Arch Linux

pszafer

Member

Registered: 2015-01-22

Posts: 39

[SOLVED] Winbind offline (caching) login issue

Hi, I joined my laptop to work domain, but offline login/cache is not working at all. I have to have connection to the DC all the time.

I followed Arch wiki to configure my laptop to join AD domain. I tried to follow Samba wiki also Setting_up_Samba_as_a_Domain_Member
It is working but if I stop NetworkManager it hangs as it cannot find user anymore I think.

To launch terminal it takes around five minutes and PS1 gives me:

IHaveNoName@hostname

I cannot restart system and do anything really (switch to another TTY not working as well), even reboot.

krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 dns_lookup_kdc = true
 default_realm = INTERNAL.DOMAIN.TLD
 default_ccache_name = /run/user/%{uid}/krb5cc

[domain_realm]
internal.domain.tld = INTERNAL.DOMAIN.TLD
.internal.domain.tld = INTERNAL.DOMAIN.TLD


[appdefaults]
 pam = {
   debug = true
   ticket_lifetime = 7d
   renew_lifetime = 3d
 }

smb.conf

[global]
   workgroup = INTERNAL
   security = ADS
   realm = INTERNAL.DOMAIN.TLD
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes

   winbind refresh tickets = Yes
   vfs objects = acl_xattr
   map acl inherit = Yes
   store dos attributes = Yes

   # Allow a single, unified keytab to store obtained Kerberos tickets
   dedicated keytab file = /etc/krb5.keytab
   kerberos method = secrets and keytab
   log file = /var/log/samba/my_%m.log
   log level = 20

   # Do not require that login usernames include the default domain
   winbind use default domain = yes
   # UID/GID mapping for local users
   idmap config * : backend = tdb
   idmap config * : range = 3000-7999

   # UID/GID mapping for domain users
   idmap config INTERNAL:backend = ad
   idmap config INTERNAL:schema_mode = rfc2307
   idmap config INTERNAL:range = 10000-999999
   idmap config INTERNAL:unix_nss_info = yes

   # Template settings for users without ''unixHomeDir'' and ''loginShell'' attributes 
   template shell = /bin/bash
   template homedir = /home/%U

   # Allow offline/cached credentials and ticket refresh
   winbind offline logon = Yes
   winbind nss info = rfc2307

   winbind enum users = no
   winbind enum groups = no

nsswitch.conf

passwd: files winbind systemd
group: files winbind [SUCCESS=merge] systemd
shadow: files

publickey: files

hosts: files mymachines myhostname resolve [!UNAVAIL=return] dns
networks: files

protocols: files
services: files
ethers: files
rpc: files

netgroup: files

Both commands working (tested while online)

wbinfo -u
wbinfo -g

/etc/security/pam_winbind.conf

[Global]
   debug = yes
   debug_state = yes
   try_first_pass = yes
   krb5_auth = yes
   krb5_ccache_type = FILE:/run/user/%u/krb5cc
   cached_login = yes
   silent = no
   mkhomedir = yes

/etc/pam.d/system-auth

auth      sufficient  pam_winbind.so
auth      required    pam_unix.so     try_first_pass nullok
auth      optional    pam_permit.so
auth      required    pam_env.so

account   sufficient  pam_winbind.so
account   required    pam_unix.so
account   optional    pam_permit.so
account   required    pam_time.so

password  sufficient  pam_winbind.so
password  required    pam_unix.so     try_first_pass nullok sha512 shadow
password  optional    pam_permit.so

session   required    pam_limits.so
session   required    pam_winbind.so
session   required    pam_unix.so
session   optional    pam_permit.so

Testing offline login like here https://wiki.samba.org/index.php/PAM_Of … entication is working succesfully with output: NETLOGON_CACHED_ACCOUNT
There is no krb5_ccache_type file in /run/user/%u/krb5cc , even though it's configured.

I think I should mention that GDM is also not caching username of domain user (it's not persistent after reboot).
How to fix this cache issue?

Last edited by pszafer (2021-02-10 08:36:48)

hortimech

Member

Registered: 2020-10-09

Posts: 9

Re: [SOLVED] Winbind offline (caching) login issue

OK, not an Arch user but I am willing to bet your problem is related to a similar Debian problem, the winbind cache is in the lockdir and this gets removed every time the computer reboots. Try running 'smbd -b | grep 'LOCKDIR' . Look in the directory in the output, if you see 'gencache.tdb' then that is the problem. Until Samba fixes the problem, add a line similar to ' lock directory = /var/cache/samba/' to smb.conf then reload/restart Samba. Login as a domain user at least once, then shutdown, detach from the network, reboot and try to login as the AD user again.

pszafer

Member

Registered: 2015-01-22

Posts: 39

Re: [SOLVED] Winbind offline (caching) login issue

Thanks for reply. It's not that.

I switched to SSSD.
I post my steps to configure, maybe somebody have similar problem without solution for Arch.

I basically followed manual config from this site and ldap Arch Wiki
krb5.conf

includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log

[libdefaults]
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = INTERNAL.DOMAIN.TLD

KRB5_TRACE=/dev/stdout kinit -V aduser@INTERNAL.DOMAIN.TLD.

smb.conf

[global]
   workgroup = INTERNAL
   security = ADS
   realm = INTERNAL.DOMAIN.TLD
   kerberos method = secrets and keytab
   log file = /var/log/samba/%m.log
   client signing = yes
   client use spnego = yes

sssd.conf

[code]
kinit Administrator
net ads join -k
[/code]

[sssd]
domains = internal.domain.tld
config_file_version = 2
services = nss, pam

[domain/internal.domain.tld]
cache_credentials = True
debug_level = 6
id_provider = ad
auth_provider = ad
access_provider = ad

default_shell = /bin/bash
fallback_homedir = /home/%d/%u
ldap_id_mapping = True
ldap_schema = ad
enumerate = True
ad_gpo_access_control = permissive
ad_site=internal

pam.d/system-auth

#%PAM-1.0

auth      sufficient   pam_unix.so     try_first_pass nullok
auth      optional    pam_permit.so
auth 	  sufficient pam_sss.so forward_pass
auth      required    pam_env.so

account   required    pam_unix.so
account   [default=bad success=ok user_unknown=ignore]  pam_sss.so
account   optional    pam_permit.so
account   required    pam_time.so

password  required    pam_unix.so     try_first_pass nullok sha512 shadow
password  sufficient 					pam_sss.so use_authok
password  optional    pam_permit.so

session   required 					pam_mkhomedir.so skel=/etc/skel/ umask=0022
session   required    pam_limits.so
session   required    pam_unix.so
session   optional    pam_sss.so
session   optional    pam_permit.so

chmod 600 /etc/sssd/sssd.conf
systemctl enable --now sssd
getent passwd DOMAINUSER

hortimech

Member

Registered: 2020-10-09

Posts: 9

Re: [SOLVED] Winbind offline (caching) login issue

Then I suggest you remove Samba, you can no longer use sssd with Samba, if you want shares, then you need Samba, if you just want authentication, then you can use sssd, but without Samba, You cannot use both on the same machine, no one (not even red-hat) supports the use of sssd with Samba.

pszafer

Member

Registered: 2015-01-22

Posts: 39

Re: [SOLVED] Winbind offline (caching) login issue

I disabled Samba service. I wanted mounted shares, yes, but as it's not working I'm trying to switch to SSSD+autofs for mounting shares.
According to this https://sssd.io/docs/users/ad_provider. … n-manually I need samba to obtain keytab.