Доброго дня. Я бьюсь второй день и ни как не пойму. Ввел ОС в домен, все настроил, а папка расшаренная просит все равно пароль и не принимает пользователей домена. Пото му что не отрабатывает getent passwd и getent group. Не видят они пользователей домена, только локальных. Сломал всю голову.
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.4 LTS"root@vusbase:~# testparm -s
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[medstat]"
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
# Global parameters
[global]
disable spoolss = Yes
dns proxy = No
load printers = No
log file = /var/log/samba/log.%m
map to guest = Bad User
max log size = 1000
panic action = /usr/share/samba/panic-action %d
printcap name = /dev/null
realm = GB2BEL.RU
security = ADS
show add printer wizard = No
winbind enum groups = Yes
winbind enum users = Yes
winbind offline logon = Yes
winbind refresh tickets = Yes
winbind separator = /
workgroup = GB2BEL
idmap config gb2bel : backend = rid
idmap config gb2bel : range = 10000-19999
idmap config gb2bel : base_rid = 0
idmap config * :range = 20000-29999
idmap config * : backend = tdb
[medstat]
create mask = 0777
directory mask = 0777
force create mode = 0777
force directory mode = 0777
inherit owner = windows and unix
path = /mnt/medstat
read only = No
valid users = "@GB2BEL\пользователи домена" @GB2BEL\admins
write list = "@GB2BEL\пользователи домена" @GB2BEL\admins[/quote]
[quote]root@vusbase:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: saikov@GB2BEL.RU
Valid starting Expires Service principal
27.02.2020 17:30:22 28.02.2020 03:30:22 krbtgt/GB2BEL.RU@GB2BEL.RU
renew until 28.02.2020 17:30:19
Это отрабатывает, но только в одну сторону
[console]root@vusbase:~# wbinfo -n GB2BEL\\saikov
S-1-5-21-4213692847-1725867062-2836627142-4695 SID_USER (1)
root@vusbase:~# wbinfo -S S-1-5-21-4213692847-1725867062-2836627142-4695
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-4213692847-1725867062-2836627142-4695 to uid[/console]
[console]root@vusbase:~# wbinfo -a GB2BEL\\saikov%"XXXXXX"
plaintext password authentication failed
Could not authenticate user GB2BEL\saikov%XXXXXXX with plaintext password
challenge/response password authentication failed
wbcAuthenticateUserEx(GB2BEL\saikov): error code was NT_STATUS_WRONG_PASSWORD (0xc000006a, authoritative=1)
error message was: When trying to update a password, this return status indicates that the value provided as the current password is not correct.
Could not authenticate user GB2BEL\saikov with challenge/response[/console]
Хотя раньше она отрабатывала. Пользователь находился. Это я уже что то с smb.conf наковырял
[console]root@vusbase:~# cat /etc/krb5.conf[/console]
[libdefaults]
default_realm = GB2BEL.RU
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
[realms]
GB2BEL.RU = {
kdc = ad1.gb2bel.ru
kdc = ad0.gb2bel.ru
admin_server = ad1.gb2bel.ru
default_domain = GB2BEL.RU
}
[domain_realm]
.GB2BEL.RU = GB2BEL.RU
GB2BEL.RU = GB2BEL.RU
[login]
krb4_convert = false
krb4_get_tickets = false[/quote]
[quote]root@vusbase:~# cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat winbind systemd
group: compat winbind systemd
shadow: compat
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
Что блин делать? wbinfo -t -p -g -u все отрабатывает корректно.
Добавлено: 28.02.2020 10:27:16
[console]root@vusbase:~# wbinfo -a GB2BEL\\saikov%XXXXXXX
plaintext password authentication succeeded
challenge/response password authentication succeeded[/console]
Сейчас команда отрабатывает, но getent по прежнему молчит.
Настройки теперь такие
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[medstat]"
Loaded services file OK.
idmap range not specified for domain '*'
ERROR: Invalid idmap range for domain *!
Server role: ROLE_DOMAIN_MEMBER
Press enter to see a dump of your service definitions
# Global parameters
[global]
dedicated keytab file = /etc/krb5.keytab
disable spoolss = Yes
dns proxy = No
kerberos method = secrets and keytab
load printers = No
log file = /var/log/samba/log.%m
map to guest = Bad User
max log size = 1000
printcap name = /dev/null
realm = GB2BEL.RU
security = ADS
show add printer wizard = No
winbind enum groups = Yes
winbind enum users = Yes
winbind offline logon = Yes
winbind refresh tickets = Yes
winbind use default domain = Yes
workgroup = GB2BEL
idmap config gb2bel : range = 13000-1999999
idmap config gb2bel : schema_mode = rfc2307
idmap config gb2bel : backend = ad
idmap config * : backend = tdb
[medstat]
comment = Shared folder
create mask = 0777
directory mask = 0777
path = /mnt/medstat
read only = No
Добавлено: 02.03.2020 08:08:56
Да.Форум уже не тот торт ((
