AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues Post: 303040057

Sponsored Content

Operating Systems AIX AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues Post 303040057 by linuxsnake on Tuesday 22nd of October 2019 05:59:43 PM

10-22-2019

Registered User

AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues

Hi. Ive recently upgraded Samba on an AIX server to Samba 4. The aim is to allow a specific group of Windows AD users to access some AIX file shares (with no requirement to enter passwords) - using AD to authenticate.

Currently I have:

Samba 4 installed ( and 3 daemons running)
Installed Kerberos with windbind in config

Joined domain using kinit and net join using regular domain username.

Code:

wbinfo -u  - lists all users in Windows AD
wbinfo -g  - lists all groups in Windows AD
wbinfo -n "ad group" - gives me an aix uid

I had initial problems when trying to access my AIX shares with SID mapping errors in the samba logs.

To resolve this I created a user mapping file called users.map as follows
root = *

Then added this line to smb.conf

Code:

username map = /etc/users.map

Now any AD Windows user can access my AIX file shares without needing to enter a password. I can change this map file to a single domain user or list of specific users to lock it down but this isnt what I need. I want to only allow one specific AD group to access this fileshare.

If people join or leave the company Id have to keep editing this file..

How do I go about getting this working with access by one AD group only?. If I remove the username map entry I cant access the file shares at all and prompted for login/pass. I saw references to valid users = @"DOMAIN\AD Group" but this wont allow access. Its as if samba is looking for a local user called this on the AIX box not to check AD for it as I expected..

Is this linked to config changes in
etc/security/user for WINBIND or are these only needed for ssh access to AIX with AD logins?

Or could this be down to not using a domain admin account when I joined the AD domain using kinit and net join?

Im thinking of installing ldap if I cant get this working with winbind but surely its overkill.. Any help is appreciated with this final hurdle..

Last edited by linuxsnake; 10-23-2019 at 02:31 AM..

linuxsnake

View Public Profile for linuxsnake

Find all posts by linuxsnake

6 More Discussions You Might Find Interesting

1. SCO

Authentication problems with Active Directory/Samba/Winbind/Pam

Hi all. I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:...

2. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs...

3. HP-UX

HP-UX SSH and Active Directory Kerberos with Samba

The situation: i have a AD server with samba4,all clients ssh-kerberos works fine,except hpux :p wich works only for few days..then i must re-export(sic!) the keys with samba-tool domain exportkeytab 11.keytab --principal=host/hpux.fqdn Why after few days ssh return error "server not found...

4. Red Hat

How can I add to Active Directory with Samba Linux?

hi How do I update this file /etc/samba/smb.conf Linux be added to Active Directory thanks

5. UNIX for Beginners Questions & Answers

SAMBA as Active Directory Domin Controller

Could you please let me know, how to install and configure samba as domain controller like Active Directory (AD Server in Windows Server)? And how to configure the Window clients and Linux clients through Samba AD Domain Controller. Note: OS is Ubuntu or CentOS.

6. AIX

Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication

I am running AIX 7.1 and currently we have samba 3.6.25 installed on the server. As it stands some AIX folders are shared that can be accessed by certain Windows users. The problem is that since Windows 10 the guest feature no longer works so users have to manually type in their Windows login/pwd...

LEARN ABOUT DEBIAN

regdiff

REGDIFF(1)							  [FIXME: manual]							REGDIFF(1)

NAME

       regdiff - Diff program for Windows registry files

SYNOPSIS

       regdiff [--help] [--backend=BACKEND] [--backend=BACKEND] [--credentials=CREDENTIALS] [--credentials=CREDENTIALS] [location] [location]

DESCRIPTION

       regdiff compares two Windows registry files key by key and value by value and generates a text file that contains the differences between
       the two files.

       A file generated by regdiff can later be applied to a registry file by the regpatch utility.

       regdiff and regpatch use the same file format as the regedit32.exe utility from Windows.

OPTIONS

       --help
	   Show list of available options.

       --backend BACKEND
	   Name of backend to load. Possible values are: creg, regf, dir and rpc. The default is dir.

	   This argument can be specified twice: once for the first registry file and once for the second.

       --credentials=CREDENTIALS
	   Credentials to use, if any. Password should be separated from user name by a percent sign.

	   This argument can be specified twice: once for the first registry file and once for the second.

VERSION

       This man page is correct for version 4.0 of the Samba suite.

SEE ALSO

       gregedit, regshell, regpatch, regtree, samba, patch, diff

AUTHOR

       This utility is part of the Samba[1] suite, which is developed by the global Samba Team[2].

       This manpage and regdiff were written by Jelmer Vernooij.

NOTES

	1. Samba
	   http://www.samba.org/

	2. Samba Team
	   http://www.samba.org/samba/team/

[FIXME: source] 						    04/16/2014								REGDIFF(1)