obey pam restrictions = yes

in smb.conf. If you use this, the home directory is created by pam when a user connect to his home directory shared with samba

Sorry for my english.

Thankyou i have corrected the problem

passwd: compat
winbindgroup: compat winbind

It should read

passwd: compat winbind
group: compat winbind

most of the login incorrect problems reported by the commenters are likely to be caused by this edit problem.

I was getting the following errors in auth.log and could not login as administrator without getting an error on login “User not known to the underlying authentication module”
auth.log:
Jan 11 22:33:44 myserver login[5180]: pam_winbind(login:auth): getting password (0×00000000)
Jan 11 22:33:44 myserver login[5180]: pam_winbind(login:auth): user ‘ADMINISTRATOR’ granted access
Jan 11 22:33:44 myserver login[5180]: pam_unix(login:account): could not identify user (from getpwnam(administrator))
Jan 11 22:33:44 myserver login[5180]: User not known to the underlying authentication module

This turned out to be an issue with nsswitch.conf so I tweaked it as follows after reading the following HOWTO http://localhost:901/swat/help/Samba3-HOWTO/FastStart.html in SWAT. Change the following lines as shown.

nsswitch.conf:
passwd: compat winbind
group: compat winbind
hosts: files dns wins winbind

My appologies I pasted the wrong text in the previous post.

I picked up an issue when using Likewise-open and the above how-to to get my Samba shares to use ADS integration. It kept on prompting for a password and the ADS usernames did not work!

I am currently running child domains on Server 2003 R2 platform. This changes the ADS schema and the ‘net ads join ….’ command does not allow you to join the domain.

If you used Likewise-open to join the domain. Please use this tutorial:

http://www.likewisesoftware.com/resources/user_documentation/Likewise-Samba-Guide.pdf

You do not need to change the krb5.conf, nsswith.conf or the PAM authentication config files at all!

I hope this saves someone from the late nights I went through to find it.

Regards,

Craig

I try and log in as a user and get the message that my password will expire in 9 days (which is correct, my AD password is due to expire).
I click on OK and then get a message: “Incorrect User name or password, letter must be typed in the correct case”
and am back at login.

But I did, AD authenticated, so why am I being blocked?

As I see it since you only once say to change something you typed:

Note:- replace ug01 netbios name with your own

That indicates to me that everything else is entered verbatim. For example instead of entering my own domain information where you have DOMAIN.INTERNAL, I enter DOMAIN.INTERNAL.

This seems wrong to me. I don’t honestly know how to proceed. It gets more maddening in krb5.conf because: 1. it seems to have been populated with my FQDN where you say I should enter DOMAIN.INTERNAL, 2. you’ve used DOMAIN.INTERNAL and domain.internal
and 3. the some of the lines are only vaguely similar but enough so that I think they suffice for what you say to enter.

So off I go looking for some other tutorial to compare with. I’m sure to be more confused by the end of all this.

I did see one little problem: the “skel” directory is not specified correctly in /etc/pam.d/common-session; it should be:

session required pam_mkhomedir.so umask=0022 skel=/etc/skel

Otherwise, the newly created home directory is not populated correctly.

I just found out it was OK.

My mistake,
Forget precedent post!

Happy finger triggered too fast…

You said

Take a backupof existing file

sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig

Create a link to /var/lib/samba

sudo ln -s /etc/samba/secrets.tdb /var/lib/samba

Could it be possible that the command is “cp” instead of “mv” in the first sudo. Otherwise the next link won’t work either.

Regards,

Bernard Tremblay

Any idea?

Thanks again.

Regards,
Vinod

Cheers
Ramesh

For the smb.conf you say to change the parameters, but those do not seem to be in the default config. Is that the resulting config, i.e. the whole of smb.conf? I assume we also need to change the DOMAIN values to match our environment?

Similar questions for the krb5.conf file.