Allow AD group to access samba share












1














On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question
























  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27
















1














On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question
























  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27














1












1








1


1





On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question















On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory




samba ldap active-directory






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Dec 25 '18 at 13:27

























asked Dec 19 '18 at 9:51









Wernfried Domscheit

1063




1063












  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27


















  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27
















Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
– telcoM
Dec 20 '18 at 12:40




Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
– telcoM
Dec 20 '18 at 12:40












Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
– telcoM
Dec 20 '18 at 12:44




Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
– telcoM
Dec 20 '18 at 12:44












What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
– roaima
Dec 21 '18 at 22:19




What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
– roaima
Dec 21 '18 at 22:19












If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
– roaima
Dec 21 '18 at 22:31




If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
– roaima
Dec 21 '18 at 22:31












@roaima, please see my update.
– Wernfried Domscheit
Dec 25 '18 at 13:27




@roaima, please see my update.
– Wernfried Domscheit
Dec 25 '18 at 13:27










2 Answers
2






active

oldest

votes


















1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07



















0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489869%2fallow-ad-group-to-access-samba-share%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes









1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07
















1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07














1












1








1






Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer












Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.







share|improve this answer












share|improve this answer



share|improve this answer










answered Dec 25 '18 at 17:07









roaima

42.8k551116




42.8k551116












  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07


















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07
















Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
– Wernfried Domscheit
Dec 25 '18 at 18:40




Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
– Wernfried Domscheit
Dec 25 '18 at 18:40












Sure. But not on Christmas Day :-)
– roaima
Dec 25 '18 at 20:40




Sure. But not on Christmas Day :-)
– roaima
Dec 25 '18 at 20:40












I am not in the office either. Maybe a link or a description next year would be great.
– Wernfried Domscheit
Dec 25 '18 at 22:07




I am not in the office either. Maybe a link or a description next year would be great.
– Wernfried Domscheit
Dec 25 '18 at 22:07













0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago
















0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago














0












0








0






Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer












Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.







share|improve this answer












share|improve this answer



share|improve this answer










answered 2 days ago









chris

53011017




53011017












  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago


















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago
















I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
– Wernfried Domscheit
2 days ago




I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
– Wernfried Domscheit
2 days ago


















draft saved

draft discarded




















































Thanks for contributing an answer to Unix & Linux Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489869%2fallow-ad-group-to-access-samba-share%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

List directoties down one level, excluding some named directories and files

Image
1 I want to send a list of all folders including one level down to a txt file. Excluding some named folders and no files. Imagine a folder structure like this. CAPS are folders. FOLDER 1 .hidden TEMP somefile ========= ========= FOLDER 2 .hidden TEMP DATA1 DATA2 somefile ======== ======== FOLDER 3 .hidden TEMP DATA1 somefile I would like to run "insert magic command here" and end up with an output that looks like below FOLDER 1 FOLDER 2 DATA1 DATA2 FOLDER 3 DATA1 bash shell-script share | improve this question edited Dec 16 at 4:15 Rui F Ribeiro ...
Read more

Województwo

Image
Podział administracyjny Polski (stan na 1 stycznia 2010) Województwo – jednostka podziału administracyjnego najwyższego stopnia w Polsce, od 1990 r. jednostka zasadniczego podziału terytorialnego administracji rządowej, od 1999 r. także jednostka samorządu terytorialnego. Podział kraju na województwa ma swoje korzenie w okresie rozbicia dzielnicowego, stąd ich zróżnicowanie pod względem wielkości w czasach Rzeczypospolitej. Pierwsze województwa powstawały na przełomie XIV i XV w. Pierwotnie były to samodzielne zgromadzenia wojskowe na określonych terenach Polski, którymi zarządzali wyznaczani przez władcę wojewodowie – od: wodzić woje. Status województwa reguluje w Polsce ustawa o samorządzie województwa z dnia 5 czerwca 1998 r. [1] Spis treści 1 Liczba województw 2 Stan aktualny – 16 województw 2.1 Podział na województwa od 1999 r. 3 Województwa w przeszłości 3.1 Pierwsze województwa w Polsce 3.2 Województwa w okresie I Rzeczypospolitej 3....
Read more

What dialect is “You wants I should do it for ya?”

Image
0 I heard this phrasing in an episode of a TV show, but I can't remember what for the life of me. I just remember how weird it sounded, because no one else talked like that in the series? It was a white character in a rural setting, if that helps. A criminal henchman. Is there an area or something where "You wants I..." is commonplace? slang dialects share | improve this question asked 12 hours ago Patroclus 21 2 2 ...
Read more