Edit: I tried to simplify the question:
========================================================================= How can I enable a local (linux/samba) user to access a samba share (member server) besides the AD-users, which already have access?
The problem is that my samba always asks the DC for user authentication and never tries to authenticate the user using passwd/smbpasswd.
Here is the old, long question:
i managed to set up a Samba 4 server on Ubuntu 18.04.
- Drive is mounted with "user_xattr acl"
- Hostname is set to e.g. myserver
- ipv6 is disabled
- the ipv4 static ip is set correctly with netplan
- the only entry in /etc/hosts is "127.0.0.1 localhost"
- timesync is configured and working
- installed: krb5-user samba sssd sssd-tools
- created an AD Group (edit: on the Windows Server 2008 DC) e. g. g_fileserver_rw and joined the AD accounts to the group
[libdefaults] default_realm = INTDOM.TLD ticket_lifetime = 24h # renew_lifetime = 7d # The following krb5.conf variables are only for MIT Kerberos. kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. fcc-mit-ticketflags = true [realms] [domain_realm] .intdom.tld = INTDOM.TLD intdom.tld = INTDOM.TLD
I have a comprehension question here: Are the parameters "kdc_timesync, ccache_type, forwardable, proxiable, fcc-mit-ticketflags" necessary or adverse here?
/etc/sssd/sssd.conf, mode 600
[sssd] services = nss, pam config_file_version = 2 domains = MC.DE [domain/MC.DE] id_provider = ad access_provider = ad # edit: this is actually not used override_homedir = /home/%d/%u # edit: I need this, performance not an issue in my env. enumerate = true
passwd: compat systemd sss group: compat systemd sss shadow: compat sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: files sss
Domain join with ´net ads join -U admin@INTDOM.TLD´ was successfull
- ´getent passwd´ and ´getent group´ list local and domain users respectively groups
- I added a local user (e.g. lu) with this command: ´adduser --home /dev/null --shell /bin/true --gecos "" lu´
- then I created a samba user with ´smbpasswd lu´ using the same password
I set up the rights on the shares like that (if you wonder that group has more rights than user, see ´acl group control = yes´ entry in smb.conf below):
chown -R lu:@g_fileserver_rw@INTDOM.TLD /sambashare/One chown -R lu:@g_fileserver_rw@INTDOM.TLD /sambashare/Two chmod u-w,g+w,o-rwx /sambashare/One chmod g+w,o-rwx /sambashare/Two
[global] workgroup = INTERNAL # Entries recommended in Ubuntu-Wiki: log level = 0 client signing = yes client use spnego = yes kerberos method = secrets and keytab realm = INTDOM.TLD security = ads # End of Ubuntu-Wiki-entries # My entries restrict anonymous = 2 acl group control = yes inherit acls = yes inherit owner = yes inherit permissions = yes vfs objects = acl_xattr deadtime = 15 store dos attributes = yes domain master = no local master = no preferred master = no os level = 0 idmap config * : backend = tdb idmap config * : range = 1000-199999 idmap config MC.DE : backend = sss idmap config MC.DE : range = 200000-2000200000 # End of my entries server string = %h server (Samba, Ubuntu) wins server = <WINS-Server IP Address> dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = member server passdb backend = tdbsam obey pam restrictions = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . map to guest = bad user [One] path = /sambashare/One valid users = "lu", @g_fileserver_rw@INTDOM.TLD create mask = 570 directory mask = 570 writeable = no write list = @g_fileserver_rw@INTDOM.TLD [Two] path = /sambashare/Two valid users = "lu", @g_fileserver_rw@INTDOM.TLD create mask = 770 directory mask = 770 writeable = yes
For a week all was working normal, but now the local user "lu" can no longer access the shares. The domain users can access the shares normally. The local rights are still the same: ´drwxrwx---+´ on directories and ´-r-xrwx---+´ for lu:g_fileserver_rw@INTDOM.TLD.
Can someone tell me how to enable the local user to access the shares again?