Re: [Samba] Windows pre-requisites for login with winbind?
- Date: Thu, 24 Aug 2017 12:12:03 +0100
- From: Rowland Penny via samba <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] Windows pre-requisites for login with winbind?
On Thu, 24 Aug 2017 10:55:26 +0000
"A. James Lewis" <james@xxxxxxxxxx> wrote:
> Yes indeed.... I know a lot about the Linux side, but Windows is a
> bit of a mystery to me... and I have to confess to not knowing
> exactly how nss links various directory services into the system....
> hence my comment earlier with "Password file entry" in quotes... I
> know it's not in the password file, and is amalgamated into the
> password "map", via nss, but I'm not sure what the correct
> terminology is for that.... "map" makes me think NIS, but I guess it
> could be extended to other directory services now.
> One thing I would ask, especially given your earlier assistance with
> my configs... could you advise what would be required to allow
> logging in to multiple domains.
> Existing configs included at the end:-
> As far as I can see, so long as it can look up the
> _kerberos._tcp.DOMAIN2 record, I should not need to add anything to
> For smb.conf, clearly I need to add:-
> idmap config DOMAIN2:backend = rid
> idmap config DOMAIN2:range = 500000-800000
> But do I need to add anything else to make that happen?
> Thanks again.
> $ cat krb5.conf | ./anon.sh
> default_realm = DOMAIN.LOCAL
> dns_lookup_realm = false
> dns_lookup_kdc = true
> $ cat smb.conf | ./anon.sh
> workgroup = DOMAIN
> security = ADS
> realm = DOMAIN.LOCAL
> idmap config *:backend = tdb
> idmap config *:range = 4000-4999
> idmap config DOMAIN:backend = rid
> idmap config DOMAIN:range = 5000-300000
> winbind trusted domains only = no
> winbind use default domain = yes
> winbind refresh tickets = yes
> template shell = /bin/bash
> template homedir = /home/%D/%U
In theory (wonderful thing, theory) you just need to setup a two way
trust between the two domains and then add the lines you propose,
restart Samba and it should work. It used to work with Samba3, but I
haven't tried it lately ;-)
To unsubscribe from this list go to the following URL and read the