Edit: I tried to simplify the question:

========================================================================= How can I enable a local (linux/samba) user to access a samba share (member server) besides the AD-users, which already have access?

The problem is that my samba always asks the DC for user authentication and never tries to authenticate the user using passwd/smbpasswd.


Here is the old, long question:

i managed to set up a Samba 4 server on Ubuntu 18.04.

My steps:

  • Drive is mounted with "user_xattr acl"
  • Hostname is set to e.g. myserver
  • ipv6 is disabled
  • the ipv4 static ip is set correctly with netplan
  • the only entry in /etc/hosts is " localhost"
  • timesync is configured and working
  • installed: krb5-user samba sssd sssd-tools
  • created an AD Group (edit: on the Windows Server 2008 DC) e. g. g_fileserver_rw and joined the AD accounts to the group
  • /etc/krb5.conf

       default_realm = INTDOM.TLD
       ticket_lifetime = 24h #
       renew_lifetime = 7d
    # The following krb5.conf variables are only for MIT Kerberos.
       kdc_timesync = 1
       ccache_type = 4
       forwardable = true
       proxiable = true
    # The following libdefaults parameters are only for Heimdal Kerberos.
       fcc-mit-ticketflags = true
       .intdom.tld = INTDOM.TLD
       intdom.tld = INTDOM.TLD

    I have a comprehension question here: Are the parameters "kdc_timesync, ccache_type, forwardable, proxiable, fcc-mit-ticketflags" necessary or adverse here?

  • /etc/sssd/sssd.conf, mode 600

    services = nss, pam
    config_file_version = 2
    domains = MC.DE
    id_provider = ad
    access_provider = ad
    # edit: this is actually not used
    override_homedir = /home/%d/%u
    # edit: I need this, performance not an issue in my env.
    enumerate = true
  • /etc/nsswitch.conf

    passwd:         compat systemd sss
    group:          compat systemd sss
    shadow:         compat sss
    gshadow:        files
    hosts:          files dns
    networks:       files
    protocols:      db files
    services:       db files sss
    ethers:         db files
    rpc:            db files
    netgroup:       nis sss
    sudoers:        files sss
  • Domain join with ´net ads join -U admin@INTDOM.TLD´ was successfull

  • ´getent passwd´ and ´getent group´ list local and domain users respectively groups
  • I added a local user (e.g. lu) with this command: ´adduser --home /dev/null --shell /bin/true --gecos "" lu´
  • then I created a samba user with ´smbpasswd lu´ using the same password
  • I set up the rights on the shares like that (if you wonder that group has more rights than user, see ´acl group control = yes´ entry in smb.conf below):

    chown -R lu:@g_fileserver_rw@INTDOM.TLD /sambashare/One
    chown -R lu:@g_fileserver_rw@INTDOM.TLD /sambashare/Two
    chmod u-w,g+w,o-rwx /sambashare/One
    chmod g+w,o-rwx /sambashare/Two
  • /etc/samba/smb.conf

       workgroup = INTERNAL
    # Entries recommended in Ubuntu-Wiki:
            log level = 0
            client signing = yes
            client use spnego = yes
            kerberos method = secrets and keytab
            realm = INTDOM.TLD
            security = ads
    # End of Ubuntu-Wiki-entries
    # My entries
    restrict anonymous = 2
    acl group control = yes
    inherit acls = yes
    inherit owner = yes
    inherit permissions = yes
    vfs objects = acl_xattr
    deadtime = 15
    store dos attributes = yes
    domain master = no
    local master = no
    preferred master = no
    os level = 0
    idmap config * : backend = tdb
    idmap config * : range = 1000-199999
    idmap config MC.DE : backend = sss
    idmap config MC.DE : range = 200000-2000200000
    # End of my entries
       server string = %h server (Samba, Ubuntu)
       wins server = <WINS-Server IP Address>
       dns proxy = no
       log file = /var/log/samba/log.%m
       max log size = 1000
       syslog = 0
       panic action = /usr/share/samba/panic-action %d
       server role = member server
       passdb backend = tdbsam
       obey pam restrictions = yes
       passwd program = /usr/bin/passwd %u
       passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
       map to guest = bad user
            path = /sambashare/One
            valid users = "lu", @g_fileserver_rw@INTDOM.TLD
            create mask = 570
            directory mask = 570
            writeable = no
            write list = @g_fileserver_rw@INTDOM.TLD
            path = /sambashare/Two
            valid users = "lu", @g_fileserver_rw@INTDOM.TLD
            create mask = 770
            directory mask = 770
            writeable = yes

For a week all was working normal, but now the local user "lu" can no longer access the shares. The domain users can access the shares normally. The local rights are still the same: ´drwxrwx---+´ on directories and ´-r-xrwx---+´ for lu:g_fileserver_rw@INTDOM.TLD.

Can someone tell me how to enable the local user to access the shares again?


Well, it was my fault. The config is actually working and it did not stop working after a few days, but I was rather dumb to make this assumption as I saw problems with other machines. It still worked on the machines I tested it first.

Windows machines, which had an altered security policy (different from the default) could not connect using a local account.

The setting is here:

Under "Security Options" in secpol.msc:

"Network security: LAN Manager authentication level"

it started to work, as soon as I set it to:

"Send NTLMv2 response only"

I'm sorry that I wasted your time.

A mod can remove my question and answer all together, if he considers so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.