Allow AD group to access samba share












1














On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question
























  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27
















1














On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question
























  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27














1












1








1


1





On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory







share|improve this question















On my Linux I created a samba share like this, it was working fine.



[global]

    security = user

    passdb backend = tdbsam

    map to guest = Bad User

    guest account = mcms



[mml-t1]

    path = /var/lib/mcms/exports/TPMD01/mml

    writable = no

    guest ok = yes

    guest only = yes


Now, with new Windows 10 users get an error due to stricter security policies:




You can't access this shared folder because your organization's
security policies block unauthenticated guest access. These policies
help protect your PC from unsafe or malicious devices on the network.




I like to permit users based on groups in our Active Directory. I tried this one:



[mml-t1]

        path = /var/lib/mcms/exports/TPMD01/mml

        valid users = @T_UNIX_MCMS

        force user = mcms

        browseable = yes

        read only = yes

        guest ok = no


But it is not working, i.e. no connection. I also tried valid users = +"DOMAINT_UNIX_MCMS"



I need to configure the share properly.



Important note, the Linux server is already linked to our AD. On the Linux server I can use for example su - domscheit with my Windows AD credentials and I get a home directory /home/domscheit owned by domscheit "domain users". (but there is no local user domscheit according to etc/passwd) User mcms is a local user with write/read permissions on /var/lib/mcms/exports/TPMD01/mml



I am running Samba version 4.7.1



Update



Here is my log:



[2018/12/25 14:06:00.652804,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.652872,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend guest

[2018/12/25 14:06:00.652887,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'guest'

[2018/12/25 14:06:00.652923,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam

[2018/12/25 14:06:00.652934,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam'

[2018/12/25 14:06:00.653067,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_ignoredomain

[2018/12/25 14:06:00.653125,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_ignoredomain'

[2018/12/25 14:06:00.653258,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend sam_netlogon3

[2018/12/25 14:06:00.653317,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'sam_netlogon3'

[2018/12/25 14:06:00.653330,  5] ../source3/auth/auth.c:48(smb_register_auth)

  Attempting to register auth backend winbind

[2018/12/25 14:06:00.653402,  5] ../source3/auth/auth.c:60(smb_register_auth)

  Successfully added auth method 'winbind'

[2018/12/25 14:06:00.653453,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.653504,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.653577,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.653659,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.654557,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_spnego' registered

[2018/12/25 14:06:00.654625,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5' registered

[2018/12/25 14:06:00.654683,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'gssapi_krb5_sasl' registered

[2018/12/25 14:06:00.654736,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'spnego' registered

[2018/12/25 14:06:00.654795,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'schannel' registered

[2018/12/25 14:06:00.654869,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'naclrpc_as_system' registered

[2018/12/25 14:06:00.654921,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'sasl-EXTERNAL' registered

[2018/12/25 14:06:00.654973,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp' registered

[2018/12/25 14:06:00.655023,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'ntlmssp_resume_ccache' registered

[2018/12/25 14:06:00.655074,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_basic' registered

[2018/12/25 14:06:00.655126,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_ntlm' registered

[2018/12/25 14:06:00.655176,  3] ../auth/gensec/gensec_start.c:977(gensec_register)

  GENSEC backend 'http_negotiate' registered

[2018/12/25 14:06:00.655292,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.655378,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682627,  5] ../source3/auth/auth.c:524(make_auth3_context_for_ntlm)

  Making default auth method list for server role = 'standalone server', encrypt passwords = yes

[2018/12/25 14:06:00.682682,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match guest

[2018/12/25 14:06:00.682697,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method guest has a valid init

[2018/12/25 14:06:00.682734,  5] ../source3/auth/auth.c:400(load_auth_module)

  load_auth_module: Attempting to find an auth method to match sam_ignoredomain

[2018/12/25 14:06:00.682760,  5] ../source3/auth/auth.c:425(load_auth_module)

  load_auth_module: auth method sam_ignoredomain has a valid init

[2018/12/25 14:06:00.682863,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC mechanism spnego

[2018/12/25 14:06:00.682953,  5] ../auth/gensec/gensec_start.c:739(gensec_start_mech)

  Starting GENSEC submechanism ntlmssp

[2018/12/25 14:06:00.682990,  3] ../auth/ntlmssp/ntlmssp_util.c:72(debug_ntlmssp_flags)

  Got NTLMSSP neg_flags=0xe2088297

    NTLMSSP_NEGOTIATE_UNICODE

    NTLMSSP_NEGOTIATE_OEM

    NTLMSSP_REQUEST_TARGET

    NTLMSSP_NEGOTIATE_SIGN

    NTLMSSP_NEGOTIATE_LM_KEY

    NTLMSSP_NEGOTIATE_NTLM

    NTLMSSP_NEGOTIATE_ALWAYS_SIGN

    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

    NTLMSSP_NEGOTIATE_VERSION

    NTLMSSP_NEGOTIATE_128

    NTLMSSP_NEGOTIATE_KEY_EXCH

    NTLMSSP_NEGOTIATE_56

[2018/12/25 14:06:00.705494,  3] ../auth/ntlmssp/ntlmssp_server.c:552(ntlmssp_server_preauth)

  Got user=[domscheit] domain=[SWI] workstation=[CWP1101] len1=24 len2=326

[2018/12/25 14:06:00.705925,  5] ../source3/auth/auth_util.c:122(make_user_info_map)

  Mapping user [SWI][domscheit] from workstation [CWP1101]

[2018/12/25 14:06:00.705951,  5] ../source3/auth/user_info.c:64(make_user_info)

  attempting to make a user_info for domscheit (domscheit)

[2018/12/25 14:06:00.705965,  5] ../source3/auth/user_info.c:72(make_user_info)

  making strings for domscheit's user_info struct

[2018/12/25 14:06:00.705988,  5] ../source3/auth/user_info.c:125(make_user_info)

  making blobs for domscheit's user_info struct

[2018/12/25 14:06:00.706006,  3] ../source3/auth/auth.c:189(auth_check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [SWI][domscheit]@[CWP1101] with the new password interface

[2018/12/25 14:06:00.706019,  3] ../source3/auth/auth.c:192(auth_check_ntlm_password)

  check_ntlm_password:  mapped user is: [SWI][domscheit]@[CWP1101]

[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

  check_sam_security: Couldn't find user 'domscheit' in passdb.

[2018/12/25 14:06:00.706093,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)

  auth_check_ntlm_password: sam_ignoredomain authentication for user [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706115,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)

  check_ntlm_password:  Authentication for user [domscheit] -> [domscheit] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1

[2018/12/25 14:06:00.706128,  3] ../source3/auth/auth_util.c:2214(do_map_to_guest_server_info)

  No such user domscheit [SWI] - using guest account

[2018/12/25 14:06:00.706186,  5] ../auth/ntlmssp/ntlmssp_server.c:1011(ntlmssp_server_postauth)

  server session key is invalid (len == 0), cannot do KEY_EXCH!

[2018/12/25 14:06:00.728317,  1] ../source3/smbd/service.c:521(make_connection_snum)

  create_connection_session_info failed: NT_STATUS_ACCESS_DENIED


Instead of using a group name I tried for testing with my personal account valid users = SWI\domscheit (and some more variants). However always the same error.



getent group T_UNIX_MCMS and getent passwd domscheit all return valid entries.






samba ldap active-directory




samba ldap active-directory






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Dec 25 '18 at 13:27

























asked Dec 19 '18 at 9:51









Wernfried Domscheit

1063




1063












  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27


















  • Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
    – telcoM
    Dec 20 '18 at 12:40










  • Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
    – telcoM
    Dec 20 '18 at 12:44










  • What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
    – roaima
    Dec 21 '18 at 22:19










  • If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
    – roaima
    Dec 21 '18 at 22:31










  • @roaima, please see my update.
    – Wernfried Domscheit
    Dec 25 '18 at 13:27
















Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
– telcoM
Dec 20 '18 at 12:40




Unix/Linux is generally case sensitive in various things Windows isn't. The group of your home directory suggests the AD groups are presented in lower case on your Linux system. In Linux, it would be entirely possible to have two separate user groups named T_UNIX_MCMS and t_unix_mcms, so Samba cannot just fold the character case by default. Try commands getent group T_UNIX_MCMS and getent group t_unix_mcms: if one of the commands produces non-empty output, that indicates the right way to specify the group name.
– telcoM
Dec 20 '18 at 12:40












Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
– telcoM
Dec 20 '18 at 12:44




Also verify the domain name separator character (winbind separator if you're using winbind): since the backslash often has special meaning as an escape character in Unix/Linux, a Windows-style domain-qualified name would need to be written as DOMAIN\T_UNIX_MCMS, even in double quotes. As a result, some admins prefer using another character, e.g. + as the separator in domain-qualified user/group names.
– telcoM
Dec 20 '18 at 12:44












What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
– roaima
Dec 21 '18 at 22:19




What do the Samba logs give for a failure reason? On a Debian system they would typically live under /var/log/samba. If there's nothing exciting set log level = 3 in your smb.conf and restart Samba. Then try connecting again.
– roaima
Dec 21 '18 at 22:19












If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
– roaima
Dec 21 '18 at 22:31




If you're no longer allowing guest access, the map to guest = bad user entry is irrelevant, and you should remove it and guest account = mcms. Please let me know if that changes anything usefully.
– roaima
Dec 21 '18 at 22:31












@roaima, please see my update.
– Wernfried Domscheit
Dec 25 '18 at 13:27




@roaima, please see my update.
– Wernfried Domscheit
Dec 25 '18 at 13:27










2 Answers
2






active

oldest

votes


















1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07



















0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489869%2fallow-ad-group-to-access-samba-share%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes









1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07
















1














Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer





















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07














1












1








1






Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.






share|improve this answer












Here you go.




[2018/12/25 14:06:00.706077,  3] ../source3/auth/check_samsec.c:399(check_sam_security)

check_sam_security: Couldn't find user 'domscheit' in passdb.



What this is telling you is that Samba's password database doesn't know about your user account. The reason is your security = user coupled with passdb backend = tdbsam (the local Sanba user database, similar to but independent of /etc/passwd). Since your machine is already joined to the AD domain you should set Samba up to recognise that and use it to your advantage.







share|improve this answer












share|improve this answer



share|improve this answer










answered Dec 25 '18 at 17:07









roaima

42.8k551116




42.8k551116












  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07


















  • Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
    – Wernfried Domscheit
    Dec 25 '18 at 18:40










  • Sure. But not on Christmas Day :-)
    – roaima
    Dec 25 '18 at 20:40










  • I am not in the office either. Maybe a link or a description next year would be great.
    – Wernfried Domscheit
    Dec 25 '18 at 22:07
















Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
– Wernfried Domscheit
Dec 25 '18 at 18:40




Yes, I was expecting something like this. However, do you have a guideline for "set Samba up to recognize that" - I did not manage to find a proper one.
– Wernfried Domscheit
Dec 25 '18 at 18:40












Sure. But not on Christmas Day :-)
– roaima
Dec 25 '18 at 20:40




Sure. But not on Christmas Day :-)
– roaima
Dec 25 '18 at 20:40












I am not in the office either. Maybe a link or a description next year would be great.
– Wernfried Domscheit
Dec 25 '18 at 22:07




I am not in the office either. Maybe a link or a description next year would be great.
– Wernfried Domscheit
Dec 25 '18 at 22:07













0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago
















0














Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer





















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago














0












0








0






Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.






share|improve this answer












Have a look at:



https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member



30 character minimum.







share|improve this answer












share|improve this answer



share|improve this answer










answered 2 days ago









chris

53011017




53011017












  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago


















  • I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
    – Wernfried Domscheit
    2 days ago
















I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
– Wernfried Domscheit
2 days ago




I found this side but I did not manage it to make it working. Some parts are already done on the serer (e.g. Kerberos setup) but there are too many items where I am not familiar with.
– Wernfried Domscheit
2 days ago


















draft saved

draft discarded




















































Thanks for contributing an answer to Unix & Linux Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489869%2fallow-ad-group-to-access-samba-share%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

Morgemoulin

Image
Morgemoulin — miejscowość i gmina — Państwo   Francja Region Grand Est Departament Moza Okręg Verdun Kod INSEE 55357 Powierzchnia 6,82 km² Populacja  (1990) • liczba ludności 75 • gęstość 11 os./km² Kod pocztowy 55400 Położenie na mapie Francji Morgemoulin 49°14′N   5°35′E / 49,233333   5,583333 Portal Francja Morgemoulin – miejscowość i gmina we Francji, w regionie Grand Est, w departamencie Moza. Według danych na rok 1990 gminę zamieszkiwało 75 osób, a gęstość zaludnienia wynosiła 11 osób/km² (wśród 2335 gmin Lotaryngii Morgemoulin plasuje się na 970. miejscu pod względem liczby ludności, natomiast pod względem powierzchni na miejscu 848.). Bibliografia | Francuski urząd statystyczny ( fr. ) . p   •   d   •   e Gminy okręgu Verdun Abaucourt-Hautecourt • Aincreville • Ambly-sur-Meuse • Amel-sur-l'Étang • Ancemont • Arrancy-sur-Crusne • Aubréville • Autré...
Read more

Scott Moir

Image
Scott Moir Tessa Virtue i Scott Moir w 2016 r. Reprezentacja   Kanada Data i miejsce urodzenia 2 września 1987 London Wzrost 180 cm Konkurencja Pary taneczne Partner sportowy Tessa Virtue Trener Marie-France Dubreuil, Patrice Lauzon, Romain Haguenauer Poprzednio: Marina Zujewa, Oleg Epstein, Igor Szpilband, Johnny Johns, Carol Moir, Paul MacIntosh, Suzanne Killing Klub Montreal International School of Skating Poprzednio: Arctic Edge FSC Ilderton Skating Club Lokalizacja treningowa Montreal Poprzednio: Canton Kitchener Rekordy życiowe ISU przed sezonem 2018/2019 Nota łączna 206,07 Igrzyska Olimpijskie 2018 Taniec krótki 83,67 Igrzyska Olimpijskie 2018 Taniec dowolny 122,40 Igrzyska Olimpijskie 2018 Dorobek medalowy Reprezentacja   Kanada Igrzyska olimpijskie Złoto Vancouver 2010 pary taneczne Złoto Pjongczang 2018 pary taneczne Złoto Pjongczang 2018 drużynowo Srebro S...
Read more

Souastre

Image
Souastre — miejscowość i gmina — Herb Państwo   Francja Region Hauts-de-France Departament Pas-de-Calais Okręg Arras Kod INSEE 62800 Powierzchnia 7,18 km² Populacja  (1990) • liczba ludności 352 • gęstość 49 os./km² Kod pocztowy 62111 Położenie na mapie Francji Souastre 50°09′N   2°34′E / 50,150000   2,566667 Portal Francja Souastre – miejscowość i gmina we Francji, w regionie Hauts-de-France, w departamencie Pas-de-Calais. Według danych na rok 1990 gminę zamieszkiwały 352 osoby, a gęstość zaludnienia wynosiła 49 osób/km² (wśród 1549 gmin regionu Nord-Pas-de-Calais Souastre plasuje się na 887. miejscu pod względem liczby ludności, natomiast pod względem powierzchni na miejscu 507.). Bibliografia | Francuski urząd statystyczny ( fr. ) . p   •   d   •   e Gminy okręgu Arras Ablain-Saint-Nazaire Ablainzevelle Acheville Achicourt Achiet-le-Grand Achiet-le-Pe...
Read more