Adding Samba as an NT member server

[Eksistenz]

OK - so I've installed Samba, and I've been reading all the documentation I can find, but NONE of it explains CLEARLY how to add a Samba server as a member server, with an NT PDC providing user authentication.
Can anyone please point me at some sensible information. The info I've read assumes you want Samba to operate as your PDC (which I don't). Also it seems that in order to use encrypted passwords (which you must for NT access), that I need to maintian a separate list of users and passwords for Samba - which kind of negates the whole idea of a single login.
This is driving me mad. For sanity's sake, please help...

 

[beye1850]

check here

http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba-p4.html

 

[Eksistenz]

Thanks for the info. Unfortunately, it's the same as I've already got.
I've successfully added the Linux machine to the domain, and set the options in smb.conf to use an NT PDC for logon authentication. I've then created a share and made it public. I can browse to the share on my Win2k desktop, but if I try and view the contents of the shared folder, I get a message saying the network resource doesn't exist (even though it's happily displying the folder).
After following all the steps that the documentation says you need to follow in order to use NT authentication, Samba happily rejects all user names and passwords, so it is evidently NOT looking at the NT user list.
And I thought Linux was supposed to reduce TCO!

 

[kevets]

Eksistenz,
I understand your frustration. I just went through the same problem. It will work but there is much configuration to do. I finally got it working. Before you do anything else try this; join the W2K workstation to the same NT domain the Linux server is in and logon directly to the domain, not locally. If this works then you are configured correctly. As an alternative to logging on directly to the domain, you can still logon locally but you must use the /user:domainname\userid switch on the net use command like this
NET USE X: \\linuxsrv\share /user:yourdomain\youruserid
If your local userid and password are the same on the domain you should get connected. You can then connect any additional shares, for this user, from the Linux server without using the /user switch as long as you remain connected. Apparently the logon creditials are cached.

Good luck and hang in there.
Steve

 

[fluid11]

You have a Windows NT/2000 domain? Here's what you do...

First you should have the Samba server join the domain. Create a computer account in the domain for the Linux server. If this is an Active Directory domain, make sure to select "All Pre-Windows 2000 computers to use this account", when creating the Computer Account in the domain. Next, join the Linux server to the NT domain...

smbpasswd -j domain_name -r windows_pdc

The domain is the NetBIOS name of the domain and the windows_pdc is the NetBIOS name of the Windows Primary Domain Controller.

Now your domain controllers can authenticate users for your Linux machine.

You will need the following directives in the global portion of the smb.conf file...

security = domain
password server = 'netbios_name_of_DC'
encrypt passwords = yes

In the smb.conf file, you can allow only specific users to access shares using the "valid users" directive.

[share]
path = /home/chris
writeable = yes
valid users = chris

In the above example, only the user account "chris" can access this share. The "chris" account must exist in the Windows domain. You should also create the "chris" account in /etc/passwd and apply the proper permissions on the /home/chris directory. You don't have to worry about setting any passwords for the users on the Linux box, because authentication is coming from the Windows server.

ChrisP If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[Eksistenz]

ChrisP & Steve,

Thanks for the info - sorry for not replying sooner - I've had no time to 'play' recently. I'll give it another go - I'm determined to get it working.

Many thanks,

Paul (aka eksistenz)