Only ROOT can login

[nkiefer]

I installed SUSE 9.0 Enterprise and am trying to configure SAMBA 3.0 as a PDC so my win2kServer can join the domain. From the win2k pc I can join the samba domain only if I login to the win2k pc as "root". I f I try to login to the domain as a user I get the message "the domain mmfLinux is not available!".

Here is my smb.conf file:

# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE
# Date: 2004-06-30
[global]
workgroup = MMFLINUX
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
printer admin = @ntadmin, root, administrator
username map = /etc/samba/smbusers
map to guest = Bad User
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
security = user
encrypt passwords = yes
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain logons = yes
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=Computers
local master = yes
wins support = yes
netbios name = mmfLinux
domain master = yes
preferred master = yes
os level = 65
ldap suffix = dc=example,dc=com
[homes]
comment = Home Directories
valid users = %S
browseable = no
read only = No
inherit permissions = Yes
guest ok = no
printable = no
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700
browseable = yes
guest ok = no
printable = no
[users]
comment = All users
path = /home
read only = No
inherit permissions = Yes
veto files = /aquota.user/groups/shares/
browseable = yes
guest ok = no
printable = no
[groups]
comment = All groups
path = /home/groups
read only = No
inherit permissions = Yes
browseable = yes
guest ok = no
printable = no
[pdf]
comment = PDF creator
path = /var/tmp
printable = yes
print command = /usr/bin/smbprngenpdf -J '%J' -c %c -s %s -u '%u' -z %z
create mask = 0600
browseable = yes
guest ok = no
[printers]
comment = All Printers
path = /var/tmp
printable = yes
create mask = 0600
browseable = no
guest ok = no
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775
browseable = yes
guest ok = no
printable = no

There is an smbusers file in my ../etc/samba folder and it contains this:
# This file allows you to map usernames from the clients to the server.
# Unix_name = SMB_name1 SMB_name2 ...
#
# See section 'username map' in the manual page of smb.conf for more
# information.

root = administrator admin
;nobody = guest pcguest smbguest


Do I need to manually add each user to this file? I was hoping that I would create a user on the linux pc and that samab would let anyone who has an account on Linux in.

 

[lgarner]

Anyone who has a Samba account, that is. As I recall, only root can join a domain; this is normal.

Samba doesn't use passwd and shadow files. It maintains its own set. I don't know if pam could be used to have a single password, but I think you'd still have to manually add the users to the smbuser file.

 

[nkiefer]

So the procedure would be to add all of the windows users to the smbusers file. Then go to each machine, login as normal and join the domain. When prompted for someone who can join the domain use root.

If a user is not in the smbusers file they cannot join the samba domain?
An account on the Linux server for each windows network user is not required?
Does using LDAP authentication vs etc/passwrd make this any easier?

 

[clonny2]

You need to add the users to the smbpasswd file. SMBUSERS i belive is just a file that says if I come in as any of these users it is equivaliant to the one specified. if, if I map as administrator then that is equivaliant to root.

Make sure you add all of the users in your domain to the smbpasswd file by using smbpasswd -a. Man smbpasswd to get the exact syntax to meet your needs.

In addition each user must first be created on the PDC to be able to map the samba user to a linux user.

Thirdly, you need admin rights on the windows pc to join the domain. So I think you mean be able to login to the domain.

You can also get doc directly from samba.org on specifically how to setup a Samba PDC.

I hope that helps some.

>---------------------------------------Lawrence Feldman
SR. QA. Engineer SNAP Appliance
lfeldman@snapappliance.com