topic Re: SAMBA AUTHENTICATION in Operating System - HP-UX

SAMBA AUTHENTICATION

Nobody's Hero — Thu, 10 Jul 2003 13:01:39 GMT

I am real confused with my samba settings.
I am running samba on the UNIX side. When I try to map a network drive on my win2k box I get prompted for a password, but it wont let me mount.

I am curious what settings people are using.
I am trying to authenticate at the Domain level.

My questions relate to specific fields in the samba config. like

''security options''

should this be
share
domain
user
or server.

I want to authenticate through our corporate domain.

Do I still need to create user mappings if I want to go this way?

Re: SAMBA AUTHENTICATION

Nobody's Hero — Thu, 10 Jul 2003 13:02:20 GMT

would it be posible for someone to show me the samba config file they are using?

Re: SAMBA AUTHENTICATION

Keely Jackson — Thu, 10 Jul 2003 13:08:14 GMT

Hi Robert

Here are the global settings from our Samba config file.

[global]

# workgroup = NT-Domain-Name or Workgroup-Name, eg: REDHAT4
workgroup = MOP_EFOS
# server string is the equivalent of the NT Description field
server string = MOP, EFOS, Mierva and Billing Samba Servers

# this tells Samba to use a separate log file for each machine
# that connects
log file = /var/opt/samba/log.%m

# Put a capping on the size of the log files (in Kb).
max log size = 50

# Security mode. Most people will want user level security. See
# security_level.txt for details.
security = server
# Use password server option only with security = server or domain
password server = OOOOO

# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
encrypt passwords = yes

# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
socket options = TCP_NODELAY

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
local master = no

read only = no
preserve case = yes
short preserve case = no
dos filetime resolution = yes
guest account = samba
syslog = 0

HTH

Keely

Re: SAMBA AUTHENTICATION

George_Dodds — Thu, 10 Jul 2003 13:11:22 GMT

Here's my smb.conf on my test box which works ok.

# Global parameters
[global]
security = SHARE
syslog = 0
read only = No

[homes]
comment = Home Directories
browseable = No

[tmp]
comment = Temporary file space
path = /tmp
guest ok = Yes

[PST]
path = /winshare
guest ok = Yes

Re: SAMBA AUTHENTICATION

T G Manikandan — Thu, 10 Jul 2003 13:12:14 GMT

Not sure about the security options

[global]
printing = bsd
server string = POLLOAN Server
printcap name = /etc/printcap
server string = POLLOAN Server
load printers = yes
coding system=hex
client code page = 932
workgroup=polaris_cdc
security=SERVER
encrypt passwords = no
create mask=0774
directory mask = 0775
lock directory = /usr/local/samba/var/locks
share modes = yes

#============================ Share Definitions ==============================

[home]
comment = Home File System
path = /home
valid users = root
public = no
writable = yes
printable = no
create mask = 0765

Re: SAMBA AUTHENTICATION

Darren Prior — Thu, 10 Jul 2003 13:21:10 GMT

Hi Robert,

If you wish to authenticate using the PDC of your corporate domain you will need to use either the server or domain level security setting.

Server level security means that the CIFS client will send a request to a password server (which can be your PDC) for authentication. Be aware that the user must be able to login from the CIFS client IP - some people have changed the user's Windows user's settings to improve security and found that the user cannot then authenticate.

Domain level security means that the CIFS server is a part of the domain, it will then use the PDC for authentication.

Whichever method you use, you'll need to map the Windows usernames to HP-UX names - use the username map function to do this.

There's some useful documentation on this in the O'Reilly Using Samba book. If you have CIFS/9000 installed then you can access an online version via SWAT at http://:901

regards,

Darren

Re: SAMBA AUTHENTICATION

Jim Mallett — Thu, 10 Jul 2003 13:22:17 GMT

In my environment the Windows Unix names match my Unix user names so I use "User" authorization. If they don't match they recommend using "share".

Take a look at your log.nmbd file, it may shed some light on exactly where the connection is being refused. I know when I initially set our environment up it took some trial and error and that file was very helpful.

Jim

Re: SAMBA AUTHENTICATION

Darren Prior — Thu, 10 Jul 2003 13:23:06 GMT

Hi again!

Please paste the relevant error messages regarding the passwords from your log.smb or log. to this thread.

regards,

Darren.

Re: SAMBA AUTHENTICATION

Rainer von Bongartz — Thu, 10 Jul 2003 13:33:59 GMT

security = DOMAIN
encrypt passwords = Yes
password server =

Regards
Rainer

Re: SAMBA AUTHENTICATION

Nobody's Hero — Thu, 10 Jul 2003 13:42:16 GMT

Thanks all,
Darren,

I do not get an error message when trying to map a drive. When I map, it prompts me for a password and usernam. I enter it. The box reappears to try again.

Re: SAMBA AUTHENTICATION

Darren Prior — Thu, 10 Jul 2003 15:09:52 GMT

Hi Robert,

Perhaps it may be in log.smb rather than the individual client's logs - if you have set up logging in this way. Otherwise, take a look at the Event Viewer, Security logs on both the PC and the PDC to see if any errors are visible.

regards,

Darren.