Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication Post: 303039870

Sponsored Content

Operating Systems AIX Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication Post 303039870 by linuxsnake on Wednesday 16th of October 2019 04:02:33 PM

10-16-2019

Registered User

I have managed to install samba and kerberos and configured smb.conf, krb5.conf and methods.cfg

I ran the following commands to join the Windows Domain from AIX:

1) kinit <username> using my current Windows user name that I log on to the domain with. Initially I had some problems with time synchronisation (scew time was out). To resolve this I configured ntp daemon pointing it to the domain server and I forced a time synchronisation. After this the command worked and I generated a kerberos key.

2) net ads join -U <username> using my current Windows user name that I log on to the domain with.

Both these commands worked so I joined the Windows domain.

At this stage I ran some test commands:

wbinfo --ping-dc - This came back positive as SUCCESS

wbinfo -g - This brings back a list of all domain groups on the domain controller
wbinfo -u - This brings back a list in unix of all the windows user names on the domain controller

Samba appears to be running ok however the folder I'm trying to share on AIX is still not visible when I try and access it via Windows \\unixserver\sharename . No errors it just isn't recognised by windows as a share.

I logged on a Windows machine to see if my Unix machine can be found in Active Directory. I found it listed under computers (its a member of one group - domain users)

I have 2 questions so far:

1) When configuring Kerberos all the guides refer to winbind settings in methods.cfg

There is a reference in this config file to WINBIND and DCE file locations:

Code:

WINBIND:
        program = /usr/lib/security/WINBIND
        program_64 = /usr/lib/security/WINBIND_64
DCE:
        program = /usr/lib/security/DCE

When I check my AIX system these files do not exist. I ran a find searching the whole system. /usr/lib/security exists but WINBIND , WINBIND_64 and DCE do not exist. The latest winbind packages have already been installed via yum so I'm on the latest version for AIX 7.1

In /opt/freeware/lib/security there are 2 files pam_winbind.so and pam_smbpass.so. I believe I may need to copy these to /usr/lib/security ?
The question is why dont I have WINBIND or WINBIND_64 on my system and how do I get hold of these? I presume I need methods.cfg to use these WINBIND library files in order for my fileshare to work?
I don't need to authenticate users to login to the unix shell. I just need a group of windows users (from one AD group) to access an AIX fileshare (without a requirement to enter a password) - authenticating using active directory account.

2) Currently I have joined the domain as a regular windows user. This allows me to interrogate Active Directory and list all users and groups. I presume to get this working correctly I will need to join the domain as a Windows user with a higher level of rights (perhaps domain administrator rights?). Can anyone tell me what group the Windows user should be a member of to get file sharing working so a specific AD group of Windows users can access a shared AIX folder authenticating with their windows password (no need to enter one)? I'm guessing my regular Windows user account won't give me what we need.

I've switched logging up to 3 for samba.log to try and give me an idea of why this is failing but if anyone has got this working appreciate any suggestions.

linuxsnake

View Public Profile for linuxsnake

Find all posts by linuxsnake

9 More Discussions You Might Find Interesting

1. Linux

How to Unite Redhat 9 Linux with Windows 2003 Active Directory authentication

Dear All, How to configure a Redhat 9 client to windows 2003 server. I have windows 2003 server which act has domain controller in my office. I have been asked to use redhat 9 has client. how to configure so that redhat 9 can authenticate with windows 2003 server .I have username created in...

2. AIX

How to share a directory in AIX to access from Solaris and windows?

Hi All, I am basically new to this forum as well as AIX. To share some huge files between 2 servers I thought of creating a shared Directory in my AIX machine to access it in Solaris. I am very new to this AIX. Help me out how can u share a directory in AIX to access (mount) it on Solaris. Hope...

3. SCO

Authentication problems with Active Directory/Samba/Winbind/Pam

Hi all. I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:...

4. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs...

5. UNIX for Dummies Questions & Answers

control permissions for Active Directory users on AIX

Hello, I've configured an user authentication against Active Directory (Windows Server 2008 R2) on AIX V6 with LDAP. It works fine. And here's my problem: How can I control ldap user permissions on the local AIX machine? E.g. an AD user should be able to write all files of local sys...

6. AIX

Authenticate AIX users from MS Active Directory

First, let me start off saying this is not spam. This is me trying to help out other AIX Admins with MS AD servers. If it is not applicable to you, someone else will find it useful. As long as the "KDC" service is running on your AD server, these steps should work. There should be no...

7. Solaris

solaris samba configuration without wins service from authentication window server/Active directory

Hi All, We are using solaris samba server for our company project to provide access to code to our development team.Recently our ICT has disabled wins service on Active directory due which user are not able to connect to samba share and they are getting error "No logon server available" as samba...

8. AIX

Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)

Hi all, I have installed samba 3.6.22 on AIX 7.1 and join a windows AD with success. All seem to work fine, I have configured smb.conf, methods.cfg, kerberos, user .... the following command work fine wbinfo -u, wbinfo -g, wbinfo -i, wbinfo -s, wbinfo -S, lsuser, id... The unique...

9. AIX

AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues

Hi. Ive recently upgraded Samba on an AIX server to Samba 4. The aim is to allow a specific group of Windows AD users to access some AIX file shares (with no requirement to enter passwords) - using AD to authenticate. Currently I have: Samba 4 installed ( and 3 daemons running) Installed...

LEARN ABOUT REDHAT

wbinfo

WBINFO(1)																 WBINFO(1)

NAME

       wbinfo - Query information from winbind daemon

SYNOPSIS

       wbinfo  [  -u ]	[ -g ]	[ -h name ]  [ -i ip ]	[ -n name ]  [ -s sid ]  [ -U uid ]  [ -G gid ]  [ -S sid ]  [ -Y sid ]  [ -t ]  [ -m ]  [
       -r user ]  [ -a user%password ]	[ -A user%password ]

DESCRIPTION

       This tool is part of the  Samba suite.

       The wbinfo program queries and returns information created and used by the  winbindd(8) daemon.

       The winbindd(8) daemon must be configured and running for the wbinfo program to be able to return information.

OPTIONS

       -u     This option will list all users available in the Windows NT domain for which the winbindd(8) daemon is operating in.  Users  in  all
	      trusted  domains will also be listed. Note that this operation does not assign user ids to any users that have not already been seen
	      by winbindd(8).

       -g     This option will list all groups available in the Windows NT domain for which the winbindd(8) daemon is operating in. Groups in  all
	      trusted  domains	will  also  be listed. Note that this operation does not assign group ids to any groups that have not already been
	      seen by winbindd(8).

       -h name
	      The -h option queries winbindd(8) to query the WINS server for the IP address associated with the NetBIOS name specified by the name
	      parameter.

       -i ip  The  -i option queries winbindd(8) to send a node status request to get the NetBIOS name associated with the IP address specified by
	      the ip parameter.

       -n name
	      The -n option queries winbindd(8) for the SID associated with the name specified. Domain names can be specified before the user name
	      by  using  the winbind separator character.  For example CWDOM1/Administrator refers to the Administrator user in the domain CWDOM1.
	      If no domain is specified then the domain used is the one specified in the smb.conf workgroup parameter.

       -s sid Use -s to resolve a SID to a name. This is the inverse of the -n option above. SIDs must be specified as ASCII strings in the tradi-
	      tional Microsoft format. For example, S-1-5-21-1455342024-3071081365-2475485837-500.

       -U uid Try  to convert a UNIX user id to a Windows NT SID. If the uid specified does not refer to one within the winbind uid range then the
	      operation will fail.

       -G gid Try to convert a UNIX group id to a Windows NT SID. If the gid specified does not refer to one within the winbind gid range then the
	      operation will fail.

       -S sid Convert a SID to a UNIX user id. If the SID does not correspond to a UNIX user mapped by	winbindd(8) then the operation will fail.

       -Y sid Convert  a  SID  to  a  UNIX group id. If the SID does not correspond to a UNIX group mapped by  winbindd(8) then the operation will
	      fail.

       -t     Verify that the workstation trust account created when the Samba server is added to the Windows NT domain is working.

       -m     Produce a list of domains trusted by the Windows NT server winbindd(8) contacts when resolving names. This list does not include the
	      Windows NT domain the server is a Primary Domain Controller for.

       -r username
	      Try to obtain the list of UNIX group ids to which the user belongs. This only works for users defined on a Domain Controller.

       -a username%password
	      Attempt to authenticate a user via winbindd.  This checks both authenticaion methods and reports its results.

       -A username%password
	      Store username and password used by winbindd during session setup to a domain controller. This enables winbindd to operate in a Win-
	      dows 2000 domain with Restrict Anonymous turned on (a.k.a. Permissions compatiable with Windows 2000 servers only).

EXIT STATUS

       The wbinfo program returns 0 if the operation succeeded, or 1 if the operation failed. If the winbindd(8) daemon is not working wbinfo will
       always return failure.

VERSION

       This man page is correct for version 2.2 of the Samba suite.

SEE ALSO

       winbindd(8)

AUTHOR

       The  original  Samba  software  and  related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open
       Source project similar to the way the Linux kernel is developed.

       wbinfo and winbindd were written by Tim Potter.

       The conversion to DocBook for Samba 2.2 was done by Gerald Carter

								 19 November 2002							 WBINFO(1)