Administrace komentářů

Ahoj,

před časem jsem tu řešil problém s doménou a dvěma samba servery, kdy jeden je v DC modu a druhý v member modu. Ten druhý má sloužit zároveň jako datový server. Nyní jsem ve fázi, kdy ty servery spolu nějak spolupracují. V testovacím režimu mám zatím 3 uživatele a jeden share.

Přes shell se můžu přihlásit z win10 klienta do obou samb pod jmény všech uživatelů, které byly vytvořeny pouze na DC. Pokud se ale pokusím pod stejným loginem a heslem dostat přímo do dataserveru přes průzkumníka windows 10, tak mi vyskočí tabulka pro přihlašovací údaje, které když doplním stejně jako do shellu (který funguje), tak mě to odmítne přihlásit. Do samotné DC se přes průzkumníka windows 10 přihlásím. Níže je můj smb.conf

[global]
   workgroup = MOJEDOMENA
   security = ADS
   realm = MOJEDOMENA.LAN

   winbind refresh tickets = Yes
   vfs objects = acl_xattr
   map acl inherit = Yes
   store dos attributes = Yes

   dedicated keytab file = /etc/krb5.keytab
   kerberos method = secrets and keytab

   winbind use default domain = yes

   log file = /var/log/samba/%m.log
   log level = 5

# Default ID mapping configuration for local BUILTIN accounts
# and groups on a domain member. The default (*) domain:
# - must not overlap with any domain ID mapping configuration!
# - must use a read-write-enabled back end, such as tdb.
idmap config * : backend = tdb
idmap config * : range = 2000-9999
# - You must set a DOMAIN backend configuration
# idmap config for the SAMDOM domain
idmap config MOJEDOMENA : backend = rid
idmap config MOJEDOMENA : schema_mode = rfc2307
idmap config MOJEDOMENA : range = 1000000-9999999

# Template settings for login shell and home directory
template shell = /bin/bash
template homedir = /home/%U

username map = /usr/local/samba/etc/user.map

client signing = yes
client use spnego = yes

encrypt passwords = yes
 
        winbind nss info = rfc2307
        winbind trusted domains only = no
        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes

   domain master = no
   local master = no 
        

[DATA]
   comment = sdileny disk
   path = /mnt/DATA
   valid users = ****, administrator, *******
   browseable = yes         
   read only = no         
   guest ok = yes
   inherit acls = yes         
   inherit permissions = yes

Co se týče samotné samby, tak v jejím logu je tady toto:

   Key: USER_****
[2020/12/17 16:23:22.688992,  4] ../source3/smbd/sec_ctx.c:438(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2020/12/17 16:23:22.689001,  3] ../source3/auth/check_samsec.c:399(check_sam_security)
  check_sam_security: Couldn't find user '****' in passdb.
[2020/12/17 16:23:22.689011,  5] ../source3/auth/auth.c:251(auth_check_ntlm_password)
  auth_check_ntlm_password: sam_ignoredomain authentication for user [****] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2020/12/17 16:23:22.689027,  2] ../source3/auth/auth.c:334(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [****] -> [****] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2020/12/17 16:23:22.689047,  2] ../auth/auth_log.c:610(log_authentication_event_human_readable)
  Auth: [SMB2,(null)] user [WIN10]\[****] at [Čt, 17 pro 2020 16:23:22.689039 CET] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [WIN10] remote host [ipv4:192.168.100.50:63554] mapped to [WIN10]\[****]. local host [ipv4:192.168.100.20:445] 
  {"timestamp": "2020-12-17T16:23:22.689116+0100", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 0}, "status": "NT_STATUS_NO_SUCH_USER", "localAddress": "ipv4:192.168.100.20:445", "remoteAddress": "ipv4:192.168.100.50:63554", "serviceDescription": "SMB2", "authDescription": null, "clientDomain": "WIN10", "clientAccount": "****", "workstation": "WIN10", "becameAccount": null, "becameDomain": null, "becameSid": null, "mappedAccount": "****", "mappedDomain": "WIN10", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "NTLMv2", "duration": 8925}}
[2020/12/17 16:23:22.689143,  5] ../source3/auth/auth_ntlmssp.c:196(auth3_check_password)
  Checking NTLMSSP password for WIN10\**** failed: NT_STATUS_NO_SUCH_USER, authoritative=1
[2020/12/17 16:23:22.689153,  5] ../auth/ntlmssp/ntlmssp_server.c:386(ntlmssp_server_auth_send)
  ntlmssp_server_auth_send: Checking NTLMSSP password for WIN10\**** failed: NT_STATUS_NO_SUCH_USER
[2020/12/17 16:23:22.689169,  4] ../source3/smbd/sec_ctx.c:438(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2020/12/17 16:23:22.689195,  5] ../auth/gensec/gensec.c:492(gensec_update_done)
  gensec_update_done: ntlmssp[0x55e0667646f0]: NT_STATUS_NO_SUCH_USER
[2020/12/17 16:23:22.689206,  3] ../auth/gensec/spnego.c:1414(gensec_spnego_server_negTokenTarg_step)
  gensec_spnego_server_negTokenTarg_step: SPNEGO(ntlmssp) login failed: NT_STATUS_NO_SUCH_USER
[2020/12/17 16:23:22.689216,  5] ../auth/gensec/gensec.c:492(gensec_update_done)
  gensec_update_done: spnego[0x55e0667283e0]: NT_STATUS_NO_SUCH_USER
[2020/12/17 16:23:22.689227,  4] ../source3/smbd/sec_ctx.c:216(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2020/12/17 16:23:22.689235,  4] ../source3/smbd/uid.c:581(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2020/12/17 16:23:22.689243,  4] ../source3/smbd/sec_ctx.c:320(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2020/12/17 16:23:22.689251,  5] ../libcli/security/security_token.c:53(security_token_debug)
  Security token: (NULL)
[2020/12/17 16:23:22.689258,  5] ../source3/auth/token_util.c:866(debug_unix_user_token)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2020/12/17 16:23:22.689278,  4] ../source3/smbd/sec_ctx.c:438(pop_sec_ctx)

Nenapadá někoho, kde by mohla být chyba?