Hi, Yes, my goal is to setup an Active Directory substitution, but not looking for a complete AD replacement. I really don't want to use windows active directory. In my organization around 60% of the users are using Linux as their desktop, remaining 40% is on windows XP SP3. I want to setup single sign on using free IPA, I found the attached document on the internet, so I tried to setup samba as a client to freeIPA and autheticate windows clients to samba and samba to freeIPA. (I tried this because I was struggling with windows to authenticate to the kerberos) Please have a look at the attached document, I will try your suggestions and post the results. Wishing you all a Happy and peaceful NEW YEAR. Thanks & Regards Viji <div class="gmail_quote">On Wed, Dec 31, 2008 at 9:22 PM, Kozlov <<a href="mailto:mackoel@gmail.com">mackoel@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi, I saw your posts on samba list :) Is your goal to make the Active Directory substitution? Samba3 + FreeIPA won't work that way. Look for explanations on freeipa-users list. You either need Samba4 or no kerberos on Windows. However, samba3 can be used with FreeIPA as File Sharing solution and will use Single Sign On when you'll managed to setup winxp for IPA.<div class="Ih2E3d"> Best regards and Happy New Year! </div><div class="Ih2E3d"> Kostya Viji V Nair пишет: > Hi, > </div> > I have setup samba as a PDC with kerberos and ldap. While adding the windows > clients I get the following error message on the logs, and windows says the > user name and password is incorrect > > [2008/12/31 19:00:09, 0] lib/util_sock.c:write_data(1059) > [2008/12/31 19:00:09, 0] lib/util_sock.c:get_peer_addr_internal(1607) > getpeername failed. Error was Transport endpoint is not connected > write_data: write failure in writing to client 0.0.0.0. Error Connection > reset by peer > [2008/12/31 19:00:09, 0] smbd/process.c:srv_send_smb(74) > Error writing 4 bytes to client. -1. (Transport endpoint is not connected) > > Any help on the same will be gratly appreciated. > > # rpm -qa |grep samba > samba-client-3.2.5-0.23.fc10.x86_64 > samba-common-3.2.5-0.23.fc10.x86_64 > samba-3.2.5-0.23.fc10.x86_64 > samba-winbind-3.2.5-0.23.fc10.x86_64 > > # uname -a > Linux <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> 2.6.27.7-134.fc10.x86_64 #1 SMP Mon Dec 1 22:21:35 > EST 2008 x86_64 x86_64 x86_64 GNU/Linux > > # cat /etc/samba/smb.conf > [global] > workgroup = <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> > server string = Samba Server Version %v > security = user > passdb backend = smbpasswd > socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 > os level = 33 > domain logons = yes > domain master = yes > local master = yes > preferred master = yes > wins support = yes > template shell = /bin/false > realm = <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> > use kerberos keytab = yes > load printers = yes > cups options = raw > # log level = 3 passdb:5 auth:10 > [homes] > comment = Home Directories > browseable = no > writable = yes > [printers] > comment = All Printers > path = /var/spool/samba > browseable = no > guest ok = no > writable = no > printable = yes > [share] > comment = Share > path = /share > browseable = yes > guest ok = no > writable = yes > valid users = admin > > Thanks > Viji Viji V Nair пишет: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi, <div class="Ih2E3d"> I have done the modifications as suggested, but no luck, getting the same error. # kinit admin </div> # ipa-addservice host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> # ipa-getkeytab -s <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> -p host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> -k /etc/krb5.keytab<div class="Ih2E3d"> Could you please elaborate the steps which you have done to get it working on both the client and server side? Thanks Viji </div><div class="Ih2E3d"> On Tue, Dec 30, 2008 at 11:46 PM, Kozlov <<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a> <mailto:<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a>>> wrote: Hi, The minor comment is that kadmin is supposed to be substituted with ipa-addservice. The major comment is that you've missed ipa-getkeytab on ipaserver that actually SETS password that you then install on winxp. And try to map all users to one: for example, "* Administrator". Best regards, Kostya Viji V Nair пишет: Hi, Thank you for the information, I have tried all these steps, but no success 1. On the IPA Server I have created a host principal using the following command. # kadmin -q "ank host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> </div> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>"<div class="Ih2E3d"> 2. On the windows xp client C:> ksetup /setrealm <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> C:> ksetup /addkdc <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <a href="http://viji.bigmaps.com" target="_blank">viji.bigmaps.com</a> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> C:> ksetup /setmachpassword <password> C:> ksetup /mapuser <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> guest<div class="Ih2E3d"> C:> ksetup /mapuser * * After the above setup windows is showing <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> </div> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> as a Kerberos Realm on<div class="Ih2E3d"> the login screen, but when I try to login using the user name "admin" it is throwing the following error. "The system could not log you on. Make sure your user name and domain are correct, and then type your password again. Letters in passwords must be typed using the correct case." But the IPA (kerberos) server is issuing the tickets, the log shows: Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: NEEDED_PREAUTH: <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a><div class="Ih2E3d"> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> </div> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>, Additional<div class="Ih2E3d"> pre-authentication required Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (3 etypes {23 3 1}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a><div class="Ih2E3d"> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> </div> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>><div class="Ih2E3d"> Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): TGS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a><div class="Ih2E3d"> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> for host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> I have found some article on Microsoft website, saying this is a bug and apply the latest service pack (SP3), I even tried that, but no success. <a href="http://support.microsoft.com/kb/825081" target="_blank">http://support.microsoft.com/kb/825081</a> Similar Thread: <a href="http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html" target="_blank">http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html</a> Thanks & Regards Viji On Mon, Dec 29, 2008 at 6:35 PM, Konstantin Kozlov <<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>> </div><div><div></div><div class="Wj3C7c"> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>>>> wrote: Hi, You can search the list for a similar thread and here are the steps I've followed with success: Add host principal for winxp machine with the encoding des-cbc-crc and passowrd (-P ioption for ipa-getkeytab). Do not store this keytab in /etc/krb5.keytab but rather in some other file. Install MS Support Tools on WinXP, and run ksetup /setdomain ... ksetup /addkdc ... ksetup /setcomputerpassword ... ksetup /mapuser * <your user> WinXP machine asks to login to Kerberos realm at login screen. I failed to map one ipa-user to one win-user. But may be because I didn't have enough time. If you will succeed - leave a note here please. Best regards, Kostya Viji V Nair wrote: Hi, I am a new user of free-ipa, I have installed the free-ipa packages shipped with fedora 10. I have more that 100 windows clients to authenticate. Here is my problem, All the clients are XP SP2, I have installed MIT Kerberos for Windows 3.2.2. Always the native windows login prompt appears first, when i login to windows the kerberos client is asking for authentication. I want to replace this windows authentication with kerberos Any help on the same will be greatly appreciated. Thanks Viji ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> </div></div> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>><div class="Ih2E3d"> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> -- Konstantin Kozlov Department of Computational Biology, Center for Advanced Studies, SPb State Polytechnical University, 195251, Polytechnicheskaya ul., 29, bld 4, office 204, St.Petersburg, Russia. Tel./fax: +7 812 596 2831 _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> </div> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>><div class="Ih2E3d"> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> </div><div class="Ih2E3d"><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </div></blockquote> </blockquote></div>