topic Re: authentification problem on Samba3 in Operating System - HP-UX

authentification problem on Samba3

Oleg Mercader-Kashin — Wed, 01 Feb 2006 09:05:08 GMT

I've just "cloned" my working samba2 server on my new Tru64 machine's samba3. I use the same smb.conf changing only a netbios name:

# Global parameters
[global]
workgroup = SC1
netbios name = SGIIC3
security = SERVER
encrypt passwords = Yes
update encrypted = Yes
password server = NTIMP1

My MS admin registered the new netbios name sgiic3.
Well, now I see a SGIIC3 server but any connection is rejected. The output of a debug level = 3 is in attachement.

Any idea :-)?

Re: authentification problem on Samba3

Zinky — Wed, 01 Feb 2006 09:35:07 GMT

How are you connecting to your Samba 3 server? On your windows client - do you login with a user-id that matches you ruser-id on your UNIX server hosting samba?

Do you use user maps?

I suppose your Samba2 server is not a domain member right? Can you post "testparm" output from both your Samba2 and your Samba3 configs?

Re: authentification problem on Samba3

Steven E. Protter — Wed, 01 Feb 2006 09:43:22 GMT

Shalom,

Check the samba log file mentioned in smb.conf

It may have errors.

You may need to run the net join command again.

The trust relationship with the domain may need to be reset on the PDC.

SEP

Re: authentification problem on Samba3

Geoff Wild — Wed, 01 Feb 2006 09:46:51 GMT

You need to re-join the domain from the new server...

Get the MS Admin to remove the host from server manager....

I would use SECURITY=DOMAIN or ADS not SERVER with samba 3....

You may also need winbind running as well...

I have some good info and pointers to docs in this thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=949365

Rgds...Geoff

Re: authentification problem on Samba3

Zinky — Wed, 01 Feb 2006 09:50:15 GMT

Peace SEP.

His config is not a Windows Domain member but SERVER security but uses a password server for authentication (NTIMP1)

Oleg:

I am not sure if such scheme is still supported in SAMBA3 -- SECURITY=SERVER and a PASSWORD SERVER. However can you check if NTIMP1 is accessible on your SAMBA3 machine? Also - from your logs -- what does 172.16.241.43 correspond to? Also, is NTIMP1 an NT 4.0 PDC or BDC?

I used to have several servers configured as yours (with a password server - usually a BDC). I never attempted to maintain the same config but instead am using SECURITY=DOMAIN.

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Wed, 01 Feb 2006 10:55:07 GMT

The output of a findsmb:
...
172.16.241.43 NTIMP1 [SC1][Windows NT 4.0][NT LAN Manager 4.0]
Yes, I did "net join" but really I don't understand what a user name I have to use. In samba I didn't define any :-( or simple:
net rpc join -U administrator
??
a testparm is in attachment.
Well, I'll go to change to security = DOMAIN.

Re: authentification problem on Samba3

Zinky — Wed, 01 Feb 2006 11:07:27 GMT

Hmm.. I never thought security=Server plus a password server configuration is considered a Domain Member under testparm.. It is supposd to be a pass thru authentication scheme.

Anyways, to add your Samba3 config to your domain. Have your Windows Admin add the samba service to your domain which is basically creating a "machine account" on the domain PDC. If you're running Windows 2000/2003 .. then the Windows Admin will need to use Server Manager or the WIzard and create the machine account. Make sure "Allow Pre-Windows 2000 Computers to use this account" is enabled to the machine account.

Once that is done, edit your smb.conf so its security=domain. Restart it and simply do:

net rpc join

or if that does not work.

net rpc oldjoin

HTH.

Re: authentification problem on Samba3

Gavin Clarke — Wed, 01 Feb 2006 11:08:40 GMT

Hi Oleg,

With net join you are asking to join the Windows/NT domain.

You will need a username and password of a Windows/NT user that has permission to join the domain.

Cheers.

Re: authentification problem on Samba3

Zinky — Wed, 01 Feb 2006 11:11:42 GMT

BTW.. using the method I described - you will not need to drag the WIndows Admin to your UNIX Samba machine and ask him to type in the Admin password..

Re: authentification problem on Samba3

Gavin Clarke — Wed, 01 Feb 2006 11:16:16 GMT

Oleg,

Use Nelson's method or look at Geoff Wild's post.

I was just answering a little question not giving you the best solution overall.

Cheers.

Anyway dragging Windows admins around is fun.

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Wed, 01 Feb 2006 11:20:18 GMT

Hmm.. in other words I have to
1. reset machine name in a MS DOMAIN;
2. put in a smb.conf only the following (?):

[global]
workgroup = SC1
netbios name = SGIIC3
security = DOMAIN
encrypt passwords = Yes
update encrypted = Yes

3. restart samba
4. net rcp join

??

Re: authentification problem on Samba3

Geoff Wild — Wed, 01 Feb 2006 11:32:29 GMT

encrypt passwords = Yes is the default

If you really want update encrypted = Yes, then in order for this parameter to work correctly the encrypt passwords parameter must be set to no .

You do not want that....

Rgds...Geoff

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Wed, 01 Feb 2006 12:10:10 GMT

Do I have to remove a private/secrets.tdb before restart?

Re: authentification problem on Samba3

Zinky — Wed, 01 Feb 2006 13:23:01 GMT

I think there should be no need. Or if you bliew it away .. a new one will simply be created..

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Thu, 02 Feb 2006 11:44:38 GMT

Sorry but doesn't work.
./net rpc oldjoin was OK but like before I see the smba server but if I want connect to I get the popup window asks me user/pw, etc. Seems like samba can't identify:

[2006/02/02 17:10:47, 0] smbd/server.c:(806)
smbd version 3.0.20b started.
Copyright Andrew Tridgell and the Samba Team 1992-2005
[2006/02/02 17:10:47, 1] smbd/files.c:(207)
file_init: Information only: requested 10000 open files, 4076 are available.
[2006/02/02 17:15:13, 0] auth/auth_util.c:(1173)
make_server_info_info3: pdb_init_sam failed!
[2006/02/02 17:15:13, 0] auth/auth_util.c:(1173)
make_server_info_info3: pdb_init_sam failed!
[2006/02/02 17:15:34, 0] auth/auth_util.c:(1173)
make_server_info_info3: pdb_init_sam failed!
[2006/02/02 17:15:34, 0] auth/auth_util.c:(1173)
make_server_info_info3: pdb_init_sam failed!

pls, HELP!

Re: authentification problem on Samba3

Zinky — Thu, 02 Feb 2006 11:48:20 GMT

Kongratz on your join!

Your current problem appears to be kernel related.... what's your kernel param for maximum number of open files set at? You may need to increase that...

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Thu, 02 Feb 2006 11:48:51 GMT

Well, including I try to register (after all:-() like (with the help from the client's MS admin) but:

./net rpc join
Password:
Could not connect to server SRVSC1
The account was locked out.

:-(

Re: authentification problem on Samba3

Zinky — Thu, 02 Feb 2006 11:50:55 GMT

Once you've joined the domain.. that's it.. you need not net join once more or your machine account will be locked out! You will now need to have your machine account refreshed and do a net old join once more since you're locked out.

net rpc testjoin to validate your joined to the domain.

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Thu, 02 Feb 2006 11:52:47 GMT

In a sysconfigtab I don't see any about it. How can I know a max file?

Re: authentification problem on Samba3

Oleg Mercader-Kashin — Thu, 02 Feb 2006 11:54:27 GMT

# ./net rpc testjoin
Join to 'SC1' is OK