Hello Alan, Thanks for that it does seem my setup works. I've added "winbind use default domain = yes" to my smb.conf which now reads [global] workgroup = DOMAIN realm = DOMAIN.AC.UK server string = Samba Server Version %v security = ADS password server = adn.domain.ac.uk winbind use default domain = yes Is your config similar? Neil On 13/09/10 17:41, Alan Buxey wrote:

Hi,

...

If someone who has a working freeradius samba ntlm_auth AD 2008 setup could let me know which version of samba they are using and which patches it might help me a great deal.

I have a working configuration freeradius + samba 3.0.37 + Active Directory 2003.

we moved to 2008 last year and kept exactly the same FR/samba setup - ie 3.0.x with no issue. using default CentOS supplied RPM (for SAMBA - we homebuild the FreeRADIUS from source).

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplian...

Hello, Well things have taken a turn for the worse. At the weekend we upgraded the last AD Domain controller to 2008r2 (still in AD2003 mode) and the radius servers instantly stopped working with "named pipe disconnected" and now "ntlm --username" and "wbinfo -a" no longer work. I have a samba 3.4 install which 'works' from the "ntlm --username" and "wbinfo -a" point of view but which, I strongly suspect, returns incorrect NT_KEYs. (the reason I suspect this is that the previous servers always returned the same value and that value matches the output of the python script attached to https://bugzilla.samba.org/show_bug.cgi?id=6563) I've spent the best part of the day bang head on wall so I thought I'd ask a thing Would the KEY changing every few minutes be expected? (under samba3.0/ad2003 it remained the same) By key I mean the output of "/usr/local/samba/bin/ntlm_auth --request-nt-key --username=bob --challenge=deadshortbeef --nt-response=deadlongerbeef" If no one has seen things like this I'll move over to the samba lists, getting the feeling this issue belongs there. Thanks all, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplian...

On 09/20/2010 05:29 PM, Neil Prockter wrote:

Would the KEY changing every few minutes be expected? (under samba3.0/ad2003 it remained the same) By key I mean the output of "/usr/local/samba/bin/ntlm_auth --request-nt-key --username=bob --challenge=deadshortbeef --nt-response=deadlongerbeef"

No. For a given challenge, username and password the response is the same every time.

On 21/09/10 08:57, Alan DeKok wrote:

Neil Prockter wrote:

...

Well things have taken a turn for the worse. At the weekend we upgraded the last AD Domain controller to 2008r2 (still in AD2003 mode) and the radius servers instantly stopped working with "named pipe disconnected" and now "ntlm --username" and "wbinfo -a" no longer work.

That's a Samba problem, unfortunately...

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks to all for your help. I applied the patch from https://bugzilla.samba.org/show_bug.cgi?id=7568 to samba 3.5.5. and all is well. This patch is to be included in next 3.4 and 3.5 releases so hopefully no one else will suffer the same head banging against wall confusion. Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplian...