Configuring Samba

[dhicks]

In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Administrative Templates, expand System, click Net Logon, and then double-click Allow cryptography algorithms compatible with Windows NT 4.0.

 

I've turned the above option off, rebooted the DC and the Debian machine trying to authenticate against it and things now seem to work - running "wbinfo -t" to test the trust secret returns success. I don't remember changing anything to actually achive this - maybe you just need to glare at the computer long enough and it'll just kind of feel embarresed and start working? The things I were about to double-check were clock skew (Windows Server 2008 R2 seemingly allows a clock skew of 5 minutes by default, and I could have sworn there was a discrepancy before I rebooted everything, so maybe that was it?) and firewall permissions for Kerberos authentication.

[morganw]

How can you actually tell if Kerberos authentication is being used? I've got a valid krb5.conf (tested with kinit on the server) and I've joined the domain using the ads option, but I haven't configured a keytab for Samba. So am I right in thinking that even though the system itself can use Kerberos correctly, when I'm connecting from a client I'm actually using some other auth type like lanman or ntlm? I've only found one guide which referenced the keytab and that says to use the option "kerberos method = system keytab" in smb.conf. All the other guides I've found seem to just get the realm details into krb5.conf and then just use any old auth method when connecting. To test I've tried putting bad configuration data into krb5.conf and everything keeps working (except the kinit test).

[dhicks]

  valid users = @"CONVENT+Domain Users"
  admin users = @"CONVENT+Domain Admins"

 

Turns out that you stopped neading the "valid" part about 10 years ago, and if you have a Windows 7/8 machine you'll get an "Access Denied" on trying to access the share. This should now be a single line:

 

  users = @"CONVENT+Domain Users"