @ ... i.e. DOMAIN\user1. Other than that - thanks for sharing - it helped me. – AWippler May 8 '14 at 21:38
Very helpful ! Thanks a lot. – romu Jul 2 '14 at 10:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.