I have a problem with authentication of users on my Linux box.
I'm running a W2K Active Directory where all users are configured.
I also have a Fedora Core 1 linux box running, with samba 3, winbindd & kerberos installed and configured.
Samba is talking niceley to the Active Directory, when i use the "wbinfo -u" command a list of domain users is returned.
But when I use the getent passwd command the list only displays the local users configured on the linux box.
I also have nsswitch in the /etc directory configured.
When I edit my /etc/pam.d/login file to communicate via winbind with Acitve Directory, the login doesn't work. Not a single user is recognized.
Network Setup:
Domain: GOLDENEYE_THUIS
Active Directory Controller: Goldeneye (10.0.0.2)
Unix Box: Icarus (10.0.0.1)
DNS & AD configured on Goldeneye
My config files are the following:
*** /etc/nsswitch.conf ***
passwd: files winbind
shadow: files
group: files winbind
********************
**** /etc/samba/smb.conf ****
[global]
workgroup = GOLDENEYE_THUIS
netbios name = ICARUS
server string = Icarus Internet Gateway
interfaces = 10.0.0.1/255.0.0.0
localmaster = no
winbind separator = +
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/%D/%U
template shell = /bin/bash
**************************
***
********* /etc/krb5.conf *********
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
default_realm = GOLDENEYE.BE
default_tgs_enctypes = des-cbc-crc des-cbc-md5
default_tkt_enctypes = des-cbc-crc des-cbc-md5
forwardable = true
proxiable= true
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
GOLDENEYE.BE = {
kdc = goldeneye.goldeneye.be:88
default_domain = goldeneye.be
admin_server = goldeneye.goldeneye.be
}
[domain_realm]
.goldeneye.be = GOLDENEYE.BE
goldeneye.be = GOLDENEYE.BE
[kdc]
profile = /var/kerberos/krb5kdc/kdc.
conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
**************************
*********
************ /etc/pam.d/login *************
#%PAM-1.0
auth required pam_securetty.so
auth sufficient pam_winbind.so
auth sufficient pam_unix.so use_first_pass
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account sufficient pam_winbind.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session optional pam_console.so
**************************
**********
********
Generally logging on at the system with pam.d/login configured like this does not work.
Also the getent passwd command does not display the domain users, only the local ones.
Any help ?
Tnx in advance.
