Quantcast
Channel: Multimediaforum
Viewing all articles
Browse latest Browse all 4603
↧

User Authentifizierung mittels winbind/samba (Microsoft Active Directory)

September 11, 2013, 11:53 pm
$
0
0
Hallo liebe Community,
ich stehe zur Zeit vor dem Problem, dass ich einem AD (Active Directory) User Zugriff auf eine GNU/Linux Maschine gewähren muss.
Dafür habe ich samba/winbind ausgewählt.
Der Domain Join mittels net ads join hat einwandfrei funktioniert.
Auch wbinfo liefert seine Daten zurück:
shell Konsole
root@host:~# wbinfo -u administrator guest
Wenn ich jedoch den User abfragen oder mich anmelden möchte funktionierts nicht:
shell Konsole
root@host:~# id -a administrator id: administrator: no such user root@host:~# su - administrator Unknown id: administrator
Hingegen ein kinit funktioniert wieder:
shell Konsole
root@host:~# kinit administrator Password for administrator@DC.COM: root@host:~# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: administrator@DC.COM Valid starting Expires Service principal 09/12/13 12:57:31 09/12/13 13:28:39 krbtgt/DC.COM@DC.COM
Ich verwende folgende Software Versionen:
krb5: 1.11
samba: 3.5.22

Hat jemand von euch eine Ahnung wie ich die Authentifizierung zum laufen bringe?
Bin für jeden Hinweis dankbar!

Anbei noch die Konfigurationsdateien.

Die /etc/krb5.conf sieht wie folgt aus:
Code:
[libdefaults]
        ticket_lifetime = 24000
        default_realm = DC.COM
        dns_lookup_realm = yes
        dns_lookup_kdc = yes

[realms]
        DC.COM = {
                admin_server = WIN-EVS2RSS33NC.DC.COM
                default_domain = DC.COM
        }

[logging]
#      kdc = CONSOLE
Die /etc/samba/smb.conf:
Code:
[Global]
  netbios name = host
  workgroup = DC
  realm = DC.COM
  server string = %h
  security = ads
  encrypt passwords = yes
  password server = WIN-EVS2RSS33NC.DC.COM

  idmap config * : backend = tdb
  idmap config * : range = 10000-20000

  winbind use default domain = Yes
  winbind enum users = Yes
  winbind enum groups = Yes
  winbind nested groups = Yes
  winbind separator = +
  winbind refresh tickets = yes

  template shell = /bin/bash
  template homedir = /home/%D/%U
 
  preferred master = no
  dns proxy = no
  wins server = WIN-EVS2RSS33NC.DC.COM
  wins proxy = no

  inherit acls = Yes
  map acl inherit = Yes
  acl group control = yes

  load printers = no
  debug level = 3
  use sendfile = no

Zu guter letzt noch die /etc/nsswitch.conf:
Code:
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:        compat winbind
group:          compat winbind
shadow:        compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:      files

protocols:      db files
services:      db files
ethers:        db files
rpc:            db files

netgroup:      nis
NACHTRAG:
Hier noch der log Auszug nachdem ich su - administrator versucht habe.
Code:
[2013/09/12 07:00:56.676964,  4] winbindd/winbindd_dual.c:1529(fork_domain_child)
  child daemon request 63
[2013/09/12 07:00:56.677225,  3] winbindd/winbindd_rpc.c:305(msrpc_name_to_sid)
  rpc: name_to_sid name=DC\ADMINISTRATOR
[2013/09/12 07:00:56.677359,  3] winbindd/winbindd_rpc.c:319(msrpc_name_to_sid)
  name_to_sid [rpc] DC\ADMINISTRATOR for domain DC
[2013/09/12 07:00:56.677540,  5] rpc_parse/parse_prs.c:89(prs_debug)
  000000 smb_io_rpc_hdr hdr   
      0000 major    : 05
      0001 minor    : 00
      0002 pkt_type  : 00
      0003 flags    : 03
      0004 pack_type0: 10
      0005 pack_type1: 00
      0006 pack_type2: 00
      0007 pack_type3: 00
      0008 frag_len  : 0098
      000a auth_len  : 0020
      000c call_id  : 00000013
[2013/09/12 07:00:56.678217,  5] rpc_parse/parse_prs.c:89(prs_debug)
  000010 smb_io_rpc_hdr_req hdr_req
      0010 alloc_hint: 00000058
      0014 context_id: 0000
      0016 opnum    : 004d
[2013/09/12 07:00:56.678512,  5] rpc_parse/parse_prs.c:89(prs_debug)
  000070 smb_io_rpc_hdr_auth hdr_auth
      0070 auth_type    : 44
      0071 auth_level  : 06
      0072 auth_pad_len : 00
      0073 auth_reserved: 00
      0074 auth_context_id: 00000001
[2013/09/12 07:00:56.678976,  5] rpc_client/cli_pipe.c:1372(rpc_api_pipe_send)
  rpc_api_pipe: host WIN-EVS2RSS33NC.dc.com
[2013/09/12 07:00:56.679128,  5] rpc_client/cli_pipe.c:392(rpc_write_send)
  rpc_write_send: data_to_write: 152
[2013/09/12 07:00:56.680698,  5] rpc_parse/parse_prs.c:89(prs_debug)
  000000 smb_io_rpc_hdr rpc_hdr 
      0000 major    : 05
      0001 minor    : 00
      0002 pkt_type  : 02
      0003 flags    : 03
      0004 pack_type0: 10
      0005 pack_type1: 00
      0006 pack_type2: 00
      0007 pack_type3: 00
      0008 frag_len  : 00e8
      000a auth_len  : 0038
      000c call_id  : 00000013
[2013/09/12 07:00:56.681394,  5] rpc_client/cli_pipe.c:274(rpc_grow_buffer)
  rpc_grow_buffer: grew buffer by 216 bytes to 232
[2013/09/12 07:00:56.681545,  5] rpc_client/cli_pipe.c:312(rpc_read_send)
  rpc_read_send: data_to_read: 216
[2013/09/12 07:00:56.681769,  5] rpc_parse/parse_prs.c:89(prs_debug)
  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
      0010 alloc_hint: 00000090
      0014 context_id: 0000
      0016 cancel_ct : 00
      0017 reserved  : 00
[2013/09/12 07:00:56.682111,  5] rpc_parse/parse_prs.c:89(prs_debug)
  0000a8 smb_io_rpc_hdr_auth hdr_auth
      00a8 auth_type    : 44
      00a9 auth_level  : 06
      00aa auth_pad_len : 00
      00ab auth_reserved: 00
      00ac auth_context_id: 00000001
[2013/09/12 07:00:56.682892,  4] winbindd/winbindd_dual.c:1537(fork_domain_child)
  Finished processing child request 63
[2013/09/12 07:00:56.684509,  4] winbindd/winbindd_dual.c:1529(fork_domain_child)
  child daemon request 63
[2013/09/12 07:00:56.685961,  3] winbindd/winbindd_ads.c:476(query_user)
  ads: query_user
[2013/09/12 07:00:56.686218,  7] winbindd/winbindd_ads.c:59(ads_cached_connection)
  Current tickets expire in 58070 seconds (at 1379027326, time is now 1378969256)
[2013/09/12 07:00:56.688253,  5] libads/ldap_utils.c:64(ads_do_search_retry_internal)
  Search for (objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\D4\D6\4B\3F\F8\EA\4E\F6\8E\BB\67\41\57\04\00\00) in <dc=DC,dc=COM> gave 1 replies
[2013/09/12 07:00:56.689312,  5] winbindd/nss_info.c:79(smb_register_idmap_nss)
  smb_register_idmap_nss: Successfully added idmap nss backend 'template'
[2013/09/12 07:00:56.689631,  3] winbindd/winbindd_ads.c:584(query_user)
  ads query_user gave administrator
[2013/09/12 07:00:56.689982,  4] winbindd/winbindd_dual.c:1537(fork_domain_child)
  Finished processing child request 63
[2013/09/12 07:00:56.691195,  4] winbindd/winbindd_dual.c:1529(fork_domain_child)
  child daemon request 63
[2013/09/12 07:00:56.691461,  4] winbindd/winbindd_dual.c:1537(fork_domain_child)
  Finished processing child request 63
Es sieht also meiner Meinung nach so aus als ob die nsswitch greifen würde, aber winbind keinen validen User zurück gibt.
Kann das sein? Oder hat jemand eine andere Vermutung (oder bestenfalls sogar eine Lösung :-) ) ?

Danke!
↧
Search
Viewing all articles
Browse latest Browse all 4603
Search