Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication
Operating Systems AIX Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication Post 303039888 by linuxsnake on Thursday 17th of October 2019 04:49:46 AM
Old 10-17-2019
So current status is as follows:

kinit <username> - generated me a ticket using my regular Windows login
net ads join -U <username> - Successfully joined me to Windows domain using my regular windows account

wbinfo -g - Is working and brings back all windows AD groups
wbinfo -u - Is working and brings back all windows User accounts

Samba and Winbind are running however still can't find my AIX Samba share from Windows. As I said earlier in my methods.cfg file the reference to WINBIND file does not exist on my system (not sure if this is the cause)


SAMBA LOGS are showing an error "Server exit (NT_STATUS_CONNECTION_DISCONNECTED)". See logs below

Code:
[2019/10/17 06:53:28.159395,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)
[2019/10/17 06:53:41.229754,  3] ../../lib/util/access.c:365(allow_access)
  Allowed connection from x.x.x.x
[2019/10/17 06:53:41.230384,  3] ../../source3/smbd/oplock.c:1422(init_oplocks)
  init_oplocks: initializing messages.
[2019/10/17 06:53:41.230491,  3] ../../source3/smbd/process.c:1948(process_smb)
  Transaction 0 of length 73 (0 toread)
[2019/10/17 06:53:41.230550,  3] ../../source3/smbd/process.c:1541(switch_message)
  switch message SMBnegprot (pid 15597596) conn 0x0
[2019/10/17 06:53:41.230697,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [NT LM 0.12]
[2019/10/17 06:53:41.230744,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.002]
[2019/10/17 06:53:41.230781,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.???]
[2019/10/17 06:53:41.231453,  3] ../../source3/smbd/smb2_negprot.c:294(smbd_smb2_request_process_negprot)
  Selected protocol SMB2_FF
[2019/10/17 06:53:48.869858,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)
[2019/10/17 06:53:51.583732,  3] ../../lib/util/access.c:365(allow_access)
  Allowed connection from x.x.x.x
[2019/10/17 06:53:51.584379,  3] ../../source3/smbd/oplock.c:1422(init_oplocks)
  init_oplocks: initializing messages.
[2019/10/17 06:53:51.584486,  3] ../../source3/smbd/process.c:1948(process_smb)
  Transaction 0 of length 73 (0 toread)
[2019/10/17 06:53:51.584544,  3] ../../source3/smbd/process.c:1541(switch_message)
  switch message SMBnegprot (pid 31195310) conn 0x0
[2019/10/17 06:53:51.584692,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [NT LM 0.12]
[2019/10/17 06:53:51.584739,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.002]
[2019/10/17 06:53:51.584776,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.???]
[2019/10/17 06:53:51.585448,  3] ../../source3/smbd/smb2_negprot.c:294(smbd_smb2_request_process_negprot)
  Selected protocol SMB2_FF
[2019/10/17 06:53:54.243885,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)



If I run this smbclient command on the AIX server I get this response:

Code:
AIXBOX:root >smbclient -L localhost -U%
protocol negotiation failed: NT_STATUS_IO_TIMEOUT

I can telnet to port 445 on the AIX box from a Windows machine so port is visible.

I am including all my config files below to see if anyone can help point me in the right direction. My feelings are this is something to do with krb5.conf and the WINBIND file that doesn't exist on my system perhaps?
Or is it because I'm joining the Windows Domain as a regular Windows user and not a Domain Admin account?

SAMBA.CONF
Code:
server string = "IBM AIX Server"
log file = /var/log/samba.log
passdb backend = tdbsam
idmap config * : backend = tdb
idmap config * : range   = 1000-9999
idmap config UTILITY :backend = ad
idmap config UTILITY:schema_mode = rfc2307
idmap config UTILITY:range = 10000-10099

log level = 3
netbios name = AIXBOX
workgroup = ROBOT
usershare allow guests = yes
domain master = no
local master = no
password server = *
realm = ROBOT.LOCAL
security = ADS
encrypt passwords = yes
template shell = /usr/bin/bash
interfaces = en0
winbind use default domain = yes
client use spnego = no
kerberos method = system keytab

[testshare]
path = /home/share
read only = No
writable = yes
guest ok = yes
public = yes
browseable = yes
valid users = @"domain computers"

[test]
path = /buuk
browseable = yes
valid users = my_windows_user_name


METHODS.CONF
Code:
WINBIND:
        program = /usr/lib/security/WINBIND          (DOES NOT EXIST ON MY AIX SYSTEM)

NIS:
        program = /usr/lib/security/NIS
        program_64 = /usr/lib/security/NIS_64

DCE:
        program = /usr/lib/security/DCE   (DOES NOT EXIST ON MY AIX SYSTEM)

KRB5A:
        program = /usr/lib/security/KRB5A
        options = authonly

KRB5files:
        options = db=BUILTIN,auth=KRB5A


KRB5.CONF

Code:
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = ROBOT.LOCAL
 default_keytab_name = FILE:/etc/krb5.keytab
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 ROBOT.LOCAL = {
  kdc = KDC.ROBOT.LOCAL
  default_domain = ROBOT.LOCAL
 }

Last edited by linuxsnake; 10-17-2019 at 08:55 AM..
 

9 More Discussions You Might Find Interesting

1. Linux

How to Unite Redhat 9 Linux with Windows 2003 Active Directory authentication

Dear All, How to configure a Redhat 9 client to windows 2003 server. I have windows 2003 server which act has domain controller in my office. I have been asked to use redhat 9 has client. how to configure so that redhat 9 can authenticate with windows 2003 server .I have username created in... (0 Replies)
Discussion started by: solaris8in
0 Replies

2. AIX

How to share a directory in AIX to access from Solaris and windows?

Hi All, I am basically new to this forum as well as AIX. To share some huge files between 2 servers I thought of creating a shared Directory in my AIX machine to access it in Solaris. I am very new to this AIX. Help me out how can u share a directory in AIX to access (mount) it on Solaris. Hope... (2 Replies)
Discussion started by: babuchoudary_g
2 Replies

3. SCO

Authentication problems with Active Directory/Samba/Winbind/Pam

Hi all. I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:... (0 Replies)
Discussion started by: silk600
0 Replies

4. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs... (9 Replies)
Discussion started by: raidzero
9 Replies

5. UNIX for Dummies Questions & Answers

control permissions for Active Directory users on AIX

Hello, I've configured an user authentication against Active Directory (Windows Server 2008 R2) on AIX V6 with LDAP. It works fine. And here's my problem: How can I control ldap user permissions on the local AIX machine? E.g. an AD user should be able to write all files of local sys... (1 Reply)
Discussion started by: xia777
1 Replies

6. AIX

Authenticate AIX users from MS Active Directory

First, let me start off saying this is not spam. This is me trying to help out other AIX Admins with MS AD servers. If it is not applicable to you, someone else will find it useful. As long as the "KDC" service is running on your AD server, these steps should work. There should be no... (3 Replies)
Discussion started by: kah00na
3 Replies

7. Solaris

solaris samba configuration without wins service from authentication window server/Active directory

Hi All, We are using solaris samba server for our company project to provide access to code to our development team.Recently our ICT has disabled wins service on Active directory due which user are not able to connect to samba share and they are getting error "No logon server available" as samba... (2 Replies)
Discussion started by: sahil_shine
2 Replies

8. AIX

Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)

Hi all, I have installed samba 3.6.22 on AIX 7.1 and join a windows AD with success. All seem to work fine, I have configured smb.conf, methods.cfg, kerberos, user .... the following command work fine wbinfo -u, wbinfo -g, wbinfo -i, wbinfo -s, wbinfo -S, lsuser, id... The unique... (20 Replies)
Discussion started by: PhilippeA
20 Replies

9. AIX

AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues

Hi. Ive recently upgraded Samba on an AIX server to Samba 4. The aim is to allow a specific group of Windows AD users to access some AIX file shares (with no requirement to enter passwords) - using AD to authenticate. Currently I have: Samba 4 installed ( and 3 daemons running) Installed... (1 Reply)
Discussion started by: linuxsnake
1 Replies
All times are GMT -4. The time now is 06:04 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy