我有一台 OpenSUSE Tumbleweed 服务器,它是 Windows 域的一部分,使用 sssd 进行用户身份验证。对于 ssh,这可以正常工作,但我无法让它与 Samba 一起工作。当从 Windows 客户端访问 Samba 共享时,系统多次要求我输入密码,但无法访问共享。在 Linux 服务器上的日志中,我看到以下错误消息:
Aug 28 17:50:20 <server> smbd[3575]: [2020/08/28 17:50:20.751092, 0] ../../source3/auth/token_util.c:565(add_local_groups)
Aug 28 17:50:20 <server smbd[3575]: add_local_groups: SID S-1-5-21-1909068044-192024690-1575050150-1861 -> getpwuid(10000) failed, is nsswitch configured?
nsswitch.conf:
passwd: compat sss
group: compat sss
smb.conf:
[global]
workgroup = DOMAIN
realm = DOMAIN.TLD
interfaces = eth0, 172.20.0.0/16, 127.0.0.1/8
security = ADS
domain master = No
ldap ssl = no
idmap config DOMAIN : backend = sss
idmap config DOMAIN : range = 10000-20000
winbind refresh tickets = yes
winbind use default domain = yes
winbind offline logon = false
winbind enum users = yes
winbind enum groups = yes
# passdb backend = tdbsam
# kerberos method = secrets and keytab
# kerberos method = secrets only
kerberos method = system keytab
map to guest = Bad User
usershare allow guests = No
client signing = yes
client use spnego = yes
log level = 3
load printers = No
printing = bsd
printcap name = /dev/null
disable spoolss = yes
sssd.conf:
[sssd]
config_file_version = 2
services = nss, pam
domains = domain.de
[nss]
filter_users = root
filter_groups = root
[pam]
[domain/domain.de]
ad_domain = domain.de
krb5_realm = DOMAIN.DE
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
以下命令按预期工作:
> id [email protected]
> getent passwd domain\\username
我究竟做错了什么?
答案1
回答我自己的问题:我将域身份验证从 sssd 切换到 winbind,并且运行良好。