[SOLVED] Samba integration: NT_STATUS_LOGON_FAILURE

[gtr33m]

I'm trying to set up samba integration for Zimbra on a new server by following the instructions on Greg's post at UNIX and Windows Accounts in Zimbra LDAP and Zimbra Admin UI - Zimbra :: Wiki

My specs are Ubuntu 8.04LTS 32bit, using 5.14 OS.

I've followed the HOWTO where possible, but there are some changes in 8.04 which make things slightly different, and where possible, I used the repository versions of whatever apps were used instead of building from source. The versions in the repository were all the same or newer than those in the HOWTO, so I didn't think this would be an issue.

The one main difference is in the configuration of libpam-ldap and libnss-ldap which don't configure seperately, but configure through ldap-auth-config which is a dependency when installing either of the above packages, so installs with them. To reconfigure the original packages you need to reconfigure ldap-auth-config.

Configuring ldap-auth-config has one extra option with regards to storing passwords, for which I chose 'clear' which seemed the safest option in terms of compatibility.

Everything seems to work fine up to the very end.

I can create groups and users, and 'getent group' and 'getent passwd' both show the new groups and users. Creating an account also creates the home folder automatically.

The problem I am having is when I test using 'smbclient' which gives me the following error:

session setup failed: NT_STATUS_LOGON_FAILURE

The only account that works is an administrator account that I'm fairly sure was created to install zimbra.

One other strange behaviour that is probably related is that the root account needs to supply a password twice to log in.

There is a post that describes this same issue but no soluntion. I can stop and start samba with no errors, though I haven't checked the log.

Any pointers would be appreciated.

Regards,

Mark

[gtr33m]

Not sure exactly what solved it, but it seems to be working. I had to delete a few accounts and re-create them, but they seem to be working fine as well.

I did try:

net rpc rights grant "MYDOMAIN\Domain Admins" SeAddUsersPrivilege SeMachineAccountPrivilege SePrintOperatorPrivilege

on the samba machine, which may have fixed it, but I'm not sure.

One thing to note, I could not get any machines to join the domain without setting the WINS address in dhcp to the samba machine.

[todd_dsm]

I'll admit I'm very junior at this stuff but what worked for me was dropping the assumption that when you make the move to ldap you stop authenticating (in any way) with your passdb.tdb file. This is not the case.

Once I added the root user I was able to grant rights to Domain Admins.



# smbpasswd -a root
New SMB password: -password-
Retype new SMB password: -password-


Then, I hit the up arrow a few times, so that I would run the same exact "net rpc rights grant" command, and that did it. I hope this helps someone.

Cheers,
todd_dsm

Don't forget to Vote for this RFE:
RFE: A place To Display the contents of 'My Documents'
Reasoning: It's new, bold, and cool.