• [^] # Re: synchro temp ?

    Posté par . En réponse au message Samba : compte machine expire sans raison. Évalué à 2.

    Pour l'horloge, je n'avais que 2 minutes d'écart. Et après remise à l'heure, problème identique.

    Voila les logs que j'ai récupéré en faisant depuis la station (avec un compte local) une tentative de connexion au domaine avec "su - user1"

    Sur la station "station1"
    ==> /var/log/auth.log <==
    May 7 11:57:42 station1 su[6830]: pam_unix(su:auth): authentication failure; logname=administrateur uid=1000 euid=0 tty=/dev/pts/1 ruser=administrateur rhost= user=user1
    May 7 11:57:42 station1 su[6830]: pam_winbind(su:auth): getting password (0x00000210)
    May 7 11:57:42 station1 su[6830]: pam_winbind(su:auth): pam_get_item returned a password
    May 7 11:57:42 station1 su[6830]: pam_winbind(su:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_SYSTEM_ERR (4), NTSTATUS: NT_STATUS_ACCESS_DENIED, Error message was: Access denied
    May 7 11:57:42 station1 su[6830]: pam_winbind(su:auth): internal module error (retval = PAM_SYSTEM_ERR(4), user = 'user1')
    May 7 11:57:44 station1 su[6830]: pam_authenticate: Authentication failure
    May 7 11:57:44 station1 su[6830]: FAILED su for user1 by administrateur
    May 7 11:57:44 station1 su[6830]: - /dev/pts/1 administrateur:user1
    Sur le serveur "serveur"
    ==> samba/log.station1 <==
    [2010年05月07日 11:57:42, 0] rpc_server/srv_netlog_nt.c:_netr_ServerAuthenticate2(520)
    _netr_ServerAuthenticate2: netlogon_creds_server_check failed. Rejecting auth request from client STATION1 machine account STATION1$
    [2010年05月07日 11:57:42, 0] rpc_server/srv_netlog_nt.c:_netr_ServerAuthenticate2(520)
    _netr_ServerAuthenticate2: netlogon_creds_server_check failed. Rejecting auth request from client STATION1 machine account STATION1$
    Voilà les fichiers de conf de la station.
    /etc/samba/smb.conf
    [global]
    workgroup = domaine1
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    template shell = /bin/bash
    template homedir = /home/%D/%U
    winbind enum users = yes
    winbind enum groups = yes
    winbind cache time = 10
    winbind separator = +
    winbind offline logon = yes
    security = domain
    password server = 192.168.1.1
    winbind use default domain = yes
    wins server = 192.168.1.1
    server string = %h server (Samba, Ubuntu)
    dns proxy = no
    log file = /var/log/samba/log.%m
    max log size = 1000
    syslog = 0
    panic action = /usr/share/samba/panic-action %d
    encrypt passwords = true
    passdb backend = tdbsam
    obey pam restrictions = yes
    unix password sync = yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    pam password change = yes
    map to guest = bad user
    usershare allow guests = yes
    [printers]
    comment = All Printers
    browseable = no
    path = /var/spool/samba
    printable = yes
    guest ok = no
    read only = yes
    create mask = 0700
    [print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers
    browseable = yes
    read only = yes
    guest ok = no
    /etc/pam.d/common-account
    account sufficient pam_winbind.so
    account sufficient pam_unix.so
    account requisite pam_deny.so
    account required pam_permit.so
    /etc/pam.d/common-auth
    auth [success=2 default=ignore] pam_unix.so nullok_secure
    auth [success=1 default=ignore] pam_winbind.so use_first_pass
    auth requisite pam_deny.so
    auth required pam_permit.so
    auth optional pam_mount.so
    /etc/pam.d/common-password
    password [success=1 default=ignore] pam_unix.so obscure sha512
    password requisite pam_deny.so
    password required pam_permit.so
    password optional pam_gnome_keyring.so
    /etc/pam.d/common-session
    session [default=1] pam_permit.so
    session requisite pam_deny.so
    session required pam_permit.so
    session required pam_unix.so
    session optional pam_mount.so
    session optional pam_ck_connector.so nox11
    session required pam_mkhomedir.so umask=0022 skel=/etc/skel
    /etc/pam.d/common-session-noninteractive
    session [default=1] pam_permit.so
    session requisite pam_deny.so
    session required pam_permit.so
    session required pam_unix.so
    session optional pam_mount.so
    /etc/nsswitch.conf
    passwd: compat winbind
    group: compat winbind
    shadow: compat
    hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 wins
    networks: files
    protocols: db files
    services: db files
    ethers: db files
    rpc: db files
    netgroup: nis
    Le smb.conf du serveur
    [global]
    workgroup = domaine1
    server string = %h server
    wins support = yes
    dns proxy = no
    log file = /var/log/samba/log.%m
    max log size = 1000
    syslog = 0
    panic action = /usr/share/samba/panic-action %d
    encrypt passwords = true
    passdb backend = tdbsam
    obey pam restrictions = yes
    unix password sync = yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    pam password change = yes
    domain logons = yes
    logon script = %G.bat
    [homes]
    comment = Home Directories
    browseable = no
    writable = yes
    create mask = 0700
    directory mask = 0700
    valid users = %S
    [netlogon]
    comment = Network Logon Service
    path = /home/samba/netlogon
    guest ok = yes
    read only = yes
    share modes = no
    [profiles]
    comment = Users profiles
    path = /home/samba/profiles
    guest ok = no
    browseable = no
    create mask = 0600
    directory mask = 0700
    [printers]
    comment = All Printers
    browseable = no
    path = /var/spool/samba
    printable = yes
    guest ok = no
    read only = yes
    create mask = 0700
    [print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers
    browseable = yes
    read only = yes
    guest ok = no