I now appear to have a working yum. Now I just need to find space to install samba. This box is so old that space is very limited.
To resolve the dependency issues I removed openssl and libgcc rpms as below. Tried a test using yum install wget and this installed fine pulling down an older version of libgcc.
The gcc version is OS specific. For AIX 7.1 gcc 6.3 should be used, not 9.
I have a couple of 7.1 systems and yum works. I recommend uninstalling gcc-9 (and libs) along with any dependents, and reinstalling with 6.3. Does that work?
I have managed to install samba and kerberos and configured smb.conf, krb5.conf and methods.cfg
I ran the following commands to join the Windows Domain from AIX:
1) kinit <username> using my current Windows user name that I log on to the domain with. Initially I had some problems with time synchronisation (scew time was out). To resolve this I configured ntp daemon pointing it to the domain server and I forced a time synchronisation. After this the command worked and I generated a kerberos key.
2) net ads join -U <username> using my current Windows user name that I log on to the domain with.
Both these commands worked so I joined the Windows domain.
At this stage I ran some test commands:
wbinfo --ping-dc - This came back positive as SUCCESS
wbinfo -g - This brings back a list of all domain groups on the domain controller
wbinfo -u - This brings back a list in unix of all the windows user names on the domain controller
Samba appears to be running ok however the folder I'm trying to share on AIX is still not visible when I try and access it via Windows \\unixserver\sharename . No errors it just isn't recognised by windows as a share.
I logged on a Windows machine to see if my Unix machine can be found in Active Directory. I found it listed under computers (its a member of one group - domain users)
I have 2 questions so far:
1) When configuring Kerberos all the guides refer to winbind settings in methods.cfg
There is a reference in this config file to WINBIND and DCE file locations:
When I check my AIX system these files do not exist. I ran a find searching the whole system. /usr/lib/security exists but WINBIND , WINBIND_64 and DCE do not exist. The latest winbind packages have already been installed via yum so I'm on the latest version for AIX 7.1
In /opt/freeware/lib/security there are 2 files pam_winbind.so and pam_smbpass.so. I believe I may need to copy these to /usr/lib/security ?
The question is why dont I have WINBIND or WINBIND_64 on my system and how do I get hold of these? I presume I need methods.cfg to use these WINBIND library files in order for my fileshare to work?
I don't need to authenticate users to login to the unix shell. I just need a group of windows users (from one AD group) to access an AIX fileshare (without a requirement to enter a password) - authenticating using active directory account.
2) Currently I have joined the domain as a regular windows user. This allows me to interrogate Active Directory and list all users and groups. I presume to get this working correctly I will need to join the domain as a Windows user with a higher level of rights (perhaps domain administrator rights?). Can anyone tell me what group the Windows user should be a member of to get file sharing working so a specific AD group of Windows users can access a shared AIX folder authenticating with their windows password (no need to enter one)? I'm guessing my regular Windows user account won't give me what we need.
I've switched logging up to 3 for samba.log to try and give me an idea of why this is failing but if anyone has got this working appreciate any suggestions.
kinit <username> - generated me a ticket using my regular Windows login
net ads join -U <username> - Successfully joined me to Windows domain using my regular windows account
wbinfo -g - Is working and brings back all windows AD groups
wbinfo -u - Is working and brings back all windows User accounts
Samba and Winbind are running however still can't find my AIX Samba share from Windows. As I said earlier in my methods.cfg file the reference to WINBIND file does not exist on my system (not sure if this is the cause)
SAMBA LOGS are showing an error "Server exit (NT_STATUS_CONNECTION_DISCONNECTED)". See logs below
If I run this smbclient command on the AIX server I get this response:
I can telnet to port 445 on the AIX box from a Windows machine so port is visible.
I am including all my config files below to see if anyone can help point me in the right direction. My feelings are this is something to do with krb5.conf and the WINBIND file that doesn't exist on my system perhaps?
Or is it because I'm joining the Windows Domain as a regular Windows user and not a Domain Admin account?
SAMBA.CONF
METHODS.CONF
KRB5.CONF
Last edited by linuxsnake; 10-17-2019 at 08:55 AM..
I've resolved the above issue after multiple changes to the samba config. In the end the issue was down to one entry in the smb.conf
kerberos method = system keytab
Solution - delete and it uses secret.
Now I've moved slightly further. I see the network share now. When I attempt to open the file share from windows checking samba.log I see these errors
It's as if its expecting the windows username to exist on my AIX server. Do I need to manually add the user to my AIX box or is there a way to have AIX automatically log this user on regardless if they have an account on the AIX system. For example can I force them to logon as the oracle user?
UPDATE: I now finally have Samba Shares working on AIX 7.1.... However this was only after using a smbmap user list (To map individual Windows user to the root account on my AIX box)
For the Windows to Unix Mapping I added this to samba.conf
Inside smbmap we have this:
Quote:
root = ROBOT\joe.bloggs
The root user is then defined in the file share in smb.conf as follows:
Now when joe.bloggs opens the AIX file share from Windows he is mapped to the local root user and has access to the file share.
Now the only issue I have is that I don't want to have to add 10 + separate Windows users manually into the smbmap file. Currently I have tested with one account joe.bloggs.
Is there a way to configure samba so that if a Windows user is part of a specific windows group such as "domain admins" that they will automatically be mapped to the local AIX root user?
I'm sure there is an easier way than manually adding 10 + Windows AD usernames to the smbmap file manually.......
I also have an issue with wbinfo. I can run wbinfo -u and wbinfo -g commands fine and they return a list of all windows domain users and groups.
But if I try and query a list of users in a specific Windows group using wbinfo --group-info="domain users" this fails.
Last edited by linuxsnake; 10-21-2019 at 05:02 AM..
according to the IBM developer forum, you need to do this:
1) /etc/netsvc.conf
2) /usr/lib/security/methods.cfg should have this entry.
/usr/lib/security/WINBIND should point to /opt/freeware/lib/WINBIND.so
3) Edit /etc/security/user to set the below things under "default"
Hi. Ive recently upgraded Samba on an AIX server to Samba 4. The aim is to allow a specific group of Windows AD users to access some AIX file shares (with no requirement to enter passwords) - using AD to authenticate.
Currently I have:
Samba 4 installed ( and 3 daemons running)
Installed... (1 Reply)
Hi all,
I have installed samba 3.6.22 on AIX 7.1 and join a windows AD with success.
All seem to work fine, I have configured smb.conf, methods.cfg, kerberos, user .... the following command work fine wbinfo -u, wbinfo -g, wbinfo -i, wbinfo -s, wbinfo -S, lsuser, id...
The unique... (20 Replies)
Hi All, We are using solaris samba server for our company project to provide access to code to our development team.Recently our ICT has disabled wins service on Active directory due which user are not able to connect to samba share and they are getting error "No logon server available" as samba... (2 Replies)
First, let me start off saying this is not spam. This is me trying to help out other AIX Admins with MS AD servers. If it is not applicable to you, someone else will find it useful.
As long as the "KDC" service is running on your AD server, these steps should work. There should be no... (3 Replies)
Hello,
I've configured an user authentication against Active Directory (Windows Server 2008 R2) on AIX V6 with LDAP. It works fine.
And here's my problem:
How can I control ldap user permissions on the local AIX machine?
E.g. an AD user should be able to write all files of local sys... (1 Reply)
Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is..
I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs... (9 Replies)
Hi all.
I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:... (0 Replies)
Hi All,
I am basically new to this forum as well as AIX. To share some huge files between 2 servers I thought of creating a shared Directory in my AIX machine to access it in Solaris. I am very new to this AIX. Help me out how can u share a directory in AIX to access (mount) it on Solaris.
Hope... (2 Replies)
Dear All,
How to configure a Redhat 9 client to windows 2003 server. I have windows 2003 server which act has domain controller in my office. I have been asked to use redhat 9 has client. how to configure so that redhat 9 can authenticate with windows 2003 server .I have username created in... (0 Replies)