Samba 3.6 on AIX 7.1 - Windows 10 Access to AIX file shares using Active Directory authentication

I am running AIX 7.1 and currently we have samba 3.6.25 installed on the server. As it stands some AIX folders are shared that can be accessed by certain Windows users.
The problem is that since Windows 10 the guest feature no longer works so users have to manually type in their Windows login/pwd before they can access the shared drives. They get a pop up box asking them to login. Previously users were able to connect to the AIX file shares with no requirement to enter username/passwords. I do not have Kerberos installed on this server.

My requirement:
I need to reconfigure samba so that a small group of Windows users in a specific group on Active Directory can access these shared folders on AIX without the requirement to enter their login and password. Samba should recognise the user they are currently logged in as on Active Directory and allow them access to the folder if they are a member of the right access group.

My current smb.conf is as follows:

workgroup = domain
wins support = yes
security = user
log file = /var/log/samba.log
protocol = SMB2                             
min protocol = SMB2                 ## This had to be added so that Windows 10 machines can access the share as SMB1 is not supported

[File Share]
path = /filetoshare/here
force user = root
read only = no
public = yes
guest ok = no

I understand from my initial research that I need to change the security from user to ADS by setting security = ADS. This would then allow me to use Active Directory to authenticate the users. Unfortunately after checking the nmbd logs it seems that this setting is not recognised by this version of Samba 3.6...

It may be that Samba 3.6 does not support ADS. In this case do I have any other options with Samba 3.6 that would allow me to authenticate with the Windows Domain running on Windows Server 2012? I see there is also a server setting of domain - server = domain. I understand the AIX machine name would need to be added to the active directory server under machines I presume?

When looking at adding Samba to domains there was reference to a command "net ads -u Username" I get another error.

So I presume this means I can't use the domain option either which would suggest I need a newer version of Samba.

I have checked many AIX forums but have not been able to find a pre-compiled version of samba 4 for AIX 7.1. This would be the safest way to upgrade.
Unfortunately this AIX machine does not have GCC, WGET, YUM installed so it would be difficult to compile from source. If this was Ubuntu I'd just run an apt-get install samba but AIX is a different beast.
Also can anyone confirm if I need to also install Kerberos for this to work?

I'd be interested to hear if anyone has this working. Any suggestions to help with this project would be appreciated. Thank you.

Hi.. Did you search the forums before asking this question?

See, for example:

Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and winbind)

Hi. There's some useful information here but no references in the forum to the server = AD function not working on Samba 3.6

I've decided to download some pre-compiled RPM's for Samba 4 to install on my AIX server. Judging by the error message I saw it's as if my version of Samba was compiled without AD support... Strange.

I presume Kerberos will also need to be installed from my research of current forum posts. So I'll download these RPM's as well.

If I can get Samba 4 and Kerberos installed on AIX this should hopefully allow me to start communicating with Active Directory. Previously I've worked predominantly on Linux systems so this task would of been a lot quicker using yum or apt-get. I'll keep the post updated with progress, hopefully helping others who have this requirement.

Samba 4 (4.10.6-1 and pretty much any earlier version) for AIX is available from IBM / AIX toolbox. You can download it directly from there assuming you have an IBM account and it is fully supported by IBM. You might need to download the corresponding dependencies as well.

Please consider setting up the AIX Toolbox. This will give you yum and anything else IBM has in the Toolbox. Instructions are available at: ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/ezinstall/ppc/README-yum

It's rather painful to download/install/update rpms by hand without yum so try to avoid that.

Thanks for the feedback. OK I'm making some progress.

So far I have

1) Upgraded RPM to latest version as I found current version of RPM did not allow me to install RPM packages I require

Downloaded rpm.rte
public - dhe - ibm com - aix - freeSoftware - aixtoolbox - INSTALLP -ppc

Ran smit and installed using software installation menu

2) Downloaded YUM package

Downloaded YUM
aix - freeSoftware - aixtoolbox - ezinstall -ppc - yum_bundle.tar

Ran smit and installed using software installation menu

Yum is now installed so tried to run yum install samba

yum install samba

Established that version of OpenSSL was too old:

lslpp -l|grep openssl
  openssl.base             1.0.1.515  COMMITTED  Open Secure Socket Layer
  openssl.man.en_US        1.0.1.515  COMMITTED  Open Secure Socket Layer
  openssl.base             1.0.1.515  COMMITTED  Open Secure Socket Layer

I downloaded Newer Version of OpenSSL from IBM's site version openssl-1.0.2.1801.tar.Z

uncompress openssl-1.0.2.1801.tar.Z

tar -xvf openssl-1.0.2.1801.tar

Installed OK via SMIT

lslpp -l|grep openssl
  openssl.base            1.0.2.1801  COMMITTED  Open Secure Socket Layer
  openssl.license         1.0.2.1801  COMMITTED  Open Secure Socket License
  openssl.man.en_US       1.0.2.1801  COMMITTED  Open Secure Socket Layer
  openssl.base            1.0.2.1801  COMMITTED  Open Secure Socket Layer

Updated Dependencies by running
updtvpkg

So I tried to run - yum install samba

Now I'm hitting some more dependency issues

So I thought maybe I need to remove the newer version of libgcc and downgrade it to 6.3.0

The problem is that if I remove the current version of libgcc this means that OPENSSL has a dependency issue...

rpm -e libgcc
error: Failed dependencies:
        libgcc_s.a(shr.o) is needed by (installed) openssl-1.0.2s-1withsslv2.ppc

If anyone can provide any guidance of how I can proceed with this error when I run yum install would be appreciated. This appears to be for any yum install <software> attempt
Not sure if skipping these errors would be a good idea.. I'd like to get all the dependencies fixed if I can.

yum install wget
--> Finished Dependency Resolution
Error: Package: libstdc++-6.3.0-2.ppc (AIX_Toolbox_71)
           Requires: libgcc = 6.3.0-2
           Installed: libgcc-9.1.0-1.ppc (installed)
               libgcc = 9.1.0-1
           Available: libgcc-4.8.5-1.ppc (AIX_Toolbox_71)
               libgcc = 4.8.5-1
           Available: libgcc-6.3.0-1.ppc (AIX_Toolbox_71)
               libgcc = 6.3.0-1
           Available: libgcc-6.3.0-2.ppc (AIX_Toolbox_71)
               libgcc = 6.3.0-2
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

UPDATE:

I now appear to have a working yum. Now I just need to find space to install samba. This box is so old that space is very limited.

To resolve the dependency issues I removed openssl and libgcc rpms as below. Tried a test using yum install wget and this installed fine pulling down an older version of libgcc.

rpm -e libgcc-9.1.0-1.ppc
rpm -e openssl-1.1.0g-1withsslv2.ppc

The gcc version is OS specific. For AIX 7.1 gcc 6.3 should be used, not 9.

I have a couple of 7.1 systems and yum works. I recommend uninstalling gcc-9 (and libs) along with any dependents, and reinstalling with 6.3. Does that work?

Edit: I see you did that already, great

I have managed to install samba and kerberos and configured smb.conf, krb5.conf and methods.cfg

I ran the following commands to join the Windows Domain from AIX:

1) kinit <username> using my current Windows user name that I log on to the domain with. Initially I had some problems with time synchronisation (scew time was out). To resolve this I configured ntp daemon pointing it to the domain server and I forced a time synchronisation. After this the command worked and I generated a kerberos key.

2) net ads join -U <username> using my current Windows user name that I log on to the domain with.

Both these commands worked so I joined the Windows domain.

At this stage I ran some test commands:

wbinfo --ping-dc - This came back positive as SUCCESS

wbinfo -g - This brings back a list of all domain groups on the domain controller
wbinfo -u - This brings back a list in unix of all the windows user names on the domain controller

Samba appears to be running ok however the folder I'm trying to share on AIX is still not visible when I try and access it via Windows \\unixserver\sharename . No errors it just isn't recognised by windows as a share.

I logged on a Windows machine to see if my Unix machine can be found in Active Directory. I found it listed under computers (its a member of one group - domain users)

I have 2 questions so far:

1) When configuring Kerberos all the guides refer to winbind settings in methods.cfg

There is a reference in this config file to WINBIND and DCE file locations:

WINBIND:
        program = /usr/lib/security/WINBIND
        program_64 = /usr/lib/security/WINBIND_64
DCE:
        program = /usr/lib/security/DCE

When I check my AIX system these files do not exist. I ran a find searching the whole system. /usr/lib/security exists but WINBIND , WINBIND_64 and DCE do not exist. The latest winbind packages have already been installed via yum so I'm on the latest version for AIX 7.1

In /opt/freeware/lib/security there are 2 files pam_winbind.so and pam_smbpass.so. I believe I may need to copy these to /usr/lib/security ?
The question is why dont I have WINBIND or WINBIND_64 on my system and how do I get hold of these? I presume I need methods.cfg to use these WINBIND library files in order for my fileshare to work?
I don't need to authenticate users to login to the unix shell. I just need a group of windows users (from one AD group) to access an AIX fileshare (without a requirement to enter a password) - authenticating using active directory account.

2) Currently I have joined the domain as a regular windows user. This allows me to interrogate Active Directory and list all users and groups. I presume to get this working correctly I will need to join the domain as a Windows user with a higher level of rights (perhaps domain administrator rights?). Can anyone tell me what group the Windows user should be a member of to get file sharing working so a specific AD group of Windows users can access a shared AIX folder authenticating with their windows password (no need to enter one)? I'm guessing my regular Windows user account won't give me what we need.

I've switched logging up to 3 for samba.log to try and give me an idea of why this is failing but if anyone has got this working appreciate any suggestions.

So current status is as follows:

kinit <username> - generated me a ticket using my regular Windows login
net ads join -U <username> - Successfully joined me to Windows domain using my regular windows account

wbinfo -g - Is working and brings back all windows AD groups
wbinfo -u - Is working and brings back all windows User accounts

Samba and Winbind are running however still can't find my AIX Samba share from Windows. As I said earlier in my methods.cfg file the reference to WINBIND file does not exist on my system (not sure if this is the cause)

SAMBA LOGS are showing an error "Server exit (NT_STATUS_CONNECTION_DISCONNECTED)". See logs below

[2019/10/17 06:53:28.159395,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)
[2019/10/17 06:53:41.229754,  3] ../../lib/util/access.c:365(allow_access)
  Allowed connection from x.x.x.x
[2019/10/17 06:53:41.230384,  3] ../../source3/smbd/oplock.c:1422(init_oplocks)
  init_oplocks: initializing messages.
[2019/10/17 06:53:41.230491,  3] ../../source3/smbd/process.c:1948(process_smb)
  Transaction 0 of length 73 (0 toread)
[2019/10/17 06:53:41.230550,  3] ../../source3/smbd/process.c:1541(switch_message)
  switch message SMBnegprot (pid 15597596) conn 0x0
[2019/10/17 06:53:41.230697,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [NT LM 0.12]
[2019/10/17 06:53:41.230744,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.002]
[2019/10/17 06:53:41.230781,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.???]
[2019/10/17 06:53:41.231453,  3] ../../source3/smbd/smb2_negprot.c:294(smbd_smb2_request_process_negprot)
  Selected protocol SMB2_FF
[2019/10/17 06:53:48.869858,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)
[2019/10/17 06:53:51.583732,  3] ../../lib/util/access.c:365(allow_access)
  Allowed connection from x.x.x.x
[2019/10/17 06:53:51.584379,  3] ../../source3/smbd/oplock.c:1422(init_oplocks)
  init_oplocks: initializing messages.
[2019/10/17 06:53:51.584486,  3] ../../source3/smbd/process.c:1948(process_smb)
  Transaction 0 of length 73 (0 toread)
[2019/10/17 06:53:51.584544,  3] ../../source3/smbd/process.c:1541(switch_message)
  switch message SMBnegprot (pid 31195310) conn 0x0
[2019/10/17 06:53:51.584692,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [NT LM 0.12]
[2019/10/17 06:53:51.584739,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.002]
[2019/10/17 06:53:51.584776,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.???]
[2019/10/17 06:53:51.585448,  3] ../../source3/smbd/smb2_negprot.c:294(smbd_smb2_request_process_negprot)
  Selected protocol SMB2_FF
[2019/10/17 06:53:54.243885,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_DISCONNECTED)

If I run this smbclient command on the AIX server I get this response:

AIXBOX:root >smbclient -L localhost -U%
protocol negotiation failed: NT_STATUS_IO_TIMEOUT

I can telnet to port 445 on the AIX box from a Windows machine so port is visible.

I am including all my config files below to see if anyone can help point me in the right direction. My feelings are this is something to do with krb5.conf and the WINBIND file that doesn't exist on my system perhaps?
Or is it because I'm joining the Windows Domain as a regular Windows user and not a Domain Admin account?

SAMBA.CONF

server string = "IBM AIX Server"
log file = /var/log/samba.log
passdb backend = tdbsam
idmap config * : backend = tdb
idmap config * : range   = 1000-9999
idmap config UTILITY :backend = ad
idmap config UTILITY:schema_mode = rfc2307
idmap config UTILITY:range = 10000-10099

log level = 3
netbios name = AIXBOX
workgroup = ROBOT
usershare allow guests = yes
domain master = no
local master = no
password server = *
realm = ROBOT.LOCAL
security = ADS
encrypt passwords = yes
template shell = /usr/bin/bash
interfaces = en0
winbind use default domain = yes
client use spnego = no
kerberos method = system keytab

[testshare]
path = /home/share
read only = No
writable = yes
guest ok = yes
public = yes
browseable = yes
valid users = @"domain computers"

[test]
path = /buuk
browseable = yes
valid users = my_windows_user_name

METHODS.CONF

WINBIND:
        program = /usr/lib/security/WINBIND          (DOES NOT EXIST ON MY AIX SYSTEM)

NIS:
        program = /usr/lib/security/NIS
        program_64 = /usr/lib/security/NIS_64

DCE:
        program = /usr/lib/security/DCE   (DOES NOT EXIST ON MY AIX SYSTEM)

KRB5A:
        program = /usr/lib/security/KRB5A
        options = authonly

KRB5files:
        options = db=BUILTIN,auth=KRB5A

KRB5.CONF

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = ROBOT.LOCAL
 default_keytab_name = FILE:/etc/krb5.keytab
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 ROBOT.LOCAL = {
  kdc = KDC.ROBOT.LOCAL
  default_domain = ROBOT.LOCAL
 }

UPDATE:

I've resolved the above issue after multiple changes to the samba config. In the end the issue was down to one entry in the smb.conf

kerberos method = system keytab

Solution - delete and it uses secret.

Now I've moved slightly further. I see the network share now. When I attempt to open the file share from windows checking samba.log I see these errors

[2019/10/17 09:08:43.441931,  3] ../../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
  get_user_from_kerberos_info: Username ROBOT\Joe.Bloggs is invalid on this system
[2019/10/17 09:08:43.441978,  3] ../../source3/auth/auth_generic.c:147(auth3_generate_session_info_pac)
  auth3_generate_session_info_pac: Failed to map kerberos principal to system user (NT_STATUS_LOGON_FAILURE)
[2019/10/17 09:08:43.442081,  3] ../../source3/smbd/smb2_server.c:3213(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../../source3/smbd/smb2_sesssetup.c:146
[2019/10/17 09:08:43.443099,  3] ../../source3/smbd/server_exit.c:236(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_RESET)

It's as if its expecting the windows username to exist on my AIX server. Do I need to manually add the user to my AIX box or is there a way to have AIX automatically log this user on regardless if they have an account on the AIX system. For example can I force them to logon as the oracle user?

UPDATE: I now finally have Samba Shares working on AIX 7.1.... However this was only after using a smbmap user list (To map individual Windows user to the root account on my AIX box)

For the Windows to Unix Mapping I added this to samba.conf

username map = /home/robot/smbmap

Inside smbmap we have this:

The root user is then defined in the file share in smb.conf as follows:

[shared]
path = /tmp
browseable = yes
read only = No
writable = yes
valid users = root
public = yes
force user = root
force group = system

Now when joe.bloggs opens the AIX file share from Windows he is mapped to the local root user and has access to the file share.

Now the only issue I have is that I don't want to have to add 10 + separate Windows users manually into the smbmap file. Currently I have tested with one account joe.bloggs.
Is there a way to configure samba so that if a Windows user is part of a specific windows group such as "domain admins" that they will automatically be mapped to the local AIX root user?

I'm sure there is an easier way than manually adding 10 + Windows AD usernames to the smbmap file manually.......

I also have an issue with wbinfo. I can run wbinfo -u and wbinfo -g commands fine and they return a list of all windows domain users and groups.
But if I try and query a list of users in a specific Windows group using wbinfo --group-info="domain users" this fails.

failed to call wbcGetgrnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for group domain users

according to the IBM developer forum, you need to do this:

1) /etc/netsvc.conf

passwd: files compat winbind
group: files compat winbind

2) /usr/lib/security/methods.cfg should have this entry.

WINBIND:
        program = /usr/lib/security/WINBIND
        options = authonly

/usr/lib/security/WINBIND should point to /opt/freeware/lib/WINBIND.so

# ls -l /usr/lib/security/WINBIND
lrwxrwxrwx 1 root system 28 Oct  9  2017 /usr/lib/security/WINBIND -> /opt/freeware/lib/WINBIND.so

3) Edit /etc/security/user to set the below things under "default"

SYSTEM = "WINBIND OR compat"
registry = WINBIND

I tried these settings and disabled username map = /home/robot/smbmap in smb.conf but still when I try and access the samba share from Windows it will not allow me access to the directory. Logs look quite clean but no access to any share. It seems to find my windows account in Kerberos, authenticates OK but for some reason doesn't give me access to the share

So I re-enabled the username map and found myself a workaround for the time being.

I am using ldapsearch command to query the Windows Active Directory to extract all users that are a member of a specific Windows AD group and then writing the output after reformatting into /home/robot/smbmap using awk to create the correctly formatted permission file. So it writes in around 50 user accounts who are allowed access into the file. This allows access to the AIX shares fine as all of these users are mapped to the AIX root user account. Ill set it as a cron job to run once a week or month.

But frustrating that I have to do it this way. Ill see if I can post on the IBM forum as well. Thanks