I have managed to install samba and kerberos and configured smb.conf, krb5.conf and methods.cfg

I ran the following commands to join the Windows Domain from AIX:

1) kinit <username> using my current Windows user name that I log on to the domain with. Initially I had some problems with time synchronisation (scew time was out). To resolve this I configured ntp daemon pointing it to the domain server and I forced a time synchronisation. After this the command worked and I generated a kerberos key.

2) net ads join -U <username> using my current Windows user name that I log on to the domain with.

Both these commands worked so I joined the Windows domain.


At this stage I ran some test commands:

wbinfo --ping-dc - This came back positive as SUCCESS

wbinfo -g - This brings back a list of all domain groups on the domain controller
wbinfo -u - This brings back a list in unix of all the windows user names on the domain controller

Samba appears to be running ok however the folder I'm trying to share on AIX is still not visible when I try and access it via Windows \\unixserver\sharename . No errors it just isn't recognised by windows as a share.

I logged on a Windows machine to see if my Unix machine can be found in Active Directory. I found it listed under computers (its a member of one group - domain users)


I have 2 questions so far:

1) When configuring Kerberos all the guides refer to winbind settings in methods.cfg

There is a reference in this config file to WINBIND and DCE file locations:

Code:

WINBIND:
        program = /usr/lib/security/WINBIND
        program_64 = /usr/lib/security/WINBIND_64
DCE:
        program = /usr/lib/security/DCE

When I check my AIX system these files do not exist. I ran a find searching the whole system. /usr/lib/security exists but WINBIND , WINBIND_64 and DCE do not exist. The latest winbind packages have already been installed via yum so I'm on the latest version for AIX 7.1

In /opt/freeware/lib/security there are 2 files pam_winbind.so and pam_smbpass.so. I believe I may need to copy these to /usr/lib/security ?
The question is why dont I have WINBIND or WINBIND_64 on my system and how do I get hold of these? I presume I need methods.cfg to use these WINBIND library files in order for my fileshare to work?
I don't need to authenticate users to login to the unix shell. I just need a group of windows users (from one AD group) to access an AIX fileshare (without a requirement to enter a password) - authenticating using active directory account.

2) Currently I have joined the domain as a regular windows user. This allows me to interrogate Active Directory and list all users and groups. I presume to get this working correctly I will need to join the domain as a Windows user with a higher level of rights (perhaps domain administrator rights?). Can anyone tell me what group the Windows user should be a member of to get file sharing working so a specific AD group of Windows users can access a shared AIX folder authenticating with their windows password (no need to enter one)? I'm guessing my regular Windows user account won't give me what we need.

I've switched logging up to 3 for samba.log to try and give me an idea of why this is failing but if anyone has got this working appreciate any suggestions.