Ric_ Posted March 30, 2007 Posted March 30, 2007 I want to use winbind authentication on a site set up using Apahce on Debian Testing. The Apache config (before authentication options) all works. The box has a working Winbind implementation. These are the relevant snippits added to the config... Apache site config (/etc/apache2/sites-enabled/pykota) ... # Authentication stuff follows AuthName "PyKota" AuthPAM_Enabled on AuthType Baisc Require valid-user Apache module config (/etc/apache2/mods-enabled/auth_pam.load) LoadModule auth_pam_module /usr/lib/apache2/modules/mod_auth_pam.so PAM config (/etc/pam.d/apache2) @include common-auth @include common-account #%PAM-1.0 auth required pam_winbind.so account required pam_winbind.so HELP!
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 Still doesn't work mind! From the Apache error log... [Fri Mar 30 09:10:23 2007] [error] [client 192.168.1.30] (9)Bad file descriptor: Could not open password file: (null)
Geoff Posted March 30, 2007 Posted March 30, 2007 auth required pam_winbind.so account required pam_winbind.so This is incorrect. Try this instead (don't bother with the includes). auth sufficient pam_winbind.so debug auth required pam_unix.so nullok_secure debug account sufficient pam_unix_acct.so debug account required pam_winbind.so debug
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 @Geoff: Still doesn't work... [Fri Mar 30 10:16:05 2007] [error] Internal error: pcfg_openfile() called with NULL filename [Fri Mar 30 10:16:05 2007] [error] [client 192.168.1.30] (9)Bad file descriptor: Could not open password file: (null)
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 where's that at Geoff? I cannot seem to find it :oops:
Geoff Posted March 30, 2007 Posted March 30, 2007 This how you can find out (In this instance, the machine is Ubuntu 6.06 LTS AMD64 Server): root@titan:~# netstat -ap | grep winbind.*pipe unix 2 [ ACC ] STREAM LISTENING 9167 3862/winbindd /tmp/.winbindd/pipe unix 2 [ ACC ] STREAM LISTENING 9170 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203312030 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308842 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308824 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308820 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308788 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308765 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308733 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308725 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308721 3862/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 203308715 3862/winbindd /var/run/samba/winbindd_privileged/pipe
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 OK... output is debian-02:/etc# netstat -ap | grep winbind.*pipe unix 2 [ ACC ] STREAM LISTENING 1233638 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ACC ] STREAM LISTENING 1233636 29611/winbindd /tmp/.winbindd/pipe unix 3 [ ] STREAM CONNECTED 1374247 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1374243 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1372204 29611/winbindd /tmp/.winbindd/pipe unix 3 [ ] STREAM CONNECTED 1372091 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1372087 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371981 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371624 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371620 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371524 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371520 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371516 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371512 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1371508 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1368759 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1368755 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1368298 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1368294 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1366457 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1366453 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1324497 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1297531 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1238739 29611/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238084 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238080 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238058 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238054 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238041 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238037 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238022 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1238018 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1235117 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 2 [ ] STREAM CONNECTED 1235113 30953/winbindd /var/run/samba/winbindd_privileged/pipe unix 3 [ ] STREAM CONNECTED 1234121 29611/winbindd /var/run/samba/winbindd_privileged/pipe debian-02:/etc# ls -l /var/run/samba/winbindd_privileged/ total 0 srwxrwxrwx 1 root root 0 2007-03-27 11:43 pipe debian-02:/etc# ls -l /tmp/.winbindd/ total 0 srwxrwxrwx 1 root root 0 2007-03-27 11:43 pipe Access looks OK to me :?
Geoff Posted March 30, 2007 Posted March 30, 2007 No. Whats the permissions on the directory containing the pipe?
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 drwxr-xr-x 2 root root 4096 2007-03-27 11:43 .winbindd Access permissions still look OK to me.
Ric_ Posted March 30, 2007 Author Posted March 30, 2007 drwxr-xr-- 2 root winbindd_priv 4096 2007-03-27 11:43 winbindd_privileged Looks OK.
ICTNUT Posted March 19, 2008 Posted March 19, 2008 (edited) @Ric_: Did you ever get this to work. I am at the same stage as you were: [Wed Mar 19 16:41:03 2008] [error] Internal error: pcfg_openfile() called with NULL filename [Wed Mar 19 16:41:03 2008] [error] [client 192.168.51.76] (9)Bad file descriptor: Could not open password file: (null) I have checked all permissions as per this thread but still no joy, I would love to get the personal quota check working. This is what I have in my sites-enabled/000-default NameVirtualHost * ServerAdmin [email protected] DocumentRoot /usr/share/pykota Options FollowSymLinks AllowOverride None Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all AuthName "Printer Quota Check" AuthPAM_Enabled on AuthBasicAuthoritative off AuthType Basic require valid-user require SSL ScriptAlias /cgi-bin/ /usr/share/pykota/cgi-bin/ AllowOverride None Options ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all ErrorLog /var/log/apache2/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog /var/log/apache2/access.log combined ServerSignature On And i do get the logon box when I hit the site but nothing else..... Edited March 19, 2008 by ICTNUT
ICTNUT Posted March 19, 2008 Posted March 19, 2008 Geoff, is there anything special I need to do or is it just a case of changing the required directives in order to use LDAP?? Anything I should look out for? Many thanks
Ric_ Posted March 19, 2008 Author Posted March 19, 2008 @ICTNUT: Unfortunately I never did sort this... if Geoff could provide a little guide
Geoff Posted March 20, 2008 Posted March 20, 2008 (edited) I'm using apache2 on ubuntu here, so auth_ldap comes as standard. All I had to do was enable the module. a2enmod auth_ldap Here's the snippet you need in your Location or Directory section to make it password protected: AuthLDAPAuthoritative on AuthType Basic AuthName "YourSiteName" AuthLDAPUrl "ldap://domaincontroller.:389/OU=OUName,DC=domain,DC=domain,DC=tld?sAMAccountName?sub?(objectclass=person)" AuthLDAPBindDN "cn=domainaccount,cn=users,dc=domain,dc=domain,dc=tld" AuthLDAPBindPassword Password require valid-user If you want to be more specific, you will have to change the AuthLDAPUrl line so it points to a more specifc url and/or alter the require line to require a group/user/etc. Edited March 20, 2008 by Geoff 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now