I already had template shell = /bin/bash in my smb.conf, and still winbind was reporting the shell as /bin/false. This is the real problem. Winbind seems to ignore the template shell directive from the config file!!! First I tried with a manually edited file, next I configured using authconfig-gtk in fedora, both give same results (ie shell reported as /bin/false. I am posting my current smb.conf here.
#======================= Global Settings ===================================== [global] #--authconfig--start-line-- # Generated by authconfig on 2008/06/04 18:09:37 # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--) # Any modification may be deleted or altered by authconfig in future workgroup = ASURITE password server = asurite2.asurite.ad.asu.edu realm = ASU.EDU security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/sh winbind use default domain = false winbind offline logon = false #--authconfig--end-line-- # ----------------------- Netwrok Related Options ------------------------- # # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH # # server string is the equivalent of the NT Description field # # netbios name can be used to specify a server name not tied to the hostname # # Interfaces lets you configure Samba to use multiple interfaces # If you have multiple network interfaces then you can list the ones # you want to listen on (never omit localhost) # # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can # specifiy it as a per share option as well # ; workgroup = ASURITE server string = Samba %v on mymachine ; netbios name = mymachine ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24 ; hosts allow = 127. 192.168.12. 192.168.13. # --------------------------- Logging Options ----------------------------- # # Log File let you specify where to put logs and how to split them up. # # Max Log Size let you specify the max size log files should reach # logs split per machine log file = /var/log/samba/log.%m # max 50KB per log file, then rotate max log size = 50 # ----------------------- Standalone Server Options ------------------------ # # Scurity can be set to user, share(deprecated) or server(deprecated) # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # security = ads # passdb backend = tdbsam # ----------------------- Domain Members Options ------------------------ # # Security must be set to domain or ads # # Use the realm option only with security = ads # Specifies the Active Directory realm the host is part of # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Use password server option only with security = server or if you can't # use the DNS to locate Domain Controllers # The argument list may include: # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name] # or to auto-locate the domain controller/s # password server = * ; security = ads passdb backend = tdbsam ; realm = ASU.EDU ; password server = asurite2.asurite.ad.asu.edu # ----------------------- Domain Controller Options ------------------------ # # Security must be set to user for domain controllers # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Domain Master specifies Samba to be the Domain Master Browser. This # allows Samba to collate browse lists between subnets. Don't use this # if you already have a Windows NT domain controller doing this job # # Domain Logons let Samba be a domain logon server for Windows workstations. # # Logon Scrpit let yuou specify a script to be run at login time on the client # You need to provide it in a share called NETLOGON # # Logon Path let you specify where user profiles are stored (UNC path) # # Various scripts can be used on a domain controller or stand-alone # machine to add or delete corresponding unix accounts # ; security = user ; passdb backend = tdbsam ; domain master = yes ; domain logons = yes # the login script name depends on the machine name ; logon script = %m.bat # the login script name depends on the unix user used ; logon script = %u.bat ; logon path = \\%L\Profiles\%u # disables profiles support by specifing an empty path ; logon path = ; add user script = /usr/sbin/useradd "%u" -n -g users ; add group script = /usr/sbin/groupadd "%g" ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u" ; delete user script = /usr/sbin/userdel "%u" ; delete user from group script = /usr/sbin/userdel "%u" "%g" ; delete group script = /usr/sbin/groupdel "%g" # ----------------------- Browser Control Options ---------------------------- # # set local master to no if you don't want Samba to become a master # browser on your network. Otherwise the normal election rules apply # # OS Level determines the precedence of this server in master browser # elections. The default value should be reasonable # # Preferred Master causes Samba to force a local browser election on startup # and gives it a slightly higher chance of winning the election ; local master = no ; os level = 33 ; preferred master = yes #----------------------------- Name Resolution ------------------------------- # Windows Internet Name Serving Support Section: # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both # # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server # # - WINS Server: Tells the NMBD components of Samba to be a WINS Client # # - WINS Proxy: Tells Samba to answer name resolution queries on # behalf of a non WINS capable client, for this to work there must be # at least one WINS Server on the network. The default is NO. # # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names # via DNS nslookups. ; wins support = yes wins server = 129.219.17.11 129.219.13.105 129.219.17.194 ; wins proxy = yes ; dns proxy = yes # --------------------------- Printing Options ----------------------------- # # Load Printers let you load automatically the list of printers rather # than setting them up individually # # Cups Options let you pass the cups libs custom options, setting it to raw # for example will let you use drivers on your Windows clients # # Printcap Name let you specify an alternative printcap file # # You can choose a non default printing system using the Printing option load printers = yes cups options = raw ; printcap name = /etc/printcap #obtain list of printers automatically on SystemV ; printcap name = lpstat ; printing = cups # --------------------------- Filesystem Options --------------------------- # # The following options can be uncommented if the filesystem supports # Extended Attributes and they are enabled (usually by the mount option # user_xattr). Thess options will let the admin store the DOS attributes # in an EA and make samba not mess with the permission bits. # # Note: these options can also be set just per share, setting them in global # makes them the default for all shares ; map archive = no ; map hidden = no ; map read only = no ; map system = no ; store dos attributes = yes #============================ Share Definitions ============================== [homes] comment = Home Directories browseable = no writable = yes ; valid users = %S ; valid users = MYDOMAIN\%S [printers] comment = All Printers path = /var/spool/samba browseable = no guest ok = no writable = no printable = yes # Un-comment the following and create the netlogon directory for Domain Logons ; [netlogon] ; comment = Network Logon Service ; path = /var/lib/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no # Un-comment the following to provide a specific roving profile share # the default is to use the user's home directory ; [Profiles] ; path = /var/lib/samba/profiles ; browseable = no ; guest ok = yes # A publicly accessible directory, but read only, except for people in # the "staff" group ; [public] ; comment = Public Stuff ; path = /home/samba ; public = yes ; writable = yes ; printable = no ; write list = +staff This one was generated after using the authconfig-gtk in fedora 9 . On Wednesday 04 June 2008 19:36:10 Philipoff, Andrew wrote: > Edit your smb.conf and restart smbd: > Change: > template shell = /bin/false > To: > template shell = /bin/bash > > Be careful in enabling this as it will potentially allow all domain users > to login with a shell. We add the following to /etc/pam.d/sshd to restrict > ssh shell access to specific AD and local groups (substitute your AD or > local group for group_name): account sufficient pam_succeed_if.so user > ingroup group_name > > You'll need to restart sshd after editing /etc/pam.d/sshd. Note that you'll > also need to add any local users/groups that need ssh access. I found how > to do this here: > http://blogs.sun.com/tkblog/entry/integrating_linux_with_active_directory > http://linux.die.net/man/8/pam_succeed_if > You could also add AD users to a local group and use it in /etc/pam.d/sshd > instead of an AD group. > > Andrew Philipoff > Information Systems > Department of Medicine, UCSF > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Aniket Bharaswadkar Sent: Wednesday, June 04, 2008 4:32 PM > To: samba@lists.samba.org > Subject: [Samba] Problem with Login Shell in User Information using Winbind > > Hi all > > I am trying to get windows AD logins to work with Fedora 8/9 linux.I had > the same setup working well with fedora 7 , but with fedora 8/9 the > problem is whenever I do "getent passwd 'username'" the login shell is > listed as /bin/false and users cannot login , even though I have set it > to use template shell= /bin/bash in the smb.conf configuration file. > Also I have made the necessary changes to krb.conf , krb.realms and > krb5.conf files for kerberos configuration and obtained the tickets > using "kinit" . "klist" shows that I have the tickets. > > I have enabled pam_mkhomedir.so , so if I try my windows AD login by > doing "su username" , it shows messages about creating home directory , > and gets me back to my local user prompt, due to no login shell. Also, > if I input the wrong password , it says wrong password. So > authentication seems working fine. For more info , here is the output of > getent , > > admin:*:16777216:16777216:admin:/home/ASURITE/admin:/bin/false > > I am running samba 3.2.0-rc1 version which shipped with Fedora 9 . > > Please advise me how to set the login shells as /bin/bash, as currently > no domain users can login to my server. > > Aniket -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba