Hello All,
I am trying to find the complete documentation to integrate SAMBA version 4 on AIX 7.2 with Active Directory.
Could someone help with this?
Does this help?
The reference above includes this section:
In the above document, it is mentioning about creating users in the Samba. In our case, we do not want to create any user in samba. We want windows users authenticating with AD to access the SAMBA share in AIX.
Hi @rkannan87
Did you get any clues from:
and:
I'm not a Microsoft user, and that includes Active Directory, so sorry, but I cannot help further.
Thanks ! I am reading those threads. I will try.
Good luck and please post back when you find your solution, to help others with the same problem in the future.
Thanks.
Could you be more precise ?
A unix box will not let anyone connect without account...
Being authenticied by AD doesn't mean you can access / or anyone in AD can..
I configured a few and in AIX 7.1 and 7.2 (easier...) the later 3-4 years ago, only I fell ill beginning 2019 and never returned.. I lost all my documentation as it was on work shared disks and my PC was reformatted
So my question is more what is on your AIX to share? As one solution is to NOT let all authenticated to AD have access unless its what you want, by creating a group allowed in Windows ( and AD...) and that AIX box
It may be far more simple though because I, had a challenging task you may not have: In our AD there was no question adding unix servers, in other words, I had to get people connect from their PC using AD, with AD ignoring unix world or almost (auth...) you need NFS4 because of kerberos and Windows ACL compatibility, I can't remember but I think I did had to find a suitable version of Kerberos (5??) compatible with AD needs...
Hi,
We are basically testing the AD integration with Samba. We have 5 windows client with 5 test users authenticating via AD.
From AIX we wanted to export the share /data using SAMBA with AD authentication.
The installed filesets and rpm packages are as below.:
=========================================================
=========================================================
#lslpp -lc | grep -i krb
/usr/lib/objrepos:krb5.client.rte:1.6.0.4::COMMITTED:I:Network Authentication Service Client:
/usr/lib/objrepos:krb5.client.samples:1.6.0.4::COMMITTED:I:Network Authentication Service Samples:
/usr/lib/objrepos:krb5.doc.en_US.pdf:1.6.0.4::COMMITTED:I:Network Auth Service PDF Documentation - U.S. English:
/usr/lib/objrepos:krb5.lic:1.6.0.4::COMMITTED:I:Network Authentication Service License:
/etc/objrepos:krb5.client.rte:1.6.0.4::COMMITTED:I:Network Authentication Service Client:
#
#rpm -qa | grep sam
samba-winbind-4.12.7-1.ppc
samba-winbind-clients-4.12.7-1.ppc
samba-libs-4.12.7-1.ppc
samba-4.12.7-1.ppc
samba-client-4.12.7-1.ppc
samba-devel-4.12.7-1.ppc
samba-common-4.12.7-1.ppc
#
=========================================================
=========================================================
smb.conf, methods.cfg, user and krb5.conf are shown below.
smb.conf
=========================================================
# Global parameters
[global]
bind interfaces only = Yes
interfaces = <IP>
log file = /var/log/samba/log.%m
max log size = 50
preferred master = No
realm = DNC.TEST
security = ADS
server min protocol = SMB2
server string = Samba Server Version %v
winbind enum groups = Yes
winbind enum users = Yes
winbind refresh tickets = Yes
winbind use default domain = Yes
workgroup = DNC
idmap config dnc:unix_primary_group = yes
idmap config dnc:unix_nss_info = yes
idmap config dnc:range = 10000-999999
idmap config dnc:schema_mode = rfc2307
idmap config dnc:backend = ad
idmap config * : range = 1000-9999
idmap config * : backend = tdb
cups options = raw
map acl inherit = Yes
vfs objects = acl_xattr
[homes]
browseable = No
comment = Home Directories
read only = No
valid users = %S
[printers]
browseable = No
comment = All Printers
guest ok = Yes
path = /var/spool/samba
printable = Yes
[data]
browseable = No
guest ok = Yes
path = /data
read only = No
valid users = "@DNC\domain computers"
=========================================================
/etc/security/user
SYSTEM = "WINBIND OR compat"
registry = WINBIND
=========================================================
#ls -l | grep WIN
lrwxrwxrwx 1 root system 28 Jan 28 13:47 WINBIND -> /opt/freeware/lib/WINBIND.so
#
=========================================================
/etc/methods.cfg
WINBIND:
program = /usr/lib/security/WINBIND
options = authonly
=========================================================
krb5.conf
[libdefaults]
default_realm = DNC.TEST
default_keytab_name = FILE:/etc/krb5/krb5.keytab
default_tkt_enctypes = aes256-cts aes128-cts des3-cbc-sha1 arcfour-hmac des-cbc-md5 des-cbc-crc
default_tgs_enctypes = aes256-cts aes128-cts des3-cbc-sha1 arcfour-hmac des-cbc-md5 des-cbc-crc
[realms]
DNC.TEST = {
kdc = DNCTEST-AD01.DNC.TEST:88
admin_server = DNCTEST-AD01.DNC.TEST:749
default_domain = DNC.TEST
}
[domain_realm]
.DNC.TEST = DNC.TEST
DNCTEST-AD01.DNC.TEST = DNC.TEST
[logging]
kdc = FILE:/var/krb5/log/krb5kdc.log
admin_server = FILE:/var/krb5/log/kadmin.log
kadmin_local = FILE:/var/krb5/log/kadmin_local.log
default = FILE:/var/krb5/log/krb5lib.log
=========================================================
Running Kinit -> SUCCESS
#kinit <Administrator>
Password for <Administrator>@DNC.TEST:
#
#klist -a // Listing the token for the Administrator
=========================================================
Joining to domain --> Success
#net ads join -U <Administrator>
Enter <Administrator>'s password:
Using short domain name -- DNC
Joined '<AD Member>' to dns domain 'dnc.test'
#
=========================================================
When we test the wbinfo commands.
wbinfo -u -> Returning users
wbinfo -g -> Returning groups
wbinfo -n test5 --> Returning the SID of the user test5
We are getting the errros when we test the below commands.
#wbinfo -i test5
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test5
#wbinfo -S S-1-5-21-2479291821-1728743441-2121331971-1105 // Converting SID of test5 to UID.
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-2479291821-1728743441-2121331971-1105 to uid
#
=========================================================
At the moment, we are stuck with the above errors. The ID mapping is having problem here.
Your help is much appreciated.
In order to let Windows-authenticated users access a Unix file system, you need a SID to UID mapping.
Google finds
https://www.samba.org/~ab/output/htmldocs/Samba3-HOWTO/idmapper.html
If you use winbind then ensure that the winbindd service (process) is running.
https://www.samba.org/samba/docs/current/man-html/winbindd.8.html
Hi,
Thanks for your reply.
I am following the below link.
We are using the backed as ad. We missed the pre-requisite mentioned in the below link.
https://wiki.samba.org/index.php/Idmap_config_ad
Prerequisites
To enable Samba to retrieve user and group information from Active Directory (AD):
- Users must have, at least, the
uidNumberattribute set. When using therfc2307winbind NSS infomode, user accounts must also have theloginShellandunixHomeDirectoryset. - Groups must have, at least, the
gidNumberattribute set. - Computers, or: 'machine network accounts', must have the
uidNumberattribute set to access shares on samba domain members. - The Users and Computers Primary Group must have a
gidNumberattribute set. - The user, computer, and group IDs must be within the range configured in the
smb.conffor this domain.
============================================
We have requested to enable the UID/GID from AD side.
After this step, going back to the previous link, they have mentioned to configure the "Name Service Switch".
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member#Configuring_the_Name_Service_Switch
Configuring the Name Service Switch
To enable the name service switch (NSS) library to make domain users and groups available to the local system:
- Append the
winbindentry to the following databases in the/etc/nsswitch.conffile:
passwd: files winbind group: files winbind
As we are doing this configuration in AIX, We do not have /etc/nsswitch.conf file.
How do we accomplish this step in AIX ?
Please give your suggestion.
AIX has /etc/netsvc.conf instead.
But might not have passwd?
Indeed AUX seems very special. I found