1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�22.�Winbind: Use of Domain Accounts</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.66.1"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="prev" href="VFS.html" title="Chapter�21.�Stackable VFS modules"><link rel="next" href="AdvancedNetworkManagement.html" title="Chapter�23.�Advanced Network Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�22.�Winbind: Use of Domain Accounts</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="VFS.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="AdvancedNetworkManagement.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="winbind"></a>Chapter�22.�Winbind: Use of Domain Accounts</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Tim</span> <span class="surname">Potter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tpot@linuxcare.com.au">tpot@linuxcare.com.au</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Naag</span> <span class="surname">Mummaneni</span></h3><span class="contrib">Notes for Solaris</span><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:getnag@rediffmail.com">getnag@rediffmail.com</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="surname">Trostel</span></h3><div class="affiliation"><span class="orgname">SNAP<br></span><div class="address"><p><tt class="email"><<a href="mailto:jtrostel@snapserver.com">jtrostel@snapserver.com</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">27 June 2002</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="winbind.html#id2595681">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2595847">Introduction</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2595908">What Winbind Provides</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2595975">Target Uses</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2596001">How Winbind Works</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2596025">Microsoft Remote Procedure Calls</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596054">Microsoft Active Directory Services</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596077">Name Service Switch</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596194">Pluggable Authentication Modules</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596264">User and Group ID Allocation</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596293">Result Caching</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2596336">Installation and Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2596342">Introduction</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596395">Requirements</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2596465">Testing Things Out</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2598043">Conclusion</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2598058">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2598102">NSCD Problem Warning</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2598142">Winbind Is Not Resolving Users and Groups</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2595681"></a>Features and Benefits</h2></div></div></div><p> 2 Integration of UNIX and Microsoft Windows NT through a unified logon has 3 been considered a “<span class="quote"><span class="emphasis"><em>holy grail</em></span></span>” in heterogeneous computing environments for 4 a long time. 5 </p><p> 6 There is one other facility without which UNIX and Microsoft Windows network 7 interoperability would suffer greatly. It is imperative that there be a 8 mechanism for sharing files across UNIX systems and to be able to assign 9 domain user and group ownerships with integrity. 10 </p><p> 11 <span class="emphasis"><em>winbind</em></span> is a component of the Samba suite of programs that 12 solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft 13 RPC calls, Pluggable Authentication Modules, and the Name Service Switch to 14 allow Windows NT domain users to appear and operate as UNIX users on a UNIX 15 machine. This chapter describes the Winbind system, explaining the functionality 16 it provides, how it is configured, and how it works internally. 17 </p><p> 18 Winbind provides three separate functions: 19 </p><div class="itemizedlist"><ul type="disc"><li><p> 20 Authentication of user credentials (via PAM). 21 </p></li><li><p> 22 Identity resolution (via NSS). 23 </p></li><li><p> 24 Winbind maintains a database called winbind_idmap.tdb in which it stores 25 mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only 26 for users and groups that do not have a local UID/GID. It stored the UID/GID 27 allocated from the idmap uid/gid range that it has mapped to the NT SID. 28 If <i class="parameter"><tt>idmap backend</tt></i> has been specified as ldapsam:url 29 then instead of using a local mapping Winbind will obtain this information 30 from the LDAP database. 31 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 32 <a class="indexterm" name="id2595759"></a> 33 <a class="indexterm" name="id2595766"></a> 34 If <span><b class="command">winbindd</b></span> is not running, smbd (which calls <span><b class="command">winbindd</b></span>) will fall back to 35 using purely local information from <tt class="filename">/etc/passwd</tt> and <tt class="filename">/etc/group</tt> and no dynamic 36 mapping will be used. 37 </p></div><div class="figure"><a name="winbind_idmap"></a><p class="title"><b>Figure�22.1.�Winbind Idmap</b></p><div class="mediaobject"><img src="images/idmap_winbind_no_loop.png" width="270" alt="Winbind Idmap"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2595847"></a>Introduction</h2></div></div></div><p>It is well known that UNIX and Microsoft Windows NT have 38 different models for representing user and group information and 39 use different technologies for implementing them. This fact has 40 made it difficult to integrate the two systems in a satisfactory 41 manner.</p><p>One common solution in use today has been to create 42 identically named user accounts on both the UNIX and Windows systems 43 and use the Samba suite of programs to provide file and print services 44 between the two. This solution is far from perfect, however, as 45 adding and deleting users on both sets of machines becomes a chore 46 and two sets of passwords are required both of which 47 can lead to synchronization problems between the UNIX and Windows 48 systems and confusion for users.</p><p>We divide the unified logon problem for UNIX machines into 49 three smaller problems:</p><div class="itemizedlist"><ul type="disc"><li><p>Obtaining Windows NT user and group information. 50 </p></li><li><p>Authenticating Windows NT users. 51 </p></li><li><p>Password changing for Windows NT users. 52 </p></li></ul></div><p>Ideally, a prospective solution to the unified logon problem 53 would satisfy all the above components without duplication of 54 information on the UNIX machines and without creating additional 55 tasks for the system administrator when maintaining users and 56 groups on either system. The Winbind system provides a simple 57 and elegant solution to all three components of the unified logon 58 problem.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2595908"></a>What Winbind Provides</h2></div></div></div><p>Winbind unifies UNIX and Windows NT account management by 59 allowing a UNIX box to become a full member of an NT domain. Once 60 this is done the UNIX box will see NT users and groups as if 61 they were “<span class="quote"><span class="emphasis"><em>native</em></span></span>” UNIX users and groups, allowing the NT domain 62 to be used in much the same manner that NIS+ is used within 63 UNIX-only environments.</p><p>The end result is that whenever any 64 program on the UNIX machine asks the operating system to lookup 65 a user or group name, the query will be resolved by asking the 66 NT Domain Controller for the specified domain to do the lookup. 67 Because Winbind hooks into the operating system at a low level 68 (via the NSS name resolution modules in the C library), this 69 redirection to the NT Domain Controller is completely 70 transparent.</p><p>Users on the UNIX machine can then use NT user and group 71 names as they would “<span class="quote"><span class="emphasis"><em>native</em></span></span>” UNIX names. They can chown files 72 so they are owned by NT domain users or even login to the 73 UNIX machine and run a UNIX X-Window session as a domain user.</p><p>The only obvious indication that Winbind is being used is 74 that user and group names take the form <tt class="constant">DOMAIN\user</tt> and 75 <tt class="constant">DOMAIN\group</tt>. This is necessary as it allows Winbind to determine 76 that redirection to a Domain Controller is wanted for a particular 77 lookup and which trusted domain is being referenced.</p><p>Additionally, Winbind provides an authentication service 78 that hooks into the Pluggable Authentication Modules (PAM) system 79 to provide authentication via an NT domain to any PAM-enabled 80 applications. This capability solves the problem of synchronizing 81 passwords between systems since all passwords are stored in a single 82 location (on the Domain Controller).</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2595975"></a>Target Uses</h3></div></div></div><p>Winbind is targeted at organizations that have an 83 existing NT-based domain infrastructure into which they wish 84 to put UNIX workstations or servers. Winbind will allow these 85 organizations to deploy UNIX workstations without having to 86 maintain a separate account infrastructure. This greatly 87 simplifies the administrative overhead of deploying UNIX 88 workstations into an NT-based organization.</p><p>Another interesting way in which we expect Winbind to 89 be used is as a central part of UNIX-based appliances. Appliances 90 that provide file and print services to Microsoft-based networks 91 will be able to use Winbind to provide seamless integration of 92 the appliance into the domain.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2596001"></a>How Winbind Works</h2></div></div></div><p>The Winbind system is designed around a client/server 93 architecture. A long running <span><b class="command">winbindd</b></span> daemon 94 listens on a UNIX domain socket waiting for requests 95 to arrive. These requests are generated by the NSS and PAM 96 clients and is processed sequentially.</p><p>The technologies used to implement Winbind are described 97 in detail below.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596025"></a>Microsoft Remote Procedure Calls</h3></div></div></div><p>Over the last few years, efforts have been underway 98 by various Samba Team members to decode various aspects of 99 the Microsoft Remote Procedure Call (MSRPC) system. This 100 system is used for most network-related operations between 101 Windows NT machines including remote management, user authentication 102 and print spooling. Although initially this work was done 103 to aid the implementation of Primary Domain Controller (PDC) 104 functionality in Samba, it has also yielded a body of code that 105 can be used for other purposes.</p><p>Winbind uses various MSRPC calls to enumerate domain users 106 and groups and to obtain detailed information about individual 107 users or groups. Other MSRPC calls can be used to authenticate 108 NT domain users and to change user passwords. By directly querying 109 a Windows PDC for user and group information, Winbind maps the 110 NT account information onto UNIX user and group names.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596054"></a>Microsoft Active Directory Services</h3></div></div></div><p> 111 Since late 2001, Samba has gained the ability to 112 interact with Microsoft Windows 2000 using its “<span class="quote"><span class="emphasis"><em>Native 113 Mode</em></span></span>” protocols, rather than the NT4 RPC services. 114 Using LDAP and Kerberos, a Domain Member running 115 Winbind can enumerate users and groups in exactly the 116 same way as a Windows 200x client would, and in so doing 117 provide a much more efficient and effective Winbind implementation. 118 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596077"></a>Name Service Switch</h3></div></div></div><p>The Name Service Switch, or NSS, is a feature that is 119 present in many UNIX operating systems. It allows system 120 information such as hostnames, mail aliases and user information 121 to be resolved from different sources. For example, a standalone 122 UNIX workstation may resolve system information from a series of 123 flat files stored on the local filesystem. A networked workstation 124 may first attempt to resolve system information from local files, 125 and then consult an NIS database for user information or a DNS server 126 for hostname information.</p><p>The NSS application programming interface allows Winbind 127 to present itself as a source of system information when 128 resolving UNIX usernames and groups. Winbind uses this interface, 129 and information obtained from a Windows NT server using MSRPC 130 calls to provide a new source of account enumeration. Using standard 131 UNIX library calls, one can enumerate the users and groups on 132 a UNIX machine running Winbind and see all users and groups in 133 a NT domain plus any trusted domain as though they were local 134 users and groups.</p><p>The primary control file for NSS is 135 <tt class="filename">/etc/nsswitch.conf</tt>. 136 When a UNIX application makes a request to do a lookup, 137 the C library looks in <tt class="filename">/etc/nsswitch.conf</tt> 138 for a line that matches the service type being requested, for 139 example the “<span class="quote"><span class="emphasis"><em>passwd</em></span></span>” service type is used when user or group names 140 are looked up. This config line specifies which implementations 141 of that service should be tried and in what order. If the passwd 142 config line is:</p><pre class="screen"> 143 passwd: files example 144 </pre><p>then the C library will first load a module called 145 <tt class="filename">/lib/libnss_files.so</tt> followed by 146 the module <tt class="filename">/lib/libnss_example.so</tt>. The 147 C library will dynamically load each of these modules in turn 148 and call resolver functions within the modules to try to resolve 149 the request. Once the request is resolved, the C library returns the 150 result to the application.</p><p>This NSS interface provides an easy way for Winbind 151 to hook into the operating system. All that needs to be done 152 is to put <tt class="filename">libnss_winbind.so</tt> in <tt class="filename">/lib/</tt> 153 then add “<span class="quote"><span class="emphasis"><em>winbind</em></span></span>” into <tt class="filename">/etc/nsswitch.conf</tt> at 154 the appropriate place. The C library will then call Winbind to 155 resolve user and group names.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596194"></a>Pluggable Authentication Modules</h3></div></div></div><p>Pluggable Authentication Modules, also known as PAM, 156 is a system for abstracting authentication and authorization 157 technologies. With a PAM module it is possible to specify different 158 authentication methods for different system applications without 159 having to recompile these applications. PAM is also useful 160 for implementing a particular policy for authorization. For example, 161 a system administrator may only allow console logins from users 162 stored in the local password file but only allow users resolved from 163 a NIS database to log in over the network.</p><p>Winbind uses the authentication management and password 164 management PAM interface to integrate Windows NT users into a 165 UNIX system. This allows Windows NT users to log in to a UNIX 166 machine and be authenticated against a suitable Primary Domain 167 Controller. These users can also change their passwords and have 168 this change take effect directly on the Primary Domain Controller. 169 </p><p>PAM is configured by providing control files in the directory 170 <tt class="filename">/etc/pam.d/</tt> for each of the services that 171 require authentication. When an authentication request is made 172 by an application, the PAM code in the C library looks up this 173 control file to determine what modules to load to do the 174 authentication check and in what order. This interface makes adding 175 a new authentication service for Winbind very easy. All that needs 176 to be done is that the <tt class="filename">pam_winbind.so</tt> module 177 is copied to <tt class="filename">/lib/security/</tt> and the PAM 178 control files for relevant services are updated to allow 179 authentication via Winbind. See the PAM documentation 180 in <a href="pam.html" title="Chapter�26.�PAM-Based Distributed Authentication">PAM-Based Distributed Authentication</a> for more information.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596264"></a>User and Group ID Allocation</h3></div></div></div><p>When a user or group is created under Windows NT/200x 181 it is allocated a numerical relative identifier (RID). This is 182 slightly different from UNIX which has a range of numbers that are 183 used to identify users, and the same range in which to identify 184 groups. It is Winbind's job to convert RIDs to UNIX ID numbers and 185 vice versa. When Winbind is configured, it is given part of the UNIX 186 user ID space and a part of the UNIX group ID space in which to 187 store Windows NT users and groups. If a Windows NT user is 188 resolved for the first time, it is allocated the next UNIX ID from 189 the range. The same process applies for Windows NT groups. Over 190 time, Winbind will have mapped all Windows NT users and groups 191 to UNIX user IDs and group IDs.</p><p>The results of this mapping are stored persistently in 192 an ID mapping database held in a tdb database). This ensures that 193 RIDs are mapped to UNIX IDs in a consistent way.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596293"></a>Result Caching</h3></div></div></div><p> 194<a class="indexterm" name="id2596301"></a> 195 An active system can generate a lot of user and group 196 name lookups. To reduce the network cost of these lookups, Winbind 197 uses a caching scheme based on the SAM sequence number supplied 198 by NT Domain Controllers. User or group information returned 199 by a PDC is cached by Winbind along with a sequence number also 200 returned by the PDC. This sequence number is incremented by 201 Windows NT whenever any user or group information is modified. If 202 a cached entry has expired, the sequence number is requested from 203 the PDC and compared against the sequence number of the cached entry. 204 If the sequence numbers do not match, then the cached information 205 is discarded and up-to-date information is requested directly 206 from the PDC.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2596336"></a>Installation and Configuration</h2></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596342"></a>Introduction</h3></div></div></div><p> 207This section describes the procedures used to get Winbind up and 208running. Winbind is capable of providing access 209and authentication control for Windows Domain users through an NT 210or Windows 200x PDC for regular services, such as telnet and ftp, as 211well for Samba services. 212</p><div class="itemizedlist"><ul type="disc"><li><p> 213 <span class="emphasis"><em>Why should I do this?</em></span> 214 </p><p>This allows the Samba administrator to rely on the 215 authentication mechanisms on the Windows NT/200x PDC for the authentication 216 of Domain Members. Windows NT/200x users no longer need to have separate 217 accounts on the Samba server. 218 </p></li><li><p> 219 <span class="emphasis"><em>Who should be reading this document?</em></span> 220 </p><p> 221 This document is designed for system administrators. If you are 222 implementing Samba on a file server and wish to (fairly easily) 223 integrate existing Windows NT/200x users from your PDC onto the 224 Samba server, this document is for you. 225 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596395"></a>Requirements</h3></div></div></div><p> 226If you have a Samba configuration file that you are currently using, <span class="emphasis"><em>BACK IT UP!</em></span> 227If your system already uses PAM, <span class="emphasis"><em>back up the <tt class="filename">/etc/pam.d</tt> directory 228contents!</em></span> If you haven't already made a boot disk, <span class="emphasis"><em>MAKE ONE NOW!</em></span> 229</p><p> 230Messing with the PAM configuration files can make it nearly impossible to log in to your machine. That's 231why you want to be able to boot back into your machine in single user mode and restore your 232<tt class="filename">/etc/pam.d</tt> back to the original state they were in if you get frustrated with the 233way things are going. 234</p><p> 235The latest version of Samba-3 includes a functioning winbindd daemon. Please refer to the <a href="http://samba.org/" target="_top">main Samba Web page</a> or, better yet, your closest Samba mirror site for 236instructions on downloading the source code. 237</p><p> 238To allow domain users the ability to access Samba shares and files, as well as potentially other services 239provided by your Samba machine, PAM must be set up properly on your 240machine. In order to compile the Winbind modules, you should have at least the PAM development libraries installed 241on your system. Please refer the PAM web site <a href="http://www.kernel.org/pub/linux/libs/pam/" target="_top">http://www.kernel.org/pub/linux/libs/pam/</a>. 242</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596465"></a>Testing Things Out</h3></div></div></div><p> 243Before starting, it is probably best to kill off all the Samba-related daemons running on your server. 244Kill off all <span class="application">smbd</span>, <span class="application">nmbd</span>, and <span class="application">winbindd</span> processes that may be running. To use PAM, 245make sure that you have the standard PAM package that supplies the <tt class="filename">/etc/pam.d</tt> 246directory structure, including the PAM modules that are used by PAM-aware services, several pam libraries, 247and the <tt class="filename">/usr/doc</tt> and <tt class="filename">/usr/man</tt> entries for pam. Winbind built 248better in Samba if the pam-devel package is also installed. This package includes the header files 249needed to compile PAM-aware applications. 250</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596518"></a>Configure <tt class="filename">nsswitch.conf</tt> and the Winbind Libraries on Linux and Solaris</h4></div></div></div><p> 251PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install 252the <tt class="filename">pam-devel</tt> libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3 253may auto-install the Winbind files into their correct locations on your system, so before you get too far down 254the track be sure to check if the following configuration is really 255necessary. You may only need to configure 256<tt class="filename">/etc/nsswitch.conf</tt>. 257</p><p> 258The libraries needed to run the <span class="application">winbindd</span> daemon through nsswitch need to be copied to their proper locations: 259</p><p> 260</p><pre class="screen"> 261<tt class="prompt">root# </tt><b class="userinput"><tt>cp ../samba/source/nsswitch/libnss_winbind.so /lib</tt></b> 262</pre><p> 263</p><p> 264I also found it necessary to make the following symbolic link: 265</p><p> 266<tt class="prompt">root# </tt> <b class="userinput"><tt>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</tt></b> 267</p><p>And, in the case of Sun Solaris:</p><pre class="screen"> 268<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</tt></b> 269<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</tt></b> 270<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</tt></b> 271</pre><p> 272Now, as root you need to edit <tt class="filename">/etc/nsswitch.conf</tt> to 273allow user and group entries to be visible from the <span class="application">winbindd</span> 274daemon. My <tt class="filename">/etc/nsswitch.conf</tt> file look like 275this after editing: 276</p><pre class="programlisting"> 277 passwd: files winbind 278 shadow: files 279 group: files winbind 280</pre><p> 281The libraries needed by the <span><b class="command">winbindd</b></span> daemon will be automatically 282entered into the <span><b class="command">ldconfig</b></span> cache the next time 283your system reboots, but it is faster (and you do not need to reboot) if you do it manually: 284</p><p> 285<tt class="prompt">root# </tt><b class="userinput"><tt>/sbin/ldconfig -v | grep winbind</tt></b> 286</p><p> 287This makes <tt class="filename">libnss_winbind</tt> available to winbindd 288and echos back a check to you. 289</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596722"></a>NSS Winbind on AIX</h4></div></div></div><p>(This section is only for those running AIX.)</p><p> 290The Winbind AIX identification module gets built as <tt class="filename">libnss_winbind.so</tt> in the 291nsswitch directory of the Samba source. This file can be copied to <tt class="filename">/usr/lib/security</tt>, 292and the AIX naming convention would indicate that it should be named WINBIND. A stanza like the following: 293</p><pre class="programlisting"> 294WINBIND: 295 program = /usr/lib/security/WINBIND 296 options = authonly 297</pre><p> 298can then be added to <tt class="filename">/usr/lib/security/methods.cfg</tt>. This module only supports 299identification, but there have been success reports using the standard Winbind PAM module for 300authentication. Use caution configuring loadable authentication 301modules since you can make 302it impossible to logon to the system. More information about the AIX authentication module API can 303be found at “<span class="quote"><span class="emphasis"><em>Kernel Extensions and Device Support Programming Concepts for AIX</em></span></span>”<a href="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixprggd/kernextc/sec_load_mod.htm" target="_top"> 304in Chapter 18(John, there is no section like this in 18). Loadable Authentication Module Programming 305Interface</a> and more information on administering the modules 306can be found at <a href="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/iandaadmin.htm" target="_top"> “<span class="quote"><span class="emphasis"><em>System 307Management Guide: Operating System and Devices.</em></span></span>”</a> 308</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596801"></a>Configure smb.conf</h4></div></div></div><p> 309Several parameters are needed in the <tt class="filename">smb.conf</tt> file to control the behavior of <span class="application">winbindd</span>. These 310are described in more detail in the <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> man page. My <tt class="filename">smb.conf</tt> file, as shown in <a href="winbind.html#winbindcfg" title="Example�22.1.�smb.conf for Winbind set-up">the next example</a>, was modified to include the necessary entries in the [global] section. 311</p><p> 312</p><div class="example"><a name="winbindcfg"></a><p class="title"><b>Example�22.1.�smb.conf for Winbind set-up</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td># separate domain and username with '\', like DOMAIN\username</td></tr><tr><td><a class="indexterm" name="id2596879"></a><i class="parameter"><tt> 313 314 winbind separator = \</tt></i></td></tr><tr><td># use uids from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2596901"></a><i class="parameter"><tt> 315 316 idmap uid = 10000-20000</tt></i></td></tr><tr><td># use gids from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2596924"></a><i class="parameter"><tt> 317 318 idmap gid = 10000-20000</tt></i></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2596946"></a><i class="parameter"><tt> 319 320 winbind enum users = yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2596961"></a><i class="parameter"><tt> 321 322 winbind enum groups = yes</tt></i></td></tr><tr><td># give winbind users a real shell (only needed if they have telnet access)</td></tr><tr><td><a class="indexterm" name="id2596984"></a><i class="parameter"><tt> 323 324 template homedir = /home/winnt/%D/%U</tt></i></td></tr><tr><td><a class="indexterm" name="id2597000"></a><i class="parameter"><tt> 325 326 template shell = /bin/bash</tt></i></td></tr></table></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2597016"></a>Join the Samba Server to the PDC Domain</h4></div></div></div><p> 327All machines that will participate in domain security should be members of 328the domain. This applies also to the PDC and all BDCs. 329</p><p> 330The process of joining a domain requires the use of the <span><b class="command">net rpc join</b></span> 331command. This process communicates with the domain controller it will register with 332(usually the PDC) via MS DCE RPC. This means, of course, that the <span><b class="command">smbd</b></span> 333process must be running on the target DC. This means that it is necessary to temporarily 334start Samba on a PDC so that it can join its own domain. 335</p><p> 336Enter the following command to make the Samba server join the 337domain, where <i class="replaceable"><tt>PDC</tt></i> is the name of 338your PDC and <i class="replaceable"><tt>Administrator</tt></i> is 339a domain user who has administrative privileges in the domain. 340</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 341Before attempting to join a machine to the domain verify that Samba is running 342on the target DC (usually PDC) and that it is capable of being reached via ports 343137/udp, 135/tcp, 139/tcp, and 445/tcp (if Samba or Windows Server 2Kx. 344</p></div><p> 345<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/net rpc join -S PDC -U Administrator</tt></b> 346</p><p> 347The proper response to the command should be: “<span class="quote"><span class="emphasis"><em>Joined the domain 348<i class="replaceable"><tt>DOMAIN</tt></i></em></span></span>” where <i class="replaceable"><tt>DOMAIN</tt></i> 349is your DOMAIN name. 350</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2597101"></a>Starting and Testing the <span><b class="command">winbindd</b></span> Daemon</h4></div></div></div><p> 351Eventually, you will want to modify your Samba startup script to 352automatically invoke the winbindd daemon when the other parts of 353Samba start, but it is possible to test out just the Winbind 354portion first. To start up Winbind services, enter the following 355command as root: 356</p><p> 357<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/sbin/winbindd</tt></b> 358</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 359The above assumes that Samba has been installed in the <tt class="filename">/usr/local/samba</tt> 360directory tree. You may need to search for the location of Samba files if this is not the 361location of <span><b class="command">winbindd</b></span> on your system. 362</p></div><p> 363Winbindd can now also run in “<span class="quote"><span class="emphasis"><em>dual daemon mode</em></span></span>”. This will make it 364run as two processes. The first will answer all requests from the cache, 365thus making responses to clients faster. The other will 366update the cache for the query that the first has just responded. 367The advantage of this is that responses stay accurate and are faster. 368You can enable dual daemon mode by adding <tt class="option">-B</tt> to the command-line: 369</p><p> 370<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/sbin/winbindd -B</tt></b> 371</p><p> 372I'm always paranoid and like to make sure the daemon is really running. 373</p><p> 374<tt class="prompt">root# </tt><b class="userinput"><tt>ps -ae | grep winbindd</tt></b> 375</p><p> 376This command should produce output like this, if the daemon is running you would expect 377to see a report something like this: 378</p><pre class="screen"> 3793025 ? 00:00:00 winbindd 380</pre><p> 381Now, for the real test, try to get some information about the users on your PDC: 382</p><p> 383<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/wbinfo -u</tt></b> 384</p><p> 385This should echo back a list of users on your Windows users on 386your PDC. For example, I get the following response: 387</p><pre class="screen"> 388 CEO\Administrator 389 CEO\burdell 390 CEO\Guest 391 CEO\jt-ad 392 CEO\krbtgt 393 CEO\TsInternetUser 394</pre><p> 395Obviously, I have named my domain “<span class="quote"><span class="emphasis"><em>CEO</em></span></span>” and my <a class="indexterm" name="id2597256"></a>winbind separator is “<span class="quote"><span class="emphasis"><em>\</em></span></span>”. 396</p><p> 397You can do the same sort of thing to get group information from the PDC: 398</p><pre class="screen"> 399<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/wbinfo -g</tt></b> 400 CEO\Domain Admins 401 CEO\Domain Users 402 CEO\Domain Guests 403 CEO\Domain Computers 404 CEO\Domain Controllers 405 CEO\Cert Publishers 406 CEO\Schema Admins 407 CEO\Enterprise Admins 408 CEO\Group Policy Creator Owners 409</pre><p> 410The function <span><b class="command">getent</b></span> can now be used to get unified 411lists of both local and PDC users and groups. Try the following command: 412</p><p> 413<tt class="prompt">root# </tt><b class="userinput"><tt>getent passwd</tt></b> 414</p><p> 415You should get a list that looks like your <tt class="filename">/etc/passwd</tt> 416list followed by the domain users with their new UIDs, GIDs, home 417directories and default shells. 418</p><p> 419The same thing can be done for groups with the command: 420</p><p> 421<tt class="prompt">root# </tt><b class="userinput"><tt>getent group</tt></b> 422</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2597350"></a>Fix the init.d Startup Scripts</h4></div></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2597356"></a>Linux</h5></div></div></div><p> 423The <span class="application">winbindd</span> daemon needs to start up after the <span class="application">smbd</span> and <span class="application">nmbd</span> daemons are running. 424To accomplish this task, you need to modify the startup scripts of your system. 425They are located at <tt class="filename">/etc/init.d/smb</tt> in Red Hat Linux and they are located in 426<tt class="filename">/etc/init.d/samba</tt> in Debian Linux. Edit your 427script to add commands to invoke this daemon in the proper sequence. My 428startup script starts up <span class="application">smbd</span>, <span class="application">nmbd</span>, and <span class="application">winbindd</span> from the 429<tt class="filename">/usr/local/samba/bin</tt> directory directly. The <span><b class="command">start</b></span> 430function in the script looks like this: 431</p><pre class="programlisting"> 432start() { 433 KIND="SMB" 434 echo -n $"Starting $KIND services: " 435 daemon /usr/local/samba/bin/smbd $SMBDOPTIONS 436 RETVAL=$? 437 echo 438 KIND="NMB" 439 echo -n $"Starting $KIND services: " 440 daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS 441 RETVAL2=$? 442 echo 443 KIND="Winbind" 444 echo -n $"Starting $KIND services: " 445 daemon /usr/local/samba/sbin/winbindd 446 RETVAL3=$? 447 echo 448 [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \ 449 touch /var/lock/subsys/smb || RETVAL=1 450 return $RETVAL 451} 452</pre><p>If you would like to run winbindd in dual daemon mode, replace 453the line : 454</p><pre class="programlisting"> 455 daemon /usr/local/samba/sbin/winbindd 456</pre><p> 457 458in the example above with: 459 460</p><pre class="programlisting"> 461 daemon /usr/local/samba/sbin/winbindd -B 462</pre><p>. 463</p><p> 464The <span><b class="command">stop</b></span> function has a corresponding entry to shut down the 465services and looks like this: 466</p><pre class="programlisting"> 467stop() { 468 KIND="SMB" 469 echo -n $"Shutting down $KIND services: " 470 killproc smbd 471 RETVAL=$? 472 echo 473 KIND="NMB" 474 echo -n $"Shutting down $KIND services: " 475 killproc nmbd 476 RETVAL2=$? 477 echo 478 KIND="Winbind" 479 echo -n $"Shutting down $KIND services: " 480 killproc winbindd 481 RETVAL3=$? 482 [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \ 483 rm -f /var/lock/subsys/smb 484 echo "" 485 return $RETVAL 486} 487</pre></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2597506"></a>Solaris</h5></div></div></div><p> 488Winbind does not work on Solaris 9, see <a href="Portability.html#winbind-solaris9" title="Winbind on Solaris 9">Winbind on Solaris 9</a> section for details. 489</p><p> 490On Solaris, you need to modify the <tt class="filename">/etc/init.d/samba.server</tt> startup script. It 491usually only starts smbd and nmbd but should now start winbindd, too. If you have Samba installed in 492<tt class="filename">/usr/local/samba/bin</tt>, the file could contains something like this: 493</p><p> 494 495 </p><pre class="programlisting"> 496 ## 497 ## samba.server 498 ## 499 500 if [ ! -d /usr/bin ] 501 then # /usr not mounted 502 exit 503 fi 504 505 killproc() { # kill the named process(es) 506 pid=`/usr/bin/ps -e | 507 /usr/bin/grep -w $1 | 508 /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` 509 [ "$pid" != "" ] && kill $pid 510 } 511 512 # Start/stop processes required for Samba server 513 514 case "$1" in 515 516 'start') 517 # 518 # Edit these lines to suit your installation (paths, workgroup, host) 519 # 520 echo Starting SMBD 521 /usr/local/samba/bin/smbd -D -s \ 522 /usr/local/samba/smb.conf 523 524 echo Starting NMBD 525 /usr/local/samba/bin/nmbd -D -l \ 526 /usr/local/samba/var/log -s /usr/local/samba/smb.conf 527 528 echo Starting Winbind Daemon 529 /usr/local/samba/sbin/winbindd 530 ;; 531 532 'stop') 533 killproc nmbd 534 killproc smbd 535 killproc winbindd 536 ;; 537 538 *) 539 echo "Usage: /etc/init.d/samba.server { start | stop }" 540 ;; 541 esac 542</pre><p> 543Again, if you would like to run Samba in dual daemon mode, replace: 544</p><pre class="programlisting"> 545 /usr/local/samba/sbin/winbindd 546</pre><p> 547in the script above with: 548</p><pre class="programlisting"> 549 /usr/local/samba/sbin/winbindd -B 550</pre><p> 551</p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2597609"></a>Restarting</h5></div></div></div><p> 552If you restart the <span class="application">smbd</span>, <span class="application">nmbd</span>, and <span class="application">winbindd</span> daemons at this point, you 553should be able to connect to the Samba server as a Domain Member just as 554if you were a local user. 555</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2597640"></a>Configure Winbind and PAM</h4></div></div></div><p> 556If you have made it this far, you know that <span><b class="command">winbindd</b></span> and Samba are working 557together. If you want to use Winbind to provide authentication for other 558services, keep reading. The PAM configuration files need to be altered in 559this step. (Did you remember to make backups of your original 560<tt class="filename">/etc/pam.d</tt> files? If not, do it now.) 561</p><p> 562You will need a PAM module to use winbindd with these other services. This 563module will be compiled in the <tt class="filename">../source/nsswitch</tt> directory 564by invoking the command: 565</p><p> 566<tt class="prompt">root# </tt><b class="userinput"><tt>make nsswitch/pam_winbind.so</tt></b> 567</p><p> 568from the <tt class="filename">../source</tt> directory. The 569<tt class="filename">pam_winbind.so</tt> file should be copied to the location of 570your other PAM security modules. On my Red Hat system, this was the 571<tt class="filename">/lib/security</tt> directory. On Solaris, the PAM security 572modules reside in <tt class="filename">/usr/lib/security</tt>. 573</p><p> 574<tt class="prompt">root# </tt><b class="userinput"><tt>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</tt></b> 575</p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2597737"></a>Linux/FreeBSD-specific PAM configuration</h5></div></div></div><p> 576The <tt class="filename">/etc/pam.d/samba</tt> file does not need to be changed. I 577just left this file as it was: 578</p><pre class="programlisting"> 579 auth required /lib/security/pam_stack.so service=system-auth 580 account required /lib/security/pam_stack.so service=system-auth 581</pre><p> 582The other services that I modified to allow the use of Winbind 583as an authentication service were the normal login on the console (or a terminal 584session), telnet logins, and ftp service. In order to enable these 585services, you may first need to change the entries in 586<tt class="filename">/etc/xinetd.d</tt> (or <tt class="filename">/etc/inetd.conf</tt>). 587Red Hat Linux 7.1 and later uses the new xinetd.d structure, in this case you need 588to change the lines in <tt class="filename">/etc/xinetd.d/telnet</tt> 589and <tt class="filename">/etc/xinetd.d/wu-ftp</tt> from 590</p><pre class="programlisting"> 591 enable = no 592</pre><p> 593to: 594</p><pre class="programlisting"> 595 enable = yes 596</pre><p> 597For ftp services to work properly, you will also need to either 598have individual directories for the domain users already present on 599the server, or change the home directory template to a general 600directory for all domain users. These can be easily set using 601the <tt class="filename">smb.conf</tt> global entry 602<a class="indexterm" name="id2597824"></a>template homedir. 603</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The directory in <a class="indexterm" name="id2597837"></a>template homedir is not created automatically! Use pam_mkhomedir or pre-create 604 the directories of users to make sure users can log in on UNIX with 605 their own home directory. 606 </p></div><p> 607The <tt class="filename">/etc/pam.d/ftp</tt> file can be changed 608to allow Winbind ftp access in a manner similar to the 609samba file. My <tt class="filename">/etc/pam.d/ftp</tt> file was 610changed to look like this: 611</p><pre class="programlisting"> 612auth required /lib/security/pam_listfile.so item=user sense=deny \ 613 file=/etc/ftpusers onerr=succeed 614auth sufficient /lib/security/pam_winbind.so 615auth required /lib/security/pam_stack.so service=system-auth 616auth required /lib/security/pam_shells.so 617account sufficient /lib/security/pam_winbind.so 618account required /lib/security/pam_stack.so service=system-auth 619session required /lib/security/pam_stack.so service=system-auth 620</pre><p> 621The <tt class="filename">/etc/pam.d/login</tt> file can be changed nearly the 622same way. It now looks like this: 623</p><pre class="programlisting"> 624auth required /lib/security/pam_securetty.so 625auth sufficient /lib/security/pam_winbind.so 626auth sufficient /lib/security/pam_unix.so use_first_pass 627auth required /lib/security/pam_stack.so service=system-auth 628auth required /lib/security/pam_nologin.so 629account sufficient /lib/security/pam_winbind.so 630account required /lib/security/pam_stack.so service=system-auth 631password required /lib/security/pam_stack.so service=system-auth 632session required /lib/security/pam_stack.so service=system-auth 633session optional /lib/security/pam_console.so 634</pre><p> 635In this case, I added the </p><pre class="programlisting">auth sufficient /lib/security/pam_winbind.so</pre><p> 636lines as before, but also added the </p><pre class="programlisting">required pam_securetty.so</pre><p> 637above it, to disallow root logins over the network. I also added a 638</p><pre class="programlisting">sufficient /lib/security/pam_unix.so use_first_pass</pre><p> 639line after the <span><b class="command">winbind.so</b></span> line to get rid of annoying 640double prompts for passwords. 641</p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2597943"></a>Solaris-specific configuration</h5></div></div></div><p> 642The <tt class="filename">/etc/pam.conf</tt> needs to be changed. I changed this file so my Domain 643users can logon both locally as well as telnet. The following are the changes 644that I made. You can customize the <tt class="filename">pam.conf</tt> file as per your requirements, but 645be sure of those changes because in the worst case it will leave your system 646nearly impossible to boot. 647</p><pre class="programlisting"> 648# 649#ident "@(#)pam.conf 1.14 99/09/16 SMI" 650# 651# Copyright (c) 1996-1999, Sun Microsystems, Inc. 652# All Rights Reserved. 653# 654# PAM configuration 655# 656# Authentication management 657# 658login auth required /usr/lib/security/pam_winbind.so 659login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 660login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 661# 662rlogin auth sufficient /usr/lib/security/pam_winbind.so 663rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 664rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 665# 666dtlogin auth sufficient /usr/lib/security/pam_winbind.so 667dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 668# 669rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 670other auth sufficient /usr/lib/security/pam_winbind.so 671other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 672# 673# Account management 674# 675login account sufficient /usr/lib/security/pam_winbind.so 676login account requisite /usr/lib/security/$ISA/pam_roles.so.1 677login account required /usr/lib/security/$ISA/pam_unix.so.1 678# 679dtlogin account sufficient /usr/lib/security/pam_winbind.so 680dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 681dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1 682# 683other account sufficient /usr/lib/security/pam_winbind.so 684other account requisite /usr/lib/security/$ISA/pam_roles.so.1 685other account required /usr/lib/security/$ISA/pam_unix.so.1 686# 687# Session management 688# 689other session required /usr/lib/security/$ISA/pam_unix.so.1 690# 691# Password management 692# 693#other password sufficient /usr/lib/security/pam_winbind.so 694other password required /usr/lib/security/$ISA/pam_unix.so.1 695dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1 696# 697# Support for Kerberos V5 authentication (uncomment to use Kerberos) 698# 699#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass 700#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass 701#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass 702#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass 703#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 704#other account optional /usr/lib/security/$ISA/pam_krb5.so.1 705#other session optional /usr/lib/security/$ISA/pam_krb5.so.1 706#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass 707</pre><p> 708I also added a <i class="parameter"><tt>try_first_pass</tt></i> line after the <tt class="filename">winbind.so</tt> 709line to get rid of annoying double prompts for passwords. 710</p><p> 711Now restart your Samba and try connecting through your application that you 712configured in the pam.conf. 713</p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598043"></a>Conclusion</h2></div></div></div><p>The Winbind system, through the use of the Name Service 714Switch, Pluggable Authentication Modules, and appropriate 715Microsoft RPC calls have allowed us to provide seamless 716integration of Microsoft Windows NT domain users on a 717UNIX system. The result is a great reduction in the administrative 718cost of running a mixed UNIX and NT network.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598058"></a>Common Errors</h2></div></div></div><p>Winbind has a number of limitations in its current 719 released version that we hope to overcome in future 720 releases:</p><div class="itemizedlist"><ul type="disc"><li><p>Winbind is currently only available for 721 the Linux, Solaris, AIX, and IRIX operating systems, although ports to other operating 722 systems are certainly possible. For such ports to be feasible, 723 we require the C library of the target operating system to 724 support the Name Service Switch and Pluggable Authentication 725 Modules systems. This is becoming more common as NSS and 726 PAM gain support among UNIX vendors.</p></li><li><p>The mappings of Windows NT RIDs to UNIX IDs 727 is not made algorithmically and depends on the order in which 728 unmapped users or groups are seen by Winbind. It may be difficult 729 to recover the mappings of RID to UNIX ID mapping if the file 730 containing this information is corrupted or destroyed.</p></li><li><p>Currently the Winbind PAM module does not take 731 into account possible workstation and logon time restrictions 732 that may be set for Windows NT users, this is 733 instead up to the PDC to enforce.</p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598102"></a>NSCD Problem Warning</h3></div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 734 Do not under any circumstances run <span><b class="command">nscd</b></span> on any system 735 on which <span><b class="command">winbindd</b></span> is running. 736 </p></div><p> 737 If <span><b class="command">nscd</b></span> is running on the UNIX/Linux system, then 738 even though NSSWITCH is correctly configured it will not be possible to resolve 739 domain users and groups for file and directory controls. 740 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598142"></a>Winbind Is Not Resolving Users and Groups</h3></div></div></div><p>“<span class="quote"><span class="emphasis"><em> 741 My <tt class="filename">smb.conf</tt> file is correctly configured. I have specified 742 <a class="indexterm" name="id2598159"></a>idmap uid = 12000, 743 and <a class="indexterm" name="id2598166"></a>idmap gid = 3000-3500 744 and <span><b class="command">winbind</b></span> is running. When I do the following it all works fine. 745 </em></span></span>”</p><pre class="screen"> 746<tt class="prompt">root# </tt><b class="userinput"><tt>wbinfo -u</tt></b> 747MIDEARTH\maryo 748MIDEARTH\jackb 749MIDEARTH\ameds 750... 751MIDEARTH\root 752 753<tt class="prompt">root# </tt><b class="userinput"><tt>wbinfo -g</tt></b> 754MIDEARTH\Domain Users 755MIDEARTH\Domain Admins 756MIDEARTH\Domain Guests 757... 758MIDEARTH\Accounts 759 760<tt class="prompt">root# </tt><b class="userinput"><tt>getent passwd</tt></b> 761root:x:0:0:root:/root:/bin/bash 762bin:x:1:1:bin:/bin:/bin/bash 763... 764maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false 765</pre><p>“<span class="quote"><span class="emphasis"><em> 766But the following command just fails: 767</em></span></span>” 768</p><pre class="screen"> 769<tt class="prompt">root# </tt><b class="userinput"><tt>chown maryo a_file</tt></b> 770chown: `maryo': invalid user 771</pre><p> 772“<span class="quote"><span class="emphasis"><em> 773This is driving me nuts! What can be wrong? 774</em></span></span>”</p><p> 775Same problem as the one above. 776Your system is likely running <span><b class="command">nscd</b></span>, the name service 777caching daemon. Shut it down, do not restart it! You will find your problem resolved. 778</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="VFS.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="AdvancedNetworkManagement.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�21.�Stackable VFS modules�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�23.�Advanced Network Management</td></tr></table></div></body></html> 779
