PAM configuration for Windows Active Directory - Revision history

Admin at 13:24, 8 August 2017

2017-08-08T13:24:54Z

2016-04-27T13:25:29Z

2016-04-27T13:24:30Z

2016-04-27T13:23:37Z

2016-04-27T13:23:27Z

Troubleshooting

2013-02-22T10:32:08Z

Troubleshooting

2013-02-22T10:31:03Z

Install required software

2013-02-22T10:27:57Z

Configure Kerberos

2013-02-22T10:26:15Z

Synchronize time

2013-02-22T10:26:10Z

Network availability

← Older revision		Revision as of 13:24, 8 August 2017
Line 148:		Line 148:

	[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982]		[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982]
		+
		+
		+	[[Category:OS4X Enterprise]]

@@ Line 132: / Line 132: @@
 === Login not possible ===
-If users cannot login into OS4X Webaccess anymore, it may be possible that a specific Samba version is causing Trouble (especially when using an actual Version of Debian, used in OS4Xvirtual). When re-joining the domain, you will get the following error message:
+If users cannot login into OS4X Webaccess anymore, it may be possible that a specific Samba version is causing trouble (especially when using an actual version of Debian, used in OS4Xvirtual). When re-joining the domain, you will get the following error message:
   Failed to join domain: failed to lookup DC info for domain '<Domain Name>' over rpc: Access denied
   return code = -1

@@ Line 132: / Line 132: @@
 === Login not possible ===
-If users cannot login into OS4X Webaccess anymore, it may be possible that a specific Samba version is causing trouble. When re-joining the domain, you will get the following error message:
+If users cannot login into OS4X Webaccess anymore, it may be possible that a specific Samba version is causing Trouble (especially when using an actual Version of Debian, used in OS4Xvirtual). When re-joining the domain, you will get the following error message:
   Failed to join domain: failed to lookup DC info for domain '<Domain Name>' over rpc: Access denied
   return code = -1

@@ Line 144: / Line 144: @@
 External links:
 [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821811 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821811]
 [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982]

← Older revision		Revision as of 13:23, 27 April 2016
Line 130:		Line 130:
	os4xvirtual:/etc/samba# '''/etc/init.d/winbind restart'''		os4xvirtual:/etc/samba# '''/etc/init.d/winbind restart'''
	Any logging in Samba, Winbind, Kerberos and the kernel logs contain reasons why authentification may have failed.		Any logging in Samba, Winbind, Kerberos and the kernel logs contain reasons why authentification may have failed.
		+
		+	=== Login not possible ===
		+	If users cannot login into OS4X Webaccess anymore, it may be possible that a specific Samba version is causing trouble. When re-joining the domain, you will get the following error message:
		+	Failed to join domain: failed to lookup DC info for domain '<Domain Name>' over rpc: Access denied
		+	return code = -1
		+
		+	You can downgrade to the latest known working version:
		+
		+	apt-get install samba=2:3.6.6-6+deb7u7 \
		+	samba-common=2:3.6.6-6+deb7u7 libwbclient0=2:3.6.6-6+deb7u7 \
		+	libnss-winbind=2:3.6.6-6+deb7u7 libpam-winbind=2:3.6.6-6+deb7u7\
		+	winbind=2:3.6.6-6+deb7u7
		+
		+	External links:
		+	[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821811 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821811]
		+	[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820982]

@@ Line 127: / Line 127: @@
 == Troubleshooting ==
-If authentification fails without any reason, a good starting point to react is to restart Winbind:
+If authentification fails without any reason, a good starting point to react is to restart Winbind (before raising loglevels in Winbind, Samba and/or Kerberos):
   os4xvirtual:/etc/samba# '''/etc/init.d/winbind restart'''
 Any logging in Samba, Winbind, Kerberos and the kernel logs contain reasons why authentification may have failed.

@@ Line 57: / Line 57: @@
 *Kerberos
 If not installed already, install these packages through the local Linux packaging system:
-  apt-get install winbind samba krb5-kdc krb5-admin-server
+  apt-get install winbind samba krb5-kdc
 During installation of Kerberos, you will be asked for a default realm: leave this entry empty, we will configure it afterwards.

@@ Line 89: / Line 89: @@
   Default Kerberos version 5 realm: W2K8.C-WORKS.NET
   Add locations of default Kerberos servers to /etc/krb5.conf? - Yes
-  Kerberos servers for your realm: win2k8.sbs.c-works.net (''the IP address 192.168.1.65 would be valid, too'')
+  Kerberos servers for your realm: dc.w2k8.c-works.net (''the IP address 192.168.1.65 would be valid, too'')
-  Administrative server for your Kerberos realm: win2k8.sbs.c-works.net (''the IP address 192.168.1.65 would be valid, too'')
+  Administrative server for your Kerberos realm: dc.w2k8.c-works.net (''the IP address 192.168.1.65 would be valid, too'')
 == Initialize Kerberos ==

@@ Line 48: / Line 48: @@
 == Synchronize time ==
 The underlying security model relies on synchronized time between (Active Directory) server and (Linux OS4X) client). Windows Active Directory servers offer a NTP server which can be used for time synchronization.
-  ntpdate win2k8
+  ntpdate dc.w2k8.c-works.net
 If the domain controller server doesn't run as time server, be sure to use the same time source for local and remote time synchronization.

@@ Line 35: / Line 35: @@
 The AD server must be reachable via network on the Linux side:
 <pre>
-os4xvirtual:~# ping -c 3  dc.w2k8.c-works.net
+os4xvirtual:~# ping -c 3 dc.w2k8.c-works.net
 PING dc.w2k8.c-works.net (192.168.1.65) 56(84) bytes of data.
 bytes from 192.168.1.65: icmp_req=1 ttl=128 time=0.762 ms