7:43 a.m.
Hi,
I am trying to setup FreeIPA to authenticate users logging into Linux systems, but would
also like to use this to authenticate users accessing Samba shares from Windows clients.
The problem is that I cannot access the shares at all from Windows clients and when I try
to access a share from a Linux client, the following error message is printed:
robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U robert
WARNING: The "syslog" option is deprecated
krb5_init_context failed (Invalid argument)
smb_krb5_context_init_basic failed (Invalid argument)
Enter WORKGROUP\robert's password:
krb5_init_context failed (Invalid argument)
smb_krb5_context_init_basic failed (Invalid argument)
session setup failed: NT_STATUS_LOGON_FAILURE
Information regarding the setup:
- The FreeIPA + Samba server (samba.linux.company.local) is a VM running CentOS 7. The
FreeIPA version is "VERSION: 4.5.4, API_VERSION: 2.228". The Samba version is
4.7.1.
- The firewalls on the server, VM host and clients are turned off for debugging purposes.
- SELINUX is also turned off.
- This was a fresh install and FreeIPA was setup with the following commands:
sudo yum install ipa-server
sudo ipa-server-install
Do you want to configure integrated DNS (BIND)? [no]: no
Server host name [ipa.company.local]: samba.linux.company.local
Please confirm the domain name [company.local]: samba.linux.company.local
Please provide a realm name [SAMBA.COMPANY.LOCAL]: SAMBA.LINUX.COMPANY.LOCAL
- The users can log into the Linux workstations that have been enrolled, suggesting that
the setup is at least partly correct.
The Windows clients are not enrolled into the FreeIPA domain and are instead in the domain
company.local. I followed the instructions here
(https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...) with
the following options:
yum install ipa-server-trust-ad
sudo ipa-adtrust-install
Enable trusted domains support in slapi-nis? [no]: no
NetBIOS domain name [LINUX]: LINUX
Do you want to run the ipa-sidgen task? [no]: yes
Followed by:
sudo mkdir /samba
sudo chmod 777 /samba
sudo net conf addshare samba /samba writeable=y guest_ok=n
sudo systemctl restart smb
Running sudo net conf list produces the following output:
[global]
workgroup = LINUX
netbios name = SAMBA
realm = LINUX.COMPANY.LOCAL
kerberos method = dedicated keytab
dedicated keytab file = /etc/samba/samba.keytab
create krb5 conf = no
security = user
domain master = yes
domain logons = yes
log level = 1
max log size = 100000
log file = /var/log/samba/log.%m
passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-COMPANY-LOCAL.socket
disable spoolss = yes
ldapsam:trusted = yes
ldap ssl = off
ldap suffix = dc=linux,dc=company,dc=local
ldap user suffix = cn=users,cn=accounts
ldap group suffix = cn=groups,cn=accounts
ldap machine suffix = cn=computers,cn=accounts
rpc_server:epmapper = external
rpc_server:lsarpc = external
rpc_server:lsass = external
rpc_server:lsasd = external
rpc_server:samr = external
rpc_server:netlogon = external
rpc_server:tcpip = yes
rpc_daemon:epmd = fork
rpc_daemon:lsasd = fork
[samba]
path = /samba
guest ok = yes
read only = no
When I try to mount the share on Windows clients (either with \\192.168.0.xx\samba or
\\samba.linux.company.local in Explorer) it states that 'The user name or password is
incorrect.' I am not convinced that this is the case, however, since the same message
is displayed even if the share is created with the option 'guest_ok=y'.
If I try to mount the 'guest_ok=y' share from a Linux client in the FreeIPA realm,
I at least get an error message:
robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U username
WARNING: The "syslog" option is deprecated
krb5_init_context failed (Invalid argument)
smb_krb5_context_init_basic failed (Invalid argument)
Enter LINUX\robert's password:
krb5_init_context failed (Invalid argument)
smb_krb5_context_init_basic failed (Invalid argument)
session setup failed: NT_STATUS_LOGON_FAILURE
Under both Windows and Linux I have tried all combinations of domain (LINUX, SAMBA,
WORKGROUP) and various user that I can think of, but with no success.
Does anyone have an idea what the issue might be? I previously created the above setup on
a pair of VMs and everything worked as expected, but am having difficulty reproducing it
here....
Many thanks in advance for any help and suggestions! Please let me know if you need any
more information.
Rob
7:54 a.m.
On to, 29 marras 2018, Robert Byrne via FreeIPA-users wrote:
Hi,
I am trying to setup FreeIPA to authenticate users logging into Linux
systems, but would also like to use this to authenticate users
accessing Samba shares from Windows clients. The problem is that I
cannot access the shares at all from Windows clients and when I try to
access a share from a Linux client, the following error message is
printed:
We do not support this yet. Mounting shares from Windows requires
Windows applications to look up user and groups via Global Catalog
service on the side of the domain where share belongs to (IPA). As we do
not provide GC service, Windows clients fail.
As to the other direction, there are known bugs too. I recently outlined
some of them on samba-technical@ --
https://lists.samba.org/archive/samba-technical/2018-November/131274.html
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2:21 a.m.
New subject: Vault feature for AD users
Is there any possibility to use the vault feature for external (AD) users?
7:59 a.m.
Hi,
A belated thanks for the reply and I seem to have solved the problem. The cause might have
been obvious to others, but I will describe it here briefly in case it helps others:
- We have a FreeIPA server and this exports a number of directories by Samba. FreeIPA was
setup as described above and Samba as described here
(https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...).
- There is no trust with the Windows domain / AD. Some of the users are also using OSX.
- FreeIPA users were unable to mount the Samba shares if they entered
\\samba.linux.company.local\samba_share_name in e.g. Windows Explorer.
- The issue was that I had changed the users' UIDs and GIDs from those automatically
assigned by the Web UI to their current values to aid migration. The values were then
outside of the local domain range defined in the IPA server > ID ranges tab of the Web
UI. As soon as this range was changed (in my case through reinstalling FreeIPA server with
the option "--idstart=2000") the users could mount the shares from Windows.
A bit frustrating, but still a lot easier than setting up LDAP even without Samba! :-)
Somewhat off-topic. Does anyone know if the connection between the clients (Windows or
OSX) and the FreeIPA/Samba server is encrypted or how I could find this out? This is the
output of 'net conf list':
[global]
workgroup = LINUX
netbios name = IPA
realm = LINUX.CRELUX.LOCAL
kerberos method = dedicated keytab
dedicated keytab file = /etc/samba/samba.keytab
create krb5 conf = no
security = user
domain master = yes
domain logons = yes
log level = 1
max log size = 100000
log file = /var/log/samba/log.%m
passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-CRELUX-LOCAL.socket
disable spoolss = yes
ldapsam:trusted = yes
ldap ssl = off
ldap suffix = dc=linux,dc=crelux,dc=local
ldap user suffix = cn=users,cn=accounts
ldap group suffix = cn=groups,cn=accounts
ldap machine suffix = cn=computers,cn=accounts
rpc_server:epmapper = external
rpc_server:lsarpc = external
rpc_server:lsass = external
rpc_server:lsasd = external
rpc_server:samr = external
rpc_server:netlogon = external
rpc_server:tcpip = yes
rpc_daemon:epmd = fork
rpc_daemon:lsasd = fork
I guess from the line 'ldap ssl = off' that the user credentials are being sent in
plain-text. Is this correct?
Best regards,
Rob
8:45 a.m.
On ke, 05 joulu 2018, Robert Byrne via FreeIPA-users wrote:
Hi,
A belated thanks for the reply and I seem to have solved the problem. The cause might have
been obvious to others, but I will describe it here briefly in case it helps others:
- We have a FreeIPA server and this exports a number of directories by Samba. FreeIPA was
setup as described above and Samba as described here
(https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...).
- There is no trust with the Windows domain / AD. Some of the users are also using OSX.
- FreeIPA users were unable to mount the Samba shares if they entered
\\samba.linux.company.local\samba_share_name in e.g. Windows Explorer.
- The issue was that I had changed the users' UIDs and GIDs from those automatically
assigned by the Web UI to their current values to aid migration. The values were then
outside of the local domain range defined in the IPA server > ID ranges tab of the Web
UI. As soon as this range was changed (in my case through reinstalling FreeIPA server with
the option "--idstart=2000") the users could mount the shares from Windows.
A bit frustrating, but still a lot easier than setting up LDAP even without Samba! :-)
Somewhat off-topic. Does anyone know if the connection between the clients (Windows or
OSX) and the FreeIPA/Samba server is encrypted or how I could find this out? This is the
output of 'net conf list':
[global]
workgroup = LINUX
netbios name = IPA
realm = LINUX.CRELUX.LOCAL
kerberos method = dedicated keytab
dedicated keytab file = /etc/samba/samba.keytab
create krb5 conf = no
security = user
domain master = yes
domain logons = yes
log level = 1
max log size = 100000
log file = /var/log/samba/log.%m
passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-CRELUX-LOCAL.socket
disable spoolss = yes
ldapsam:trusted = yes
ldap ssl = off
ldap suffix = dc=linux,dc=crelux,dc=local
ldap user suffix = cn=users,cn=accounts
ldap group suffix = cn=groups,cn=accounts
ldap machine suffix = cn=computers,cn=accounts
rpc_server:epmapper = external
rpc_server:lsarpc = external
rpc_server:lsass = external
rpc_server:lsasd = external
rpc_server:samr = external
rpc_server:netlogon = external
rpc_server:tcpip = yes
rpc_daemon:epmd = fork
rpc_daemon:lsasd = fork
I guess from the line 'ldap ssl = off' that the user credentials are being sent in
plain-text. Is this correct?
passdb backend is set to use 'ipasam' module
with LDAPI protocol which
is LDAP over Unix domain socket. It doesn't use SSL but instead uses
GSSAPI for authentication and signing. So first, the data is not sent
over network, only between two daemons on the same machine over a UNIX
domain socket. And second, the channel set up with GSSAPI and it is
encrypted even for that UNIX domain socket.
Use of 'ldap ssl = off' is to avoid hitting the code paths in Samba that
require to handle certificate for the case where they are not needed at
all.
Hope this helps.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
1971
days inactive
1977
days old
freeipa-users@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Alexander Bokovoy -
Robert Byrne -
Ronald Wimmer