Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication


 
Thread Tools Search this Thread
Operating Systems AIX Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication
# 1  
Old 10-10-2019
Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication

I am running AIX 7.1 and currently we have samba 3.6.25 installed on the server. As it stands some AIX folders are shared that can be accessed by certain Windows users.
The problem is that since Windows 10 the guest feature no longer works so users have to manually type in their Windows login/pwd before they can access the shared drives. They get a pop up box asking them to login. Previously users were able to connect to the AIX file shares with no requirement to enter username/passwords. I do not have Kerberos installed on this server.

My requirement:
I need to reconfigure samba so that a small group of Windows users in a specific group on Active Directory can access these shared folders on AIX without the requirement to enter their login and password. Samba should recognise the user they are currently logged in as on Active Directory and allow them access to the folder if they are a member of the right access group.

My current smb.conf is as follows:

Code:
workgroup = domain
wins support = yes
security = user
log file = /var/log/samba.log
protocol = SMB2                             
min protocol = SMB2                 ## This had to be added so that Windows 10 machines can access the share as SMB1 is not supported

[File Share]
path = /filetoshare/here
force user = root
read only = no
public = yes
guest ok = no

I understand from my initial research that I need to change the security from user to ADS by setting security = ADS. This would then allow me to use Active Directory to authenticate the users. Unfortunately after checking the nmbd logs it seems that this setting is not recognised by this version of Samba 3.6...

Quote:
WARNING: Ignoring invalid value 'ADS' for parameter 'security'
Ignoring unknown parameter "realm"
It may be that Samba 3.6 does not support ADS. In this case do I have any other options with Samba 3.6 that would allow me to authenticate with the Windows Domain running on Windows Server 2012? I see there is also a server setting of domain - server = domain. I understand the AIX machine name would need to be added to the active directory server under machines I presume?

When looking at adding Samba to domains there was reference to a command "net ads -u Username" I get another error.
Quote:
ADS support not compiled in
So I presume this means I can't use the domain option either which would suggest I need a newer version of Samba.

I have checked many AIX forums but have not been able to find a pre-compiled version of samba 4 for AIX 7.1. This would be the safest way to upgrade.
Unfortunately this AIX machine does not have GCC, WGET, YUM installed so it would be difficult to compile from source. If this was Ubuntu I'd just run an apt-get install samba but AIX is a different beast.
Also can anyone confirm if I need to also install Kerberos for this to work?

I'd be interested to hear if anyone has this working. Any suggestions to help with this project would be appreciated. Thank you.

Last edited by linuxsnake; 10-10-2019 at 07:50 AM..
# 2  
Old 10-10-2019
Hi.. Did you search the forums before asking this question?

See, for example:


Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)
# 3  
Old 10-11-2019
Hi. There's some useful information here but no references in the forum to the server = AD function not working on Samba 3.6

I've decided to download some pre-compiled RPM's for Samba 4 to install on my AIX server. Judging by the error message I saw it's as if my version of Samba was compiled without AD support... Strange.

I presume Kerberos will also need to be installed from my research of current forum posts. So I'll download these RPM's as well.

If I can get Samba 4 and Kerberos installed on AIX this should hopefully allow me to start communicating with Active Directory. Previously I've worked predominantly on Linux systems so this task would of been a lot quicker using yum or apt-get. I'll keep the post updated with progress, hopefully helping others who have this requirement.
# 4  
Old 10-13-2019
Samba 4 (4.10.6-1 and pretty much any earlier version) for AIX is available from IBM / AIX toolbox. You can download it directly from there assuming you have an IBM account and it is fully supported by IBM. You might need to download the corresponding dependencies as well.
# 5  
Old 10-14-2019
Please consider setting up the AIX Toolbox. This will give you yum and anything else IBM has in the Toolbox. Instructions are available at: ftp://ftp.software.ibm.com/aix/freeS...ppc/README-yum

It's rather painful to download/install/update rpms by hand without yum so try to avoid that.
# 6  
Old 10-15-2019
Thanks for the feedback. OK I'm making some progress.

So far I have

1) Upgraded RPM to latest version as I found current version of RPM did not allow me to install RPM packages I require

Downloaded rpm.rte
public - dhe - ibm com - aix - freeSoftware - aixtoolbox - INSTALLP -ppc

Ran smit and installed using software installation menu


2) Downloaded YUM package

Downloaded YUM
aix - freeSoftware - aixtoolbox - ezinstall -ppc - yum_bundle.tar

Ran smit and installed using software installation menu


Yum is now installed so tried to run yum install samba

Code:
yum install samba

Quote:
Gave errors:
Error: Package: openldap-2.4.46-2.ppc (AIX_Toolbox)
Requires: libssl.a(libssl.so.1.0.2)
Error: Package: openldap-2.4.46-2.ppc (AIX_Toolbox)
Requires: libcrypto.a(libcrypto.so.1.0.2)
Established that version of OpenSSL was too old:
Code:
lslpp -l|grep openssl
  openssl.base             1.0.1.515  COMMITTED  Open Secure Socket Layer
  openssl.man.en_US        1.0.1.515  COMMITTED  Open Secure Socket Layer
  openssl.base             1.0.1.515  COMMITTED  Open Secure Socket Layer


I downloaded Newer Version of OpenSSL from IBM's site version openssl-1.0.2.1801.tar.Z

uncompress openssl-1.0.2.1801.tar.Z
Code:
tar -xvf openssl-1.0.2.1801.tar

Installed OK via SMIT
Code:
lslpp -l|grep openssl
  openssl.base            1.0.2.1801  COMMITTED  Open Secure Socket Layer
  openssl.license         1.0.2.1801  COMMITTED  Open Secure Socket License
  openssl.man.en_US       1.0.2.1801  COMMITTED  Open Secure Socket Layer
  openssl.base            1.0.2.1801  COMMITTED  Open Secure Socket Layer


Updated Dependencies by running
updtvpkg



So I tried to run - yum install samba


Now I'm hitting some more dependency issues


Quote:
Error: Package: libstdc++-6.3.0-2.ppc (AIX_Toolbox_71)
Requires: libgcc = 6.3.0-2
Installed: libgcc-9.1.0-1.ppc (installed)
libgcc = 9.1.0-1
Available: libgcc-4.8.5-1.ppc (AIX_Toolbox_71)
libgcc = 4.8.5-1
Available: libgcc-6.3.0-1.ppc (AIX_Toolbox_71)
libgcc = 6.3.0-1
Available: libgcc-6.3.0-2.ppc (AIX_Toolbox_71)
libgcc = 6.3.0-2

So I thought maybe I need to remove the newer version of libgcc and downgrade it to 6.3.0

The problem is that if I remove the current version of libgcc this means that OPENSSL has a dependency issue... :-(
Code:
rpm -e libgcc
error: Failed dependencies:
        libgcc_s.a(shr.o) is needed by (installed) openssl-1.0.2s-1withsslv2.ppc


Last edited by vbe; 10-16-2019 at 11:51 AM.. Reason: extra code tags...
# 7  
Old 10-15-2019
If anyone can provide any guidance of how I can proceed with this error when I run yum install would be appreciated. This appears to be for any yum install <software> attempt
Not sure if skipping these errors would be a good idea.. I'd like to get all the dependencies fixed if I can.

Code:
yum install wget
--> Finished Dependency Resolution
Error: Package: libstdc++-6.3.0-2.ppc (AIX_Toolbox_71)
           Requires: libgcc = 6.3.0-2
           Installed: libgcc-9.1.0-1.ppc (installed)
               libgcc = 9.1.0-1
           Available: libgcc-4.8.5-1.ppc (AIX_Toolbox_71)
               libgcc = 4.8.5-1
           Available: libgcc-6.3.0-1.ppc (AIX_Toolbox_71)
               libgcc = 6.3.0-1
           Available: libgcc-6.3.0-2.ppc (AIX_Toolbox_71)
               libgcc = 6.3.0-2
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest


Last edited by vbe; 10-16-2019 at 11:49 AM.. Reason: code tags - not quotes please
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. AIX

AIX 7.1 - Samba 4 File Shares and Integration with Active Directory Issues

Hi. Ive recently upgraded Samba on an AIX server to Samba 4. The aim is to allow a specific group of Windows AD users to access some AIX file shares (with no requirement to enter passwords) - using AD to authenticate. Currently I have: Samba 4 installed ( and 3 daemons running) Installed... (1 Reply)
Discussion started by: linuxsnake
1 Replies

2. AIX

Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)

Hi all, I have installed samba 3.6.22 on AIX 7.1 and join a windows AD with success. All seem to work fine, I have configured smb.conf, methods.cfg, kerberos, user .... the following command work fine wbinfo -u, wbinfo -g, wbinfo -i, wbinfo -s, wbinfo -S, lsuser, id... The unique... (20 Replies)
Discussion started by: PhilippeA
20 Replies

3. Solaris

solaris samba configuration without wins service from authentication window server/Active directory

Hi All, We are using solaris samba server for our company project to provide access to code to our development team.Recently our ICT has disabled wins service on Active directory due which user are not able to connect to samba share and they are getting error "No logon server available" as samba... (2 Replies)
Discussion started by: sahil_shine
2 Replies

4. AIX

Authenticate AIX users from MS Active Directory

First, let me start off saying this is not spam. This is me trying to help out other AIX Admins with MS AD servers. If it is not applicable to you, someone else will find it useful. As long as the "KDC" service is running on your AD server, these steps should work. There should be no... (3 Replies)
Discussion started by: kah00na
3 Replies

5. UNIX for Dummies Questions & Answers

control permissions for Active Directory users on AIX

Hello, I've configured an user authentication against Active Directory (Windows Server 2008 R2) on AIX V6 with LDAP. It works fine. And here's my problem: How can I control ldap user permissions on the local AIX machine? E.g. an AD user should be able to write all files of local sys... (1 Reply)
Discussion started by: xia777
1 Replies

6. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs... (9 Replies)
Discussion started by: raidzero
9 Replies

7. SCO

Authentication problems with Active Directory/Samba/Winbind/Pam

Hi all. I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:... (0 Replies)
Discussion started by: silk600
0 Replies

8. AIX

How to share a directory in AIX to access from Solaris and windows?

Hi All, I am basically new to this forum as well as AIX. To share some huge files between 2 servers I thought of creating a shared Directory in my AIX machine to access it in Solaris. I am very new to this AIX. Help me out how can u share a directory in AIX to access (mount) it on Solaris. Hope... (2 Replies)
Discussion started by: babuchoudary_g
2 Replies

9. Linux

How to Unite Redhat 9 Linux with Windows 2003 Active Directory authentication

Dear All, How to configure a Redhat 9 client to windows 2003 server. I have windows 2003 server which act has domain controller in my office. I have been asked to use redhat 9 has client. how to configure so that redhat 9 can authenticate with windows 2003 server .I have username created in... (0 Replies)
Discussion started by: solaris8in
0 Replies
Login or Register to Ask a Question