Marci Posted February 10, 2009 Posted February 10, 2009 OK, we've got our luverly Mac network running here, nicely integrated with AD. I'm trying to setup a new sharepoint on the x-server that everyone can access, which I've done. Problem is, it won't mount. Any attempt to doso using AD credentials fails. If I use one of the local XServer accounts however, it mounts fine. Where am I going wrong?
HodgeHi Posted February 11, 2009 Posted February 11, 2009 Are you using AFP and smb service? What protocols are you using for these shares? Also is kerberos set up for authentication type? Run sudo klist -kt and see if the services have been kerberised by the AD kerberos realm. If not then running dsconfigad -enableSSO should do it for you.
Marci Posted February 12, 2009 Author Posted February 12, 2009 (edited) Are you using AFP and smb service? What protocols are you using for these shares? Yep, using AFP & SMB... shares are set for all but ftp & nfs. Also is kerberos set up for authentication type? How do I check? see if the services have been kerberised by the AD kerberos realm Voici de output: Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 3 08/12/08 14:00:43 afpserver/LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36@LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36 3 08/12/08 14:00:44 afpserver/LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36@LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36 3 08/12/08 14:00:44 afpserver/LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36@LKDC:SHA1.849912A5AE5425B5F38E13EC3F54C34F18146D36 *snip* 7 01/19/09 10:32:20 afpserver/[email protected] 7 01/19/09 10:32:20 afpserver/[email protected] 7 01/19/09 10:32:20 afpserver/[email protected] *snip* 7 01/19/09 10:32:20 nfs/[email protected] 7 01/19/09 10:32:20 nfs/[email protected] 7 01/19/09 10:32:20 nfs/[email protected] *snip* 7 01/19/09 10:32:20 ldap/[email protected] 7 01/19/09 10:32:20 ldap/[email protected] 7 01/19/09 10:32:20 ldap/[email protected] *snip* No mention of smb in the output tho... If I just run 'sudo klist', I get: klist: No Kerberos 5 tickets in credentials cache Edited February 12, 2009 by Marci
HodgeHi Posted February 12, 2009 Posted February 12, 2009 If HORBURY.INTERNAL is the same as your AD kerberos realm then the services have been kerberised. The AFP service is a funy one as it still utilises the local KDC realm of the OS X Server. You can check that authentication is set to kerberos by using Server admin. For AFP go to the AFP service and then go to the access tab. Under here should be authentication. Now if this is set to any method, the client "should" try to use kerberos first. If set to standard, you will have to auth using a dialog box. For SMB go to the SMB service, go to settings and then access. NTMLv2 and kerberos should be ticked. You could also try and use the kerberos.app found in /system/library/coreservices/kerberos.app Open this app and try and mount the share. See if you automatically get a kerberos ticket for the server the share is located. Running dsconfigad -enableSSO should try and kerberise all running services, but after checking my server smb isn't listed either. Remember to also check the time and also have the console open when trying to mount the share. This may give a little more insight to what is happening. Also you may wish to have the server logs available when mounting the share.
Marci Posted February 12, 2009 Author Posted February 12, 2009 Yep, Horbury.Internal is the AD Domain... AFP is set to "any", have set it to "kerberos". SMB is set to "NTLMv2 & Kerberos". Have run "dsconfigad -enableSSO" Kerberos.app on my client shows that I have a ticket in the ticket cache and that I'm the active user etc. When I head to Go > Network > Appleserver it presents with finder window "Connected as: guest" unless I hit "Connect As". When I do, it prompts me for user and pass, which I provide, and then get the response "Sorry, you entered an invalid username or password, please try again." Time is sync'd to the AD PDC... Console shows nothing for times when I attempt to mount the share, however, there are earlier entries for com.apple.KerberosAutoConfig stating "Couldn't find KerberosClient config record"
Marci Posted February 12, 2009 Author Posted February 12, 2009 edu.mit.Kerberos content (same on both client and server): [libdefaults] dns_fallback = no default_realm = HORBURY.INTERNAL [domain_realm] .horbury.internal = HORBURY.INTERNAL [logging] admin_server = FILE:/var/log/krb5kdc/kadmin.log kdc = FILE:/var/log/krb5dc/kdc.log
HodgeHi Posted February 12, 2009 Posted February 12, 2009 Try mounting by using Finder > Go > Connect to Server (⌘K) I have found issues when trying to use the Finder window to do this, especially if you try and create a mounting share on login in this way. It seems to mess up the UNC path by sticking in TCP% stuff.
Marci Posted February 12, 2009 Author Posted February 12, 2009 Same response - Invalid Username or Password...
Marci Posted February 12, 2009 Author Posted February 12, 2009 OK, this is bizarre. I THINK we're just authenticating using LDAP effectively... I don't think Kerberos is functioning between the X-Serve and the Windows domain.
HodgeHi Posted February 12, 2009 Posted February 12, 2009 What permissions do you have set on the share in server admin?
Marci Posted February 12, 2009 Author Posted February 12, 2009 User groups in AD > OD Group that the AD Group is a member of: HOR Student > Student HOR Teacher > Teacher HOR ITTechTeam > SystemAdmin Permissions: Student > Read Teacher > Full Control SystemAdmin > Full Control Now, my AD Username and Password work fine to log on to any MAC with. The mac automounts my network home folder from the Windows AD Controller, and also automounts various shares from the Windows Server without prompting for further username and password (this has been done via WGM using Login Preferences for the MAC-based usergroup that my AD-based group is a member of - all the windows shares are mounted via smb) It's only sharepoints on the X-Server that fail to mount and always respond with "Invalid Username or Password".
HodgeHi Posted February 12, 2009 Posted February 12, 2009 Kerberos must be working since you had been granted a ticket. To test if you use a machine that is bound to the Xserve and authenticating using AD. Log on as an AD user. Open the Kerberos client .app Now try to open the share. This should then give you a ticket for the service used to open the share. By the way what service is being used to mount the share? AFP or SMB? Is guest access turned on for the shares? If so try removing guest access.
HodgeHi Posted February 12, 2009 Posted February 12, 2009 This is how i have one of mine set up: AFP Service: ticked AFP Guest Access: unticked SMB Service: ticked SMB Guest access: unticked enable oplocks: ticked enable strict locking: ticked inherit permissions from parent selected. FTP and NFS disabled. Enable automount: unticked spotlight: ticked time backup: unticked Permissions: ACLs AD Staff users group read and write AD Pupils group read only Posix AD administrator: read and write staff none others: none
HodgeHi Posted February 12, 2009 Posted February 12, 2009 My AFP service is set up as follows General tab Enable Bonjour: ticked Encoding: Roman Login greeting: whatever you want Access Authentication: Any method (when the AD user are created after the share-points i have found that the users fail to login when the auth type is set to kerberos only) enable masquerade: ticked unlimited client connections selected Now also don't forget the SACLs. If you have set up SACLs on the service make sure that the users you are trying to connect with have access to the services
Marci Posted February 12, 2009 Author Posted February 12, 2009 Yep, my permissions more or less same other than spotlight disabled. The share on the X-Serve that won't mount is set to use either AFP or SMB... both are enabled. Guest access is disabled for both afp and smb. Kerberos.app is showing: Ticketcache... [email protected]AL Tickets... krbtgt/[email protected] Nothing else appears when I access the SMB shares on the windows servers etc, and nothing else appears when I TRY to access the X-Server. If I disable guest access, then head to connect to server and try to connect via SMB to the x-server, I get a cifs ticket for [email protected]AL. If I try to connect to server via AFP, I get prompted for username etc - give it mine, I get "connection failed, check servername or IP Address and try again" If I give it an account local to the x-server, then it goes straight in fine, and a kerberos ticket appears for that account.
Marci Posted February 12, 2009 Author Posted February 12, 2009 AFP Service setup same as yours.... SACLs... er...? where do I check `em?
HodgeHi Posted February 12, 2009 Posted February 12, 2009 If I disable guest access, then head to connect to server and try to connect via SMB to the x-server, I get a cifs ticket for [email protected]AL.. This is the correct procedure. This is also what i get when accessing Windows shares. Tried stopping and restarting the AFP service? The SACLs are set in server admin. Click on the Xserve in the server list on the left. Then click on the settings > access. My AFP service has all users and groups allowed.
Marci Posted February 12, 2009 Author Posted February 12, 2009 All user and groups are allowed access to all services... Yep, have stopped and restarted AFP. Re: SMB in the keytab - won't show up. It sorts itself out via unix style with a good old conf file apparently so doesn't list itself as a kerberized service.
HodgeHi Posted February 12, 2009 Posted February 12, 2009 Is your Xserve an OD master too? If so try and create a user in the OD and test the shares with that user.
Marci Posted February 12, 2009 Author Posted February 12, 2009 Yep, users in OD work fine accessing AFP shares off the X-Server. Problem is, we have 2 OD users (both of which are me!), and 2000 AD users (cracking comic too), and it's the AD users that need access!
HodgeHi Posted February 12, 2009 Posted February 12, 2009 What version of OS X Server and clients are you using?
HodgeHi Posted February 12, 2009 Posted February 12, 2009 Hmmm. To be honest mate i am not entirely sure where to go next. Everything seems to be pointing correctly. There are no logs being created for errors on the Server? What about error logs for clients? Is it just this share or are all other shares the same? Is DNS working correctly for the Server? I assume it is since users can log in.
Marci Posted February 12, 2009 Author Posted February 12, 2009 Am presuming DNS working fine. Server can reach all machines and vice versa... nslookup and dig all give correct responses... This is the first share I've tried to setup on the X-Server. It's got it's netinstall share which seems to work fine for netinstall purposes, but no other shares. Have looked at all the logs I can find that I think are relevant but I'm not seeing anything relevant within `em... S'beginning to do my head in!
Marci Posted February 12, 2009 Author Posted February 12, 2009 Hmmm.... under Open Direcotry settings in ServerAdmin, General Tab... we have: LDAP Server is running Password Server is running Kerberos is stopped Relevant?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now