<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3243" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>Hello
all,</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>I'm following
the howto <A
href="http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO">http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO</A> to
integrate FreeRadius with Microsoft's AD. However, I'm experiencing some
troubles.</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial><FONT size=2>My disto is
Debian 4. I had to install some packages, like krb5-kdc, krb5-user and
krb5-config, to have the file /etc/krb5.conf (It wasn't there in the first
place).</FONT></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial><FONT size=2>When I want to
do a net join, I get a message saying that I have errors in my
krb5.conf file. I removed the lines "</FONT><FONT size=2>dns_lookup_realm =
false" and "dns_lookup_kdc = false" and then it
worked.</FONT></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial><FONT size=2>At least I
think it did. I got the message: joined "PROJECT" to realm
"PROJECT.LOCAL".</FONT></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial><FONT
size=2></FONT></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial><FONT size=2>When I then
wanted to test this using wbinfo, I get the error code "NT_STATUS_NO_SUCH_USER"
(should be normal according to the howto) and another one:
"NT_STATUS_ACCESS_DENIED" Could not authenticate user myuser with
challenge/response. A try with ntlm_auth is also negative
"NT_STATUS_NO_SUCH_USER".</FONT></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>Can somebody please
help me with my problem? Am I overlooking something or what am I doing
wrong?</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>Thanks a
million,</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2>Rutger</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>Here are the 2
config files:</FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2><U>smb.conf</U></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2><BR>[global]</DIV>
<DIV> </DIV>
<DIV>## Browsing/Identification ###</DIV>
<DIV> </DIV>
<DIV> workgroup = project<BR> server string = %h
server<BR> dns proxy = no</DIV>
<DIV> </DIV>
<DIV>#### Debugging/Accounting ####</DIV>
<DIV> </DIV>
<DIV> log file = /var/log/samba/log.%m<BR> max log size
= 1000<BR> syslog = 0<BR> panic action =
/usr/share/samba/panic-action %d</DIV>
<DIV> </DIV>
<DIV>####### Authentication #######</DIV>
<DIV> </DIV>
<DIV># "security = user" is always a good idea. This will require a Unix
account<BR># in this server for every user accessing the server. See<BR>#
/usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html<BR># in the
samba-doc package for details.<BR> security = ads</DIV>
<DIV> </DIV>
<DIV># You may wish to use password encryption. See the section on<BR>#
'encrypt passwords' in the smb.conf(5) manpage before enabling.<BR>
encrypt passwords = true</DIV>
<DIV> </DIV>
<DIV># If you are using encrypted passwords, Samba will need to know what<BR>#
password database type you are using. <BR> passdb backend =
tdbsam</DIV>
<DIV> </DIV>
<DIV> obey pam restrictions = yes</DIV>
<DIV> </DIV>
<DIV>; guest account = nobody<BR> invalid users =
root</DIV>
<DIV> </DIV>
<DIV> passwd program = /usr/bin/passwd %u<BR> passwd
chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n
*password\supdated\ssuccessfully* .</DIV>
<DIV> </DIV>
<DIV># This boolean controls whether PAM will be used for password changes<BR>#
when requested by an SMB client instead of the program listed in<BR># 'passwd
program'. The default is 'no'.<BR>; pam password change = no</DIV>
<DIV> </DIV>
<DIV><BR>############ Misc ############</DIV>
<DIV> </DIV>
<DIV># Most people will find that this option gives better performance.<BR># See
smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html<BR>#
for details<BR># You may want to add the following on a Linux
system:<BR># SO_RCVBUF=8192
SO_SNDBUF=8192<BR> socket options = TCP_NODELAY</DIV>
<DIV> </DIV>
<DIV># Some defaults for winbind (make sure you're not using the ranges<BR># for
something else.)<BR> idmap uid = 10000-20000<BR> idmap
gid = 10000-20000<BR> template shell = /bin/bash<BR>
winbind use default domain = no<BR> password server =
project-ad.project.local<BR> realm = project.local</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>#======================= Share Definitions =======================</DIV>
<DIV> </DIV>
<DIV>[homes]<BR> comment = Home Directories<BR>
browseable = no</DIV>
<DIV> </DIV>
<DIV># By default, the home directories are exported read-only. Change next<BR>#
parameter to 'yes' if you want to be able to write to them.<BR>
writable = yes</DIV>
<DIV> </DIV>
<DIV># File creation mask is set to 0700 for security reasons. If you want
to<BR># create files with group=rw permissions, set next parameter to
0775.<BR> create mask = 0700</DIV>
<DIV> </DIV>
<DIV># Directory creation mask is set to 0700 for security reasons. If you want
to<BR># create dirs. with group=rw permissions, set next parameter to
0775.<BR> directory mask = 0700</DIV>
<DIV> </DIV>
<DIV># Restrict access to home directories <BR># to the one of the authenticated
user<BR># This might need tweaking when using external authentication
schemes<BR> valid users = %S</DIV>
<DIV> </DIV>
<DIV># Un-comment the following and create the netlogon directory for Domain
Logons<BR># (you need to configure Samba to act as a domain controller
too.)<BR>;[netlogon]<BR>; comment = Network Logon
Service<BR>; path = /home/samba/netlogon<BR>; guest ok =
yes<BR>; writable = no<BR>; share modes = no</DIV>
<DIV> </DIV></FONT></SPAN>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2><U>krb5.conf</U></FONT></SPAN></DIV>
<DIV><SPAN class=296454920-14022008><U><FONT face=Arial
size=2></FONT></U></SPAN> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2>[logging]<BR>default
= FILE:/war/log/krb5libs.log<BR>kdc = FILE:/var/log/krb5kdc.log<BR>admin_server
= FILE:/var/log/kadmind.log</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial
size=2>[libdefaults]<BR> default_realm = PROJECT.LOCAL<BR># dns_lookup
realm = false<BR># dns_lookup_kdc = false</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=296454920-14022008><FONT face=Arial size=2># The following
krb5.conf variables are only for MIT Kerberos.<BR> krb4_config =
/etc/krb.conf<BR> krb4_realms = /etc/krb.realms<BR> kdc_timesync =
1<BR> ccache_type = 4<BR> forwardable = true<BR> proxiable =
true</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV><SPAN
class=296454920-14022008><FONT face=Arial size=2>
<DIV><BR># The following libdefaults parameters are only for Heimdal
Kerberos.<BR> v4_instance_resolve = false<BR> v4_name_convert =
{<BR> host = {<BR> rcmd =
host<BR> ftp = ftp<BR> }<BR> plain =
{<BR> something =
something-else<BR> }<BR> }<BR> fcc-mit-ticketflags =
true</DIV>
<DIV> </DIV>
<DIV>[realms]</DIV>
<DIV> </DIV>
<DIV> PROJECT.LOCAL = {<BR> kdc =
project-ad.project.local:88<BR> admin_server =
project-ad.project.local<BR> default_domain =
project.local<BR> }</DIV>
<DIV> </DIV>
<DIV>[domain_realm]<BR> .project.local =
PROJECT.LOCAL<BR> project.local = PROJECT.LOCAL<BR>[kdc]<BR>profile =
/var/kerberos/krb5kdc/kdc.conf</DIV>
<DIV> </DIV>
<DIV>[appdefaults]<BR>pam = {<BR> debug = false<BR> ticket_lifetime =
36000<BR> renew_lifetime = 36000<BR> forwardable =
true<BR> krb4_convert = false<BR>}</DIV>
<DIV> </DIV>
<DIV>[login]<BR> krb4_convert = true<BR> krb4_get_tickets =
false</FONT></SPAN></DIV></BODY></HTML>