Prev: ERROR: Unable to fetch machine password for DLEL70$@ in domain
Next: Password policy doesn't work (pdbedit)
From: Christopher Swingley on 14 Sep 2009 16:40
Greetings!

I'm trying to get an OpenLDAP (2.4.15-1ubuntu3), Samba PDC
(2:3.3.2-1ubuntu3.1) running under Ubuntu Jaunty. I've followed the
instructions on the Ubuntu server guide
(https://help.ubuntu.com/9.04/serverguide/C/samba-ldap.html) as closely
as possible (twice. . .), and spent some time with Chapter 5 of the
Samba3 By Example book, trying to use it to get things working. But I
can't seem to join a computer to the domain, and I've run out of ideas.
I'd like some help trying to identify where I've gone wrong and how to
get the server to allow desktops to join.

There are three user accounts in the LDAP database, 'nobody', 'root' and
'cswingley':

# ldapsearch -xLLL -b 'ou=People,dc=abrinc,dc=com' uid uidNumber
dn: ou=People,dc=abrinc,dc=com

dn: uid=root,ou=People,dc=abrinc,dc=com
uid: root
uidNumber: 0

dn: uid=nobody,ou=People,dc=abrinc,dc=com
uid: nobody
uidNumber: 65534

dn: uid=cswingley,ou=People,dc=abrinc,dc=com
uid: cswingley
uidNumber: 522

Both 'root' and 'cswingley' are able to connect to the server with
smbclient using their account passwords set up in LDAP. Both accounts
are also in the "Domain Admins" group:

# getent group | grep "Domain Admins"
Domain Admins:*:512:root,cswingley

'cswingley' has the SeMachineAccountPrivilege right, as does the "Domain
Admins" group:

# net rpc rights list accounts -U root%PASSWD
TESTDOM\cswingley
SeMachineAccountPrivilege

TESTDOM\Domain Admins
SeMachineAccountPrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege

Here are a few of the /etc/samba/smb.conf settings that seem relevant:

passdb backend = ldapsam:ldap://127.0.0.1
ldap admin dn = cn=admin,dc=test,dc=com
add machine script = sudo /usr/sbin/smbldap-useradd -t 0 -w "%u"
domain logons = yes
wins support = yes
log level = 3 passdb:10 auth:10

When I try to join a Windows XP SP3 computer to the domain as 'root' (or
'TESTDOM\root'), I get 'Logon failure: unknown user or bad password'.
When I try to join using my account (cswingley), I get 'Access is
denied'. Adding the computer to LDAP manually using
'smbldap-useradd -w' doesn't make a difference.

I'm not seeing anything in the logs that look like login failures or
some other obvious mistake errors, so I don't know where to go next or
what else to try. I feel like I'm missing something very simple,
because everything goes exactly as expected when I follow along in the
guides. But at the end of the day, it doesn't work. Help and advice
greatly appreciated.

Thanks!

Chris
--
Christopher S. Swingley
http://swingleydev.com/
<cswingle(a)gmail.com>

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
 | 
Pages: 1
Prev: ERROR: Unable to fetch machine password for DLEL70$@ in domain
Next: Password policy doesn't work (pdbedit)