ubuntu 20 broke samba using sssd

Question

I am using Ubuntu (server) with SSSD to join active directory domain. (using realm join to join the server to the domain) The only settings (other than shares) I change in smb.conf are the following:

   workgroup = MYDOMAIN
   client signing = yes
   client use spnego = yes
   kerberos method = secrets and keytab
   realm = MYDOMAIN.FQDN
   security = ads

which enables me to ssh into the server with active directory users and access SMB shares I have created on them. unfortunately Ubuntu 20 has broken samba, and the service will no longer start with security = ads being present in the configuration (ssh with AD users still work).

in log.smbd I see the following errors (when trying to start the service with security = ads):

[2020/08/24 18:28:58.872952,  0] ../../source3/auth/auth_util.c:1384(make_new_session_info_guest)
  create_local_token failed: NT_STATUS_INVALID_PARAMETER_MIX
[2020/08/24 18:28:58.873055,  0] ../../source3/smbd/server.c:2034(main)
  ERROR: failed to setup guest info.

I have tried making various configuration changes but nothing seems to work. Am I doing something wrong?

Answer 1

Your problem is that you are using sssd with Samba and shares. You now need to run winbind with your setup and shares. The problem is that you cannot use winbind with sssd, this is because sssd uses its own variant of some of the winbind libs and they are not compatible with the Samba ones. You can continue to use sssd with Samba, but only for authentication, no shares and it needs to be setup to use idmap-sss. This all started from Samba 4.8.0, I suppose I should also mention that sssd doesn't do NTLM. I suggest you read this samba wiki page: https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member