sftp chroot + winbind + ad Post: 302727909

Sponsored Content

Operating Systems AIX sftp chroot + winbind + ad Post 302727909 by jess_t03 on Wednesday 7th of November 2012 04:37:36 AM

11-07-2012

Registered User

AIX + sftp + winbind

Hello friends.

I have a task to set up AIX integration with Active Directory with SAMBA.
Users should login on SFTP with own AD accounts and download/upload something to own home directories. I've already setup authentification AIX with WINBIND and I can see AD-users, groups, and even can login to the server via SSH with AD account. But I have no idea why I can't do the same with SFTP. Local users (type: compat) login successfull, but AD users don't. Exactly SFTP, because SSH connection on 22 port works perfect for AD accounts. Maybe I need edit PAM config ?

- AIX 5.3 (5300-11-03-1013)
- pWare.SAMBA 3.5.8.1
- OpenSSH 5.2.0
- OpenSSL 0.9.8

Code:

[root@wb53tst /]$ cat /opt/pware/lib/smb.conf
[global]
        workgroup = TST
        netbios name = wb53tst
        security = ads
        passdb backend = tdbsam
        realm = TST.COM
        password server = dc1.tst.com
        load printers = yes
        cups options = raw

winbind uid = 10000-65534
winbind gid = 10000-65534
winbind use default domain = yes
winbind separator = +

winbind enum users = yes
winbind enum groups = yes
winbind cache time = 60
winbind uid = 10000-65534
winbind gid = 10000-65534
winbind use default domain = yes
winbind separator = +

template homedir = /home/FILEBASE/TST/%U
template shell = /bin/bash
winbind offline logon = no

[homes]
        comment = Home Directories
        browseable = no
        writable = yes

Code:

[root@wb53tst /]$ cat /etc/ssh/sshd_config | egrep -v "(^#.*|^$)"
Protocol 2
SyslogFacility AUTHPRIV
PermitRootLogin no
PasswordAuthentication yes
ChallengeResponseAuthentication yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
UseLogin yes
PermitUserEnvironment yes
PidFile /var/run/sshd.pid
Subsystem       sftp    /usr/sbin/sftp-server

---------- Post updated at 01:37 AM ---------- Previous update was at 01:30 AM ----------

And I want to add few words.
It's just task. I know that SAMBA, WINBIND, PAM is not perfect solution. Sure Kerberos + LDAP will be more better and easy. But I need done this test only with that.

Moderator's Comments:

edit by bakunin: you do not need to open two threads for one problem - one is perfectly fine. Threads merged.

Last edited by bakunin; 11-07-2012 at 07:24 AM..

jess_t03

View Public Profile for jess_t03

Find all posts by jess_t03

10 More Discussions You Might Find Interesting

1. Linux

Auto create local account with winbind.

Hi, I have a set up a linux box connected to windows active directory using winbind. Everything is up and running fine. Now i wish to auto create a local account whenever a new user logs in. I have tried every possible way using the smb.conf to no avail. Any help would be appreciated.

2. Solaris

SSH & SFTP Chroot

Hello all, does anybody knows a procedure to enable an chroot for users using ssh and sftp ? Thanks

3. Shell Programming and Scripting

Specifying a tcsh shell using winbind

The campus system that I use has switched to using winbind. In the old days, I was able to specify tcsh as my shell with the usual entry in /etc/passwd. But I'm told winbind doesn't have user specific entries, and now my ssh login defaults to a bash shell. Can anybody advise how I can...

4. Red Hat

chroot sftp, samba share, ownership issue linux hosts

Hello, I have sftp server with chroot for a group and username is on a Linux host, I have created a few subdirectories under sftpuser home directories with 775. Then using a Samba I shared this user home directory to another linux client. On the Linux client, I have jboss user to access...

5. Red Hat

sftp jail chroot env setup

Hi I need a specific user to be able to sftp to a server and get files from a specific location. The location is not the users home dir, i don't want the user to be able to view anything else apart from the files in that area. e.g ftp file are is - /logging/phplogs e.g user home is...

6. Red Hat

Chroot sftp users, remote sftp login shows wrong timestamp on files

Hello, I have a weird issue, I have RHEL 5.7 running with openssh5.2 where sftpgroup OS group is chroot. I see the difference difference in timestamp on files, when I login via ssh and SFTP, I see four hour difference, is something missing in my configuration. #pwd...

7. UNIX for Advanced & Expert Users

Cannot login using WINBIND in AIX 5.3

I configured AIX5.3 to use kerberos and winbind so user can login and authenticate via AD. I was able to join my AIX server to domain and can execute wbinfo -u/g. However when I login, It says unknown user. I already edit /etc/secuirty/user and then method.cfg. On the log.winbindd it says ...

8. AIX

AIX 7.1 integrate AD with winbind

I have joined an AIX 7.1 into a 2012 AD domain sucesfully. I can get ouput from wbinfo -u but when I try to access a share I get the following error : check_ntlm_password: Authentication for user -> FAILED with error NT_STATUS_NO_SUCH_USER I have found that I'm missing...

9. UNIX and Linux Applications

WINBIND module missing in AIX 7.1

I have installed following packages from perzl samba-winbind-clients-3.6.22-1 samba-client-3.6.22-1 samba-domainjoin-gui-3.6.22-1 samba-winbind-devel-3.6.22-1 samba-3.6.22-1 samba-common-3.6.22-1 samba-winbind-krb5-locator-3.6.22-1 samba-doc-3.6.22-1 samba-swat-3.6.22-1...

10. AIX

Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)

Hi all, I have installed samba 3.6.22 on AIX 7.1 and join a windows AD with success. All seem to work fine, I have configured smb.conf, methods.cfg, kerberos, user .... the following command work fine wbinfo -u, wbinfo -g, wbinfo -i, wbinfo -s, wbinfo -S, lsuser, id... The unique...