[Samba] Problem with Login Shell in User Information using Winbind - Samba

This is a discussion on [Samba] Problem with Login Shell in User Information using Winbind - Samba ; Hi all I am trying to get windows AD logins to work with Fedora 8/9 linux.I had the same setup working well with fedora 7 , but with fedora 8/9 the problem is whenever I do "getent passwd 'username'" the ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: [Samba] Problem with Login Shell in User Information using Winbind

  1. [Samba] Problem with Login Shell in User Information using Winbind

    Hi all

    I am trying to get windows AD logins to work with Fedora 8/9 linux.I had
    the same setup working well with fedora 7 , but with fedora 8/9 the
    problem is whenever I do "getent passwd 'username'" the login shell is
    listed as /bin/false and users cannot login , even though I have set it
    to use template shell= /bin/bash in the smb.conf configuration file.
    Also I have made the necessary changes to krb.conf , krb.realms and
    krb5.conf files for kerberos configuration and obtained the tickets
    using "kinit" . "klist" shows that I have the tickets.

    I have enabled pam_mkhomedir.so , so if I try my windows AD login by
    doing "su username" , it shows messages about creating home directory ,
    and gets me back to my local user prompt, due to no login shell. Also,
    if I input the wrong password , it says wrong password. So
    authentication seems working fine. For more info , here is the output of
    getent ,

    admin:*:16777216:16777216:admin:/home/ASURITE/admin:/bin/false

    I am running samba 3.2.0-rc1 version which shipped with Fedora 9 .

    Please advise me how to set the login shells as /bin/bash, as currently
    no domain users can login to my server.

    Aniket
    --
    To unsubscribe from this list go to the following URL and read the
    instructions: https://lists.samba.org/mailman/listinfo/samba


  2. Re: [Samba] Problem with Login Shell in User Information using Winbind


    I already had template shell = /bin/bash in my smb.conf, and still winbind was
    reporting the shell as /bin/false. This is the real problem. Winbind seems to
    ignore the template shell directive from the config file!!! First I tried with
    a manually edited file, next I configured using authconfig-gtk in fedora, both
    give same results (ie shell reported as /bin/false. I am posting my current
    smb.conf here.

    #======================= Global Settings =====================================

    [global]
    #--authconfig--start-line--

    # Generated by authconfig on 2008/06/04 18:09:37
    # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
    # Any modification may be deleted or altered by authconfig in future

    workgroup = ASURITE
    password server = asurite2.asurite.ad.asu.edu
    realm = ASU.EDU
    security = ads
    idmap uid = 16777216-33554431
    idmap gid = 16777216-33554431
    template shell = /bin/sh
    winbind use default domain = false
    winbind offline logon = false

    #--authconfig--end-line--

    # ----------------------- Netwrok Related Options -------------------------
    #
    # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
    #
    # server string is the equivalent of the NT Description field
    #
    # netbios name can be used to specify a server name not tied to the hostname
    #
    # Interfaces lets you configure Samba to use multiple interfaces
    # If you have multiple network interfaces then you can list the ones
    # you want to listen on (never omit localhost)
    #
    # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
    # specifiy it as a per share option as well
    #
    ; workgroup = ASURITE
    server string = Samba %v on mymachine

    ; netbios name = mymachine

    ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
    ; hosts allow = 127. 192.168.12. 192.168.13.

    # --------------------------- Logging Options -----------------------------
    #
    # Log File let you specify where to put logs and how to split them up.
    #
    # Max Log Size let you specify the max size log files should reach

    # logs split per machine
    log file = /var/log/samba/log.%m
    # max 50KB per log file, then rotate
    max log size = 50

    # ----------------------- Standalone Server Options ------------------------
    #
    # Scurity can be set to user, share(deprecated) or server(deprecated)
    #
    # Backend to store user information in. New installations should
    # use either tdbsam or ldapsam. smbpasswd is available for backwards
    # compatibility. tdbsam requires no further configuration.

    # security = ads
    # passdb backend = tdbsam


    # ----------------------- Domain Members Options ------------------------
    #
    # Security must be set to domain or ads
    #
    # Use the realm option only with security = ads
    # Specifies the Active Directory realm the host is part of
    #
    # Backend to store user information in. New installations should
    # use either tdbsam or ldapsam. smbpasswd is available for backwards
    # compatibility. tdbsam requires no further configuration.
    #
    # Use password server option only with security = server or if you can't
    # use the DNS to locate Domain Controllers
    # The argument list may include:
    # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
    # or to auto-locate the domain controller/s
    # password server = *


    ; security = ads
    passdb backend = tdbsam
    ; realm = ASU.EDU

    ; password server = asurite2.asurite.ad.asu.edu

    # ----------------------- Domain Controller Options ------------------------
    #
    # Security must be set to user for domain controllers
    #
    # Backend to store user information in. New installations should
    # use either tdbsam or ldapsam. smbpasswd is available for backwards
    # compatibility. tdbsam requires no further configuration.
    #
    # Domain Master specifies Samba to be the Domain Master Browser. This
    # allows Samba to collate browse lists between subnets. Don't use this
    # if you already have a Windows NT domain controller doing this job
    #
    # Domain Logons let Samba be a domain logon server for Windows workstations.
    #
    # Logon Scrpit let yuou specify a script to be run at login time on the client
    # You need to provide it in a share called NETLOGON
    #
    # Logon Path let you specify where user profiles are stored (UNC path)
    #
    # Various scripts can be used on a domain controller or stand-alone
    # machine to add or delete corresponding unix accounts
    #
    ; security = user
    ; passdb backend = tdbsam

    ; domain master = yes
    ; domain logons = yes

    # the login script name depends on the machine name
    ; logon script = %m.bat
    # the login script name depends on the unix user used
    ; logon script = %u.bat
    ; logon path = \\%L\Profiles\%u
    # disables profiles support by specifing an empty path
    ; logon path =

    ; add user script = /usr/sbin/useradd "%u" -n -g users
    ; add group script = /usr/sbin/groupadd "%g"
    ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d
    /nohome -s /bin/false "%u"
    ; delete user script = /usr/sbin/userdel "%u"
    ; delete user from group script = /usr/sbin/userdel "%u" "%g"
    ; delete group script = /usr/sbin/groupdel "%g"


    # ----------------------- Browser Control Options ----------------------------
    #
    # set local master to no if you don't want Samba to become a master
    # browser on your network. Otherwise the normal election rules apply
    #
    # OS Level determines the precedence of this server in master browser
    # elections. The default value should be reasonable
    #
    # Preferred Master causes Samba to force a local browser election on startup
    # and gives it a slightly higher chance of winning the election
    ; local master = no
    ; os level = 33
    ; preferred master = yes

    #----------------------------- Name Resolution -------------------------------
    # Windows Internet Name Serving Support Section:
    # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
    #
    # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
    #
    # - WINS Server: Tells the NMBD components of Samba to be a WINS Client
    #
    # - WINS Proxy: Tells Samba to answer name resolution queries on
    # behalf of a non WINS capable client, for this to work there must be
    # at least one WINS Server on the network. The default is NO.
    #
    # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
    # via DNS nslookups.

    ; wins support = yes
    wins server = 129.219.17.11 129.219.13.105 129.219.17.194
    ; wins proxy = yes

    ; dns proxy = yes

    # --------------------------- Printing Options -----------------------------
    #
    # Load Printers let you load automatically the list of printers rather
    # than setting them up individually
    #
    # Cups Options let you pass the cups libs custom options, setting it to raw
    # for example will let you use drivers on your Windows clients
    #
    # Printcap Name let you specify an alternative printcap file
    #
    # You can choose a non default printing system using the Printing option

    load printers = yes
    cups options = raw

    ; printcap name = /etc/printcap
    #obtain list of printers automatically on SystemV
    ; printcap name = lpstat
    ; printing = cups

    # --------------------------- Filesystem Options ---------------------------
    #
    # The following options can be uncommented if the filesystem supports
    # Extended Attributes and they are enabled (usually by the mount option
    # user_xattr). Thess options will let the admin store the DOS attributes
    # in an EA and make samba not mess with the permission bits.
    #
    # Note: these options can also be set just per share, setting them in global
    # makes them the default for all shares

    ; map archive = no
    ; map hidden = no
    ; map read only = no
    ; map system = no
    ; store dos attributes = yes


    #============================ Share Definitions ==============================

    [homes]
    comment = Home Directories
    browseable = no
    writable = yes
    ; valid users = %S
    ; valid users = MYDOMAIN\%S

    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    guest ok = no
    writable = no
    printable = yes

    # Un-comment the following and create the netlogon directory for Domain Logons
    ; [netlogon]
    ; comment = Network Logon Service
    ; path = /var/lib/samba/netlogon
    ; guest ok = yes
    ; writable = no
    ; share modes = no


    # Un-comment the following to provide a specific roving profile share
    # the default is to use the user's home directory
    ; [Profiles]
    ; path = /var/lib/samba/profiles
    ; browseable = no
    ; guest ok = yes


    # A publicly accessible directory, but read only, except for people in
    # the "staff" group
    ; [public]
    ; comment = Public Stuff
    ; path = /home/samba
    ; public = yes
    ; writable = yes
    ; printable = no
    ; write list = +staff


    This one was generated after using the authconfig-gtk in fedora 9 .






    On Wednesday 04 June 2008 19:36:10 Philipoff, Andrew wrote:
    > Edit your smb.conf and restart smbd:
    > Change:
    > template shell = /bin/false
    > To:
    > template shell = /bin/bash
    >
    > Be careful in enabling this as it will potentially allow all domain users
    > to login with a shell. We add the following to /etc/pam.d/sshd to restrict
    > ssh shell access to specific AD and local groups (substitute your AD or
    > local group for group_name): account sufficient pam_succeed_if.so user
    > ingroup group_name
    >
    > You'll need to restart sshd after editing /etc/pam.d/sshd. Note that you'll
    > also need to add any local users/groups that need ssh access. I found how
    > to do this here:
    > http://blogs.sun.com/tkblog/entry/in...tive_directory
    > http://linux.die.net/man/8/pam_succeed_if
    > You could also add AD users to a local group and use it in /etc/pam.d/sshd
    > instead of an AD group.
    >
    > Andrew Philipoff
    > Information Systems
    > Department of Medicine, UCSF
    >
    > -----Original Message-----
    > From: samba-bounces+aphilipoff=medicine.ucsf.edu@lists.samba.o rg
    > [mailto:samba-bounces+aphilipoff=medicine.ucsf.edu@lists.samba.o rg] On
    > Behalf Of Aniket Bharaswadkar Sent: Wednesday, June 04, 2008 4:32 PM
    > To: samba@lists.samba.org
    > Subject: [Samba] Problem with Login Shell in User Information using Winbind
    >
    > Hi all
    >
    > I am trying to get windows AD logins to work with Fedora 8/9 linux.I had
    > the same setup working well with fedora 7 , but with fedora 8/9 the
    > problem is whenever I do "getent passwd 'username'" the login shell is
    > listed as /bin/false and users cannot login , even though I have set it
    > to use template shell= /bin/bash in the smb.conf configuration file.
    > Also I have made the necessary changes to krb.conf , krb.realms and
    > krb5.conf files for kerberos configuration and obtained the tickets
    > using "kinit" . "klist" shows that I have the tickets.
    >
    > I have enabled pam_mkhomedir.so , so if I try my windows AD login by
    > doing "su username" , it shows messages about creating home directory ,
    > and gets me back to my local user prompt, due to no login shell. Also,
    > if I input the wrong password , it says wrong password. So
    > authentication seems working fine. For more info , here is the output of
    > getent ,
    >
    > admin:*:16777216:16777216:admin:/home/ASURITE/admin:/bin/false
    >
    > I am running samba 3.2.0-rc1 version which shipped with Fedora 9 .
    >
    > Please advise me how to set the login shells as /bin/bash, as currently
    > no domain users can login to my server.
    >
    > Aniket



    --
    To unsubscribe from this list go to the following URL and read the
    instructions: https://lists.samba.org/mailman/listinfo/samba


  3. Re: [Samba] Problem with Login Shell in User Information using Winbind

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Aniket Bharaswadkar wrote:
    > I already had template shell = /bin/bash in my smb.conf, and still winbind was
    > reporting the shell as /bin/false. This is the real problem. Winbind seems to
    > ignore the template shell directive from the config file!!! First I tried with
    > a manually edited file, next I configured using authconfig-gtk in fedora, both
    > give same results (ie shell reported as /bin/false. I am posting my current
    > smb.conf here.


    Are you absolutely sure you restarted winbindd after making
    any config changes? Also in current versions the nss_info data
    is cached for a period of "winbind cache time seconds" so you may
    need to purge winbindd_cache.tdb. Also check for any other
    caching services (e.g. nscd) outside of winbindd.



    cheers, jerry
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFISAVuIR7qMdg1EfYRAmrVAKCVzcKcOnBCatiSpMnWD3 uczouOOQCg1eK9
    RGagajpBsCqdDpEeZeZcHcs=
    =paSj
    -----END PGP SIGNATURE-----
    --
    To unsubscribe from this list go to the following URL and read the
    instructions: https://lists.samba.org/mailman/listinfo/samba


  4. Re: [Samba] Problem with Login Shell in User Information using Winbind


    Ok I got around the problem of /bin/false shell ! I rechecked all the configs
    and joined the machines to to domain again using

    net join ads -w asurite -U Administrator -S

    and it showed proper login shell in getent output! So users can login now, and
    thanks to Philipoff's excellent suggestion, I have given ssh access only to
    admins group using pam_succeed_if.so

    Only issue now is , intermittently winbind seems to die and getent produces no
    output , and users cannot login , the /var/log/secure entries are

    Jun 5 16:06:24 mymachine sshd[15223]: pam_winbind(sshd:account):
    pam_winbind_request: read from socket failed!
    Jun 5 16:06:24 mymachine sshd[15223]: pam_winbind(sshd:account): internal
    module error (retval = 3, user = 'abhinan')
    Jun 5 16:06:24 mymachine sshd[15223]: Failed password for abhinan from
    129.219.249.116 port 50991 ssh2
    Jun 5 16:06:24 mymachine sshd[15224]: fatal: Access denied for user abhinan
    by PAM account configuration

    A restart of winbind service fixes this problem. Also during this, the
    winbindd log shows error regarding DCERPC_FAULT_ACCESS_DENIED .

    So thanks to all here, apart from this issue my original problem is solved
    now!

    Cheers

    On Thursday 05 June 2008 08:25:34 Gerald (Jerry) Carter wrote:
    > Aniket Bharaswadkar wrote:
    > > I already had template shell = /bin/bash in my smb.conf, and still
    > > winbind was reporting the shell as /bin/false. This is the real problem.
    > > Winbind seems to ignore the template shell directive from the config
    > > file!!! First I tried with a manually edited file, next I configured
    > > using authconfig-gtk in fedora, both give same results (ie shell
    > > reported as /bin/false. I am posting my current smb.conf here.

    >
    > Are you absolutely sure you restarted winbindd after making
    > any config changes? Also in current versions the nss_info data
    > is cached for a period of "winbind cache time seconds" so you may
    > need to purge winbindd_cache.tdb. Also check for any other
    > caching services (e.g. nscd) outside of winbindd.
    >
    >
    >
    > cheers, jerry



    --
    To unsubscribe from this list go to the following URL and read the
    instructions: https://lists.samba.org/mailman/listinfo/samba


+ Reply to Thread