Samba configuration

[Orhan Karaman]

Hi,
We have HP-UX 11i and Samba 2.2. We would like to configure it that users authentication doing from our PDC but we don't know how is the configuration.
Thx.

[Norman_21]

Hi,

Assuming you are talking about PDC 'Primary Domain Controller', here is a document:

http://de.samba.org/samba/devel/docs/html/Samba-HOWTO-Collection.html#samba-pdc

Also, you can make a search in this forum for similar posts:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe34ab82b2d63d71190080090279cd0f9,00.html

Good luck.

[Geoff Wild]

security = SERVER
password server = yourdomaincontroller

where yourdomaincontroller is the name of your Windows domain controller...

encrypt passwords = Yes


I used to get failed passwords as well, did a search on google and found that sometimes the following helps resolve it:

keepalive = 0

"The value of the parameter (an integer) represents the number of seconds between keepalive packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.

Keepalives should, in general, not be needed if the socket being used has the SO_KEEPALIVE attribute set on it (see socket options). Basically you should only use this option if you strike difficulties.

Default: keepalive = 300"


Additionally, I would add:

preferred master = False
domain master = False



Rgds...Geoff

[Zeev Schultz]

I'd even go further and configure samba in a
Domain-member security style:
...smb.conf.....

security=domain

There is a nice paper
/opt/samba/docs/htmldocs/DOMAIN_MEMBER.html (under standard CIFS900 directories).

Why is it better?

1)If you use trusted win domains:

The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC.

2)load on NT server:

with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources.

3)I don't know what is the current status on unix-to-nt names (like you should keep mapping your local unix users to nt ones logging to Samba). I think its otherwise with 2k already but may be wrong.

4)With win2k I remember using ACLs (jfs 3.3 and higher on hp-ux) so the permissions of my
2k domain users were mapped not to usual rwxrwxrwx of hp-ux but to ACLs.

Zeev

[Orhan Karaman]

Hi,
We decided to apply Geoff's advice as a starting point. Then we set security to server, password server to our PDC(dns name) and wins server to our wins ip as well.

After creating a share on Unix machine we've tried to connect to machine from several windows clients, it's ok and we could see the list of shared directories, but when we try to get in a directory, it asks for a username/password. I don't know what I am going to enter. Plus, I don't want to enter anything,so my question is, how can I tell samba accept me for that shared directory without asking a password. ( I mean I want to be authenticated via PDC not from unix)

thnx..
your quick reply is really appreciated.

[Zeev Schultz]

And in share definitions there are entries like
this:
[share]
valid users = user1 ...

And user1 is translated to the same user on PDC? (user mapping file unix-to-pdc).

Also check under /var/opt/samba/ you
have logs - log.smbd (to see what's wrong),log. for each .

[Zeev Schultz]

One more,
security = server makes your client (pc) to send credentials (user/password) to samba server first and then verified vs password server.I mean your pc still stays non trusted in the whole picture.It just makes you not to use smbpasswd encrypted (or not) file as before.

I guess with domain level security your samba server should be a trusted domain member and it should not verify credentials for client (pc) as they belong to the same domain.Like usual m$win servers.The only thing that stays is unix-to-pdc names mapping (username map option in smb.conf).

regards,

[Geoff Wild]

or add your users to the "global"

valid users=ntuser1, ntuser2, etc

I'll post my smb.conf file later - as I'm on course right now...

Rgds...Geoff

[Geoff Wild]

Here's my smb.conf

# Samba config file created using SWAT

# Global parameters
[global]
workgroup = $MYNTDOMAIN
netbios name = MYHPSERVER
netbios aliases = SAPCI
security = SERVER
encrypt passwords = Yes
password server = MYNTBDC01, MYNTBDC02
log level = 1
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 10000
keepalive = 0
load printers = No
show add printer wizard = No
preferred master = False
domain master = False
valid users = myid, user1, smbnull, otheruser
read only = No
create mask = 0664
force create mode = 0664
directory mask = 0775
short preserve case = No
dos filetime resolution = Yes

[APPL]
comment = APPL
path = /export/APPL

[chalk]
path = /usr/sap/xfer/chalk
valid users = chalk, myid
[printers]
path = /tmp
printable = Yes
browseable = No
available = No

[Orhan Karaman]

Hi Geoff,

I've done our smb.conf setting like your's:

# Global parameters
[global]
workgroup = (our NT domain name)
netbios name = (our HP server hostname)
server string = s1file
security = SERVER
encrypt passwords = Yes
password server = (our PDC name)
log level = 1
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
keepalive = 0
preferred master = False
local master = No
domain master = False
wins server = (our wins ip)
valid users = o_karaman
read only = No
short preserve case = No
dos filetime resolution = Yes

[deneme]
comment = Deneme
path = /tmp/orhan

but we've got this error on log file (/var/opt/samba/log.o_karaman):

[2003/09/05 13:14:14, 0] smbd/password.c:(872)
authorise_login: rejected invalid user smbnull

Note: o_karaman is my machine name

Any suggestion?

[Geoff Wild]

You could try adding smbnull as a valid user.

The other thing is, can you from a Windows box, try:

Start, Run, \\yourhpservername

And if that doesn't work, can you see you HP Server in the Windows Network Neighbourhood?

Is your PDC or WINS server on the same subnet as your HP Server?

Are you running CIFS/9000 or did you compile your own Samba?

I use this:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=CIFSTP22

Based on Samba 2.2.8a

Rgds...Geoff

[Geoff Wild]

Oh - just realized that you stated o_karaman is your machine name - you have to change that to your NT User ID instead.

Rgds...Geoff

[John Kittel]

I don't know whether you're still having difficulty, and whether this will help...

I've got domain authentication working ( for both linux and hpux samba servers).

For me one of the big tricks was in getting the samba server to be a member server in the domain. First, create a machine account on the domain for the new samba server. Second, issue the smbpasswd command from the samba server with the -j switch to specify the domain to join as a member server. (also, the -r switch of course to specify name of PDC). And, on the linux server I was able to use -U to specify a domain administrator account and password, but on the HPUX server I vaguely recall it didn't like that bit and I had to leave out the -U switch and it prompted me to enter an account name and password. Also, it seemed that even though I got a succesful completion of the smbpasswd command, on either the linux or hp server domain authentication still didn't work until I finally removed the samba server from the domain, and rejoined it. Perhaps the key might have been making sure samba was shut down while I was doing the join? Anyway, smbpasswd command like this:

#smbpasswd -j domain_name -r pdc_name -U acct%passwd

or this:

#smbpasswd -j domain_name -r pdc_name

Another tricky thing was the announce version parameter in smb.conf, had to be (for me) 4.2

And there are several key parameters that MUST be right in smb.conf. here's the smb.conf from my hpux server:

# Samba config file created using SWAT

# Global parameters
[global]
workgroup = KACCTWD
netbios name = DEV
server string = Development System
security = DOMAIN
encrypt passwords = Yes
password server = PDCA, BDCA
username map =
log level = 3
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
announce version = 4.2
unix extensions = No
socket options = SO_RCVBUF=8192 SO_SNDBUF=8192
load printers = No
groupname map =
os level = 0
preferred master = False
local master = No
domain master = False
dns proxy = No
guest account = nobody
read only = No
short preserve case = No
dos filetime resolution = Yes

[homes]
comment = Home Directories
valid users = kittel
browseable = No

[qa57]
comment = qa57
path = /u01/qa57
valid users = kittel
create mask = 0775
force create mode = 0775
security mask = 00
directory security mask = 00

[Orhan Karaman]

hello,
here is our smb.conf file.

[global]
workgroup = NTD_EBI
netbios name = S1FILE
server string = s1file
security = DOMAIN
encrypt passwords = Yes
password server = istebidc01
username map =
log level = 3
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
announce version = 4.2
unix extensions = No
socket options = SO_RCVBUF=8192 SO_SNDBUF=8192
load printers = No
groupname map =
os level = 0
preferred master = False
local master = No
domain master = False
dns proxy = No
guest account = nobody
read only = No
short preserve case = No
dos filetime resolution = Yes

[deneme]
comment = Deneme
path = /tmp/orhan
valid users = o_karaman
browseable = No

I'm trying to connect from my pc (computer name o_karaman) with my user_id o_karaman. Following are a few lines from log file generated for my attempt.

[2003/09/08 10:26:28, 0] smbd/password.c:(1335)
connect_to_domain_password_server: unable to setup the PDC credentials to machine ISTEBIDC01. Error was : NT_STATUS_OK.
[2003/09/08 10:26:28, 0] smbd/password.c:(1554)
domain_client_validate: Domain password server not available.

[Geoff Wild]

Sounds like your HP-UX box hasn't been added to yourdomain....

Try setting security=server instead.

Rgds...Geoff

[John Kittel]

I tried this post once already and then didn't see it show up, so I'm trying it again. Sorry if it ends up duplicated...

I agree it sounds as though the samba server has not sucessfully joined the domain as a member server. I don't however think you need to set security=server. I've got it working with security=domain and it sounds like that's what you're trying to accomplish.

As I suggested before, have you first created a machine account for the samba server? and second used the smbpasswd -j command to join the domain as a member server?

If you believe you have, it still wouldn't hurt to try re-doing it. In that case shut down samba. Remove the machine account. Recreate it. At this point I'm not sure if samba should be running or not; you could try it both ways. Run command(s) something like:

#smbpasswd -j NTD_EBI -r istebidc01 -U acct%passwd

or just

#smbpasswd -j NTD_EBI -r istebidc01

For the -U variant, acct%passwd should be a domain admin acct and password.

This must succeed for domain authentication to work.

- John

[Wouter Jagers]

We've been running various versions of samba on HPUX over the years, and the domain authentication works great.

These two lines in your smb.conf are important for that:

security = domain
password server = [one of your domain controllers]

You do have to create a machine account for the server in your domain. What I usually do is first open my 'Server Manager' in Windows, add the machine in the domain (if it's there, remove and add again) and then issue the already decsribed command on the Unix box:

smbpasswd -j [your-domain-name] -r [name-of-primary-domain-controller]

After that, domain authentication should work like a breeze. You might run into issues on old Win9x clients because of the 'password encryption'.

Should you be forced to disable password encryption to allow win95's to access the server, you will have to configure the newer (win2k, winXP) clients' security policies to not use encrypted passwords.

regards
Wout

[Geoff Wild]

I don't think you need SECURITY=DOMAIN unless you want the box to act like a PDC...

I run all my samba's as SECURITY=SERVER without any authentication issues.

Here's some info fron the docs:

SECURITY = SERVER

In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box. If this fails it will revert to security = user, but note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid smbpasswd file to check users against. See the documentation file in the docs/ directory ENCRYPTION.txt for details on how to set this up.

Note that from the client's point of view security = server is the same as security = user. It only affects how the server deals with the authentication, it does not in any way affect what the client sees.



SECURITY = DOMAIN

This mode will only work correctly if smbpasswd(8) has been used to add this machine into a Windows NT Domain. It expects the encrypted passwords parameter to be set to true. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.

Note that a valid UNIX user must still exist as well as the account on the Domain Controller to allow Samba to have a valid UNIX account to map file access to.

Note that from the client's point of view security = domain is the same as security = user . It only affects how the server deals with the authentication, it does not in any way affect what the client sees.

Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the guest account. See the map to guest parameter for details on doing this.

BUG: There is currently a bug in the implementation of security = domain with respect to multi-byte character set usernames. The communication with a Domain Controller must be done in UNICODE and Samba currently does not widen multi-byte user names to UNICODE correctly, thus a multi-byte username will not be recognized correctly at the Domain Controller. This issue will be addressed in a future release.

[Orhan Karaman]

Hi gurus,
Thanks all who responded.
We've decided to install CIFS/9000 Server and Client as HP support recommended. Run setup and joined HP box into our domain(NTD_EBI) as a member server.
Following lines are from our log file generated for DOMAIN user o_karaman. There is no Unix or Samba user defined as o_karaman it only exists in Domain User Database. What i see from these lines that samba talks Wins Server to resolve PDC's ip after that connects to PDC to authenticate user but it can't authenticate as the error indicates so it switchs to guest account.

[2003/09/09 08:38:58, 3] libsmb/namequery.c:(694)
resolve_wins: Attempting wins lookup for name ISTEBIDC01<0x20>
[2003/09/09 08:38:58, 3] libsmb/namequery.c:(712)
resolve_wins: WINS server ==
[2003/09/09 08:38:58, 3] lib/util_sock.c:(798)
bind succeeded on port 0
[2003/09/09 08:38:58, 2] libsmb/namequery.c:(420)
Got a positive name query response from xx.xx.xx.xx ( yy.yy.yy.yy )
[2003/09/09 08:38:58, 3] lib/util_sock.c:(830)
Connecting to yy.yy.yy.yy at port 445
[2003/09/09 08:38:58, 3] smbd/server.c:(492)
Server exit (normal exit)
[2003/09/09 08:38:59, 3] smbd/reply.c:(1032)
No such user o_karaman [NTD_EBI] - using guest account
[2003/09/09 08:38:59, 1] smbd/reply.c:(1066)
Username nobody is invalid on this system
[2003/09/09 08:38:59, 3] smbd/error.c:(99)
error packet at smbd/reply.c(1068) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE

xx.xx.xx.xx = Wins IP
yy.yy.yy.yy = PDC IP

So in order to have this domain user to be authenticated trough PDC what needs to be done exactly?
Thanks in advance.

[Orhan Karaman]

Hi gurus,
Thanks all who responded.
We've decided to install CIFS/9000 Server and Client as HP support recommended. Run setup and joined HP box into our domain(NTD_EBI) as a member server.
Following lines are from our log file generated for DOMAIN user o_karaman. There is no Unix or Samba user defined as o_karaman it only exists in Domain User Database. What i see from these lines that samba talks Wins Server to resolve PDC's ip after that connects to PDC to authenticate user but it can't authenticate as the error indicates so it switchs to guest account.

[2003/09/09 08:38:58, 3] libsmb/namequery.c:(694)
resolve_wins: Attempting wins lookup for name ISTEBIDC01<0x20>
[2003/09/09 08:38:58, 3] libsmb/namequery.c:(712)
resolve_wins: WINS server ==
[2003/09/09 08:38:58, 3] lib/util_sock.c:(798)
bind succeeded on port 0
[2003/09/09 08:38:58, 2] libsmb/namequery.c:(420)
Got a positive name query response from xx.xx.xx.xx ( yy.yy.yy.yy )
[2003/09/09 08:38:58, 3] lib/util_sock.c:(830)
Connecting to yy.yy.yy.yy at port 445
[2003/09/09 08:38:58, 3] smbd/server.c:(492)
Server exit (normal exit)
[2003/09/09 08:38:59, 3] smbd/reply.c:(1032)
No such user o_karaman [NTD_EBI] - using guest account
[2003/09/09 08:38:59, 1] smbd/reply.c:(1066)
Username nobody is invalid on this system
[2003/09/09 08:38:59, 3] smbd/error.c:(99)
error packet at smbd/reply.c(1068) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE

xx.xx.xx.xx = Wins IP
yy.yy.yy.yy = PDC IP

So in order to have this domain user to be authenticated trough PDC what needs to be done exactly?
Thanks in advance.

[Wouter Jagers]

I think you will need the accounts to be created on your HPUX anyway. The domain knows who you are, but there is no corresponding account on the HPUX, so samba doesn't.

Share-permissions are (as in Windows) a combination of filesystem and share permissions, so the users need to be known to the Unix box.

The only way I know about to work around this all is using samba with 'winbind'. It's just, we haven't been able to make that work on HP..
(should anyone have, let me know :-)

The user accounts don't need shells or passwords, though, so it shouldn't be that much work. You could make a list of your domain users and run a little script which creates the users without logon-capabilities in /etc/passwd:

[username]:*:[uid]:100::/home/[username]:/dev/null

regards
Wout

[Stuart Urquhart]

Orhan,

The steps are :-

Add a machine account in the NT domain with the same name as your HP-UX box hostname.

Set security=domain in your smb.conf, and set the workgroup="NT domain name"

Join Samba to the domain :-

smbpasswd -j

Add Unix accounts with the same name as the NT user accounts.
Add samba accounts for these NT accounts (smbpasswd -a username)

If you set guest account in the smb.conf to a valid Unix user you'll be able to get rid of those "Username nobody is invalid on this system " messages - Samba doesn't seem to like negative UIDs like nobody.

I think the "No such user o_karaman " message you're seeing is because you're loggged into NT as o_karaman, but there's either not a Unix account o_karaman, or not a Samba account o_karaman . Since o_karaman is longer than eight characters, you're probably going to have to change your NT user id to something conforming to Unix's eight character limit.

Stuart

[Geoff Wild]

If you have a generic account on the HPUX box, then instead of creating an Unix account for each of your users, you can use a username.map file:

gwild = gwild
dmadmin = dmadmin, dm_doclink_sap, sapservicebw1

That will get around the 8 character user name limit as well as needing an Unix account for every Samba user.

username map (G)
This option allows you to specify a file containing a mapping of usernames from the clients to the server. This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows machines to those that the UNIX box uses. The other is to map multiple users to a single username so that they can more easily share files

[Zeev Schultz]

Hi
1)
As to username mapping this is really one of
last annoyances even if you use security=domain.However , there is a nice utility called winbind that takes care of all.
Here: http://us1.samba.org/samba/docs/man/winbind.html
2)use comming with CIFS/9000 documentations -
/opt/samba/docs/htmldocs it explains all.
3)breake your record and give away points to guys who invested here 2cents ++

good luck

[Orhan Karaman]

Hi gurus,
Finally it's working...
Here is what we did:
-we have uninstalled Samba 2.2.8 and CIFS/9000 server comes with HP box.
-we have installed Samba 2.2.8a version with compiled winbind from http://fi.samba.org/samba/ftp/Binary_Packages/hp/samba-2.2.8a/samba_2.2.8a_HPUX_withwinbind.depot.gz
-we have configured smb and winbind as explained in the link http://us1.samba.org/samba/docs/man/winbind.html
-we didn't configure pam.d (or pam.conf) because default version is enough for us.

Anyway after properly following the steps in the document, it's now working as we wish(with domain authentication).
Thanks to all of you.
Ciao