SAMBA AUTHENTICATION

[Nobody's Hero]

I am real confused with my samba settings.
I am running samba on the UNIX side. When I try to map a network drive on my win2k box I get prompted for a password, but it wont let me mount.

I am curious what settings people are using.
I am trying to authenticate at the Domain level.

My questions relate to specific fields in the samba config. like

''security options''

should this be
share
domain
user
or server.

I want to authenticate through our corporate domain.

Do I still need to create user mappings if I want to go this way?

[Nobody's Hero]

would it be posible for someone to show me the samba config file they are using?

[Keely Jackson]

Hi Robert

Here are the global settings from our Samba config file.

[global]

# workgroup = NT-Domain-Name or Workgroup-Name, eg: REDHAT4
workgroup = MOP_EFOS
# server string is the equivalent of the NT Description field
server string = MOP, EFOS, Mierva and Billing Samba Servers

# this tells Samba to use a separate log file for each machine
# that connects
log file = /var/opt/samba/log.%m

# Put a capping on the size of the log files (in Kb).
max log size = 50

# Security mode. Most people will want user level security. See
# security_level.txt for details.
security = server
# Use password server option only with security = server or domain
password server = OOOOO

# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
encrypt passwords = yes

# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
socket options = TCP_NODELAY

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
local master = no

read only = no
preserve case = yes
short preserve case = no
dos filetime resolution = yes
guest account = samba
syslog = 0


HTH

Keely

[George_Dodds]

Here's my smb.conf on my test box which works ok.

# Global parameters
[global]
security = SHARE
syslog = 0
read only = No

[homes]
comment = Home Directories
browseable = No

[tmp]
comment = Temporary file space
path = /tmp
guest ok = Yes

[PST]
path = /winshare
guest ok = Yes

[T G Manikandan]

Not sure about the security options

[global]
printing = bsd
server string = POLLOAN Server
printcap name = /etc/printcap
server string = POLLOAN Server
load printers = yes
coding system=hex
client code page = 932
workgroup=polaris_cdc
security=SERVER
encrypt passwords = no
create mask=0774
directory mask = 0775
lock directory = /usr/local/samba/var/locks
share modes = yes

#============================ Share Definitions ==============================

[home]
comment = Home File System
path = /home
valid users = root
public = no
writable = yes
printable = no
create mask = 0765

[Darren Prior · Accepted solution]

Hi Robert,

If you wish to authenticate using the PDC of your corporate domain you will need to use either the server or domain level security setting.

Server level security means that the CIFS client will send a request to a password server (which can be your PDC) for authentication. Be aware that the user must be able to login from the CIFS client IP - some people have changed the user's Windows user's settings to improve security and found that the user cannot then authenticate.

Domain level security means that the CIFS server is a part of the domain, it will then use the PDC for authentication.

Whichever method you use, you'll need to map the Windows usernames to HP-UX names - use the username map function to do this.

There's some useful documentation on this in the O'Reilly Using Samba book. If you have CIFS/9000 installed then you can access an online version via SWAT at http://:901

regards,

Darren

[Jim Mallett]

In my environment the Windows Unix names match my Unix user names so I use "User" authorization. If they don't match they recommend using "share".

Take a look at your log.nmbd file, it may shed some light on exactly where the connection is being refused. I know when I initially set our environment up it took some trial and error and that file was very helpful.

Jim

[Darren Prior]

Hi again!

Please paste the relevant error messages regarding the passwords from your log.smb or log. to this thread.

regards,

Darren.

[Rainer von Bongartz]

security = DOMAIN
encrypt passwords = Yes
password server =


Regards
Rainer

[Nobody's Hero]

Thanks all,
Darren,

I do not get an error message when trying to map a drive. When I map, it prompts me for a password and usernam. I enter it. The box reappears to try again.

[Darren Prior]

Hi Robert,

Perhaps it may be in log.smb rather than the individual client's logs - if you have set up logging in this way. Otherwise, take a look at the Event Viewer, Security logs on both the PC and the PDC to see if any errors are visible.

regards,

Darren.