adding 'nix box to domain

[browolf]

been trying to get this and logging on with doman accounts working.

managed to get it on the domain,

kerberos works

winbind works

pam doesnt seem to work.

 

i had it at the point where if i tried to use a domain account to login thru ssh, it just said access denied. I'm not sure where to find out what that means.

 

unfortunately i fiddled with it some more and now i've locked myself out. if i use a domain account it says access denied and if i use my own debian account it mysteriously closes putty and the root account says access denied too.

i was using the pam instructions on here, Howto: Ubuntu server as an Active Directory member server - Ubuntu Forums

 

i've managed to get in with init=/bin/sh but not sure what to do now

Edited December 3, 2008 by browolf
typos

[Geoff]

You've broken the PAM configuration. I've read the instructions they've posted an they are correct. Thus re-read and follow through the "Configure PAM to use Winbind for workstations authentication" section and fix whatever you broke.

[browolf]

You've broken the PAM configuration. I've read the instructions they've posted an they are correct. Thus re-read and follow through the "Configure PAM to use Winbind for workstations authentication" section and fix whatever you broke.

 

actually what i've done is, changed the settings to these settings

Configure PAM

 

and i can get back in again, cos i figured what ever me & those settings did they broke local logins. unexpectedly domain logins now work too! although that might have something to do with replacing ssh with ssh-krb5

but now chdir to home directory doesnt work. there's always one more thing thats broke lol

Edited December 3, 2008 by browolf

[CyberNerd]

unexpectedly domain logins now work too!

 

congrats,

 

A follow up question (and probably a rather noobish one considering I have 1600 accounts on a samba share!):

I've been using domain logins for some time now, but my domain account doesn't have rights to things like cdrom because it isn't in the local cdrom group.

How do I map AD groups to unix groups in samba ?

[Marc]

Ubuntu now has like-wise open in the repo's for 8.04 onwards. Takes all the hassle out of making ubuntu talk to windows:

 

https://help.ubuntu.com/8.04/serverguide/C/likewise-open.html

[browolf]

it seems like cheating to use such things lol. anyway adding the computer to the domain I can manage. it's always pam i have trouble with.

 

like i copied all the settings from the original debian virtual machine i had it working on to an ubuntu pc. does it work? does it buggery. every guide i look at on the net seems to have a different settings...

[Geoff]

How do I map AD groups to unix groups in samba ?

 

net groupmap add unixgroup=cdrom type=domain ntgroup="DOMAIN\Domain Users" comment="Allow Domain Users to use local CD drives."

[browolf]

Ubuntu now has like-wise open in the repo's for 8.04 onwards. Takes all the hassle out of making ubuntu talk to windows:

 

https://help.ubuntu.com/8.04/serverguide/C/likewise-open.html

 

so in the end i've tried this and it added to domain: success, login as domain user failed. still end up with no logon servers when i try to logon.

[Marc]

There's a bug with that package that means the likewise daemon does not get started at boot up...

 

sudo update-rc.d likewise-open defaults

 

That one got me too

[browolf]

hmm it said

 

system startup links for /etc/init.d/likewise-open already exist

 

it's funny when I logon with my account that also exists on the domain with the same pass i have to put in my password twice, then it says no logon servers then it lets me in. i can connect to shares on a windows server with my account.

 

I dont really understand why it's this hard to make work domain logins work....been trying for days with various different instructions.

 

I can only imagine there's something wrong on the actual domain.

 

now i remember why I despise gui-driven linux

Edited December 8, 2008 by browolf

[browolf]

tried again with different instructions. started afresh

Aerospace Software Ltd.

 

still got the same old login failure but the errors are here

 

Dec  9 15:55:10 ubuntu gdm[4922]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=ntstaff
Dec  9 15:55:26 ubuntu gdm[4922]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=ACADEMIC+andy
Dec  9 15:55:42 ubuntu gdm[4922]: pam_winbind(gdm:auth): getting password (0x00000000)
Dec  9 15:55:47 ubuntu gdm[4922]: pam_winbind(gdm:auth): user 'mother' granted access
Dec  9 15:55:47 ubuntu gdm[4922]: pam_unix(gdm:session): session opened for user mother by (uid=0)
Dec  9 15:55:47 ubuntu gdm[4922]: pam_ck_connector(gdm:session): nox11 mode, ignoring PAM_TTY :0
Dec  9 15:55:47 ubuntu gdm[4922]: gnome-keyring-daemon: couldn't lookup keyring component setting: Failed to contact configuration server; some possible causes are that you need to enable TCP/IP networking for ORBit, or you have stale NFS locks due to a system crash. See http://www.gnome.org/projects/gconf/ for information. (Details -  1: Failed to get connection to session: dbus-launch failed to autolaunch D-Bus session: No protocol specified
Dec  9 15:55:47 ubuntu gdm[4922]: Autolaunch error: X11 initialization failed.
Dec  9 15:55:47 ubuntu gdm[4922]: )gnome-keyring-daemon: couldn't lookup ssh component setting: Failed to contact configuration server; some possible causes are that you need to enable TCP/IP networking for ORBit, or you have stale NFS locks due to a system crash. See http://www.gnome.org/projects/gconf/ for information. (Details -  1: Failed to get connection to session: dbus-launch failed to autolaunch D-Bus session: No protocol specified
Dec  9 15:55:47 ubuntu gdm[4922]: Autolaunch error: X11 initialization failed.
Dec  9 15:55:47 ubuntu gdm[4922]: )gnome-keyring-daemon: couldn't lookup pkcs11 component setting: Failed to contact configuration server; some possible causes are that you need to enable TCP/IP networking for ORBit, or you have stale NFS locks due to a system crash. See http://www.gnome.org/projects/gconf/ for information. (Details -  1: Failed to get connection to session: dbus-launch failed to autolaunch D-Bus session: No protocol specified
Dec  9 15:55:47 ubuntu gdm[4922]: Autolaunch error: X11 initialization failed.
Dec  9 15:55:48 ubuntu gdm[4922]: )

[Geoff]

Does a non-graphical login work?