<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.9">
</HEAD>
<BODY>
Background: On this server, I am getting my user information via LDAP, and I am authenticating via kerberos to my Active Directory domain. I am also using the pam_mkhomedir setup so I don't have to create directories anymore (yay!!!). I've put it into /etc/pam.d/system-auth which takes care of ssh, gdm, and theoretically samba share mounts (somebody correct me right here if I am wrong... my user's shares will be on this server, some are now, and I want the shares to be created when they connect via windows version blah blah).<BR>
<BR>
Now, the pam_mkhomedir was not working for samba, so I turned on the "obey pam restrictions = yes" in my smb.conf file. Now, users cannot mount their directories at all (samba/pam seems to get hung up on the ACCOUNT directives in PAM), and I get messages like "smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User <username>!" in my /var/log/messages file. I've done some googling on this, and is something in my configuration not correct (but gdm, ssh work perfectly, so PAM is happy)... should I try another ACCOUNT directive (other than ACCOUNT required pam_stack.so service=system-auth), because it doesn't like it when I disable that line.<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
</TD>
</TR>
</TABLE>
<BR>
This is about the only problem I have to finish rolling out my server (except for writing a script to add unix UIDs and other info to 400 users in AD so they can log in in the first place).<BR>
<BR>
Henry Burroughs
</BODY>
</HTML>