Winbind NT domain authentication

Hi list,

Sorry for the cros-post, I'm not sure which list is better for
me as I got a question related to samba, configuration, FreeBSD.

I'm trying to configure NT authentication on FreeBSD 5.4 with=20
Samba 3.0.12 (installed form the ports collection).
I've folowed the Samba 3 howto I've managed the following :

wbinfo -g returns correctly the domain groups

wbinfo -u returns all the users (including those ones from the domain)

ntlm auth does authenticate the user correctly
ntlm_auth --username=3Dusr1
password:
NT_STATUS_OK: Success (0x0)
and in the winbind log I get :
=A0=A0=A0=A0=A0=A0=A0=A0rpc: trusted_domains
=A0=A0=A0=A0=A0=A0=A0=A0[ 3141]: request interface version
=A0=A0=A0=A0=A0=A0=A0=A0[ 3141]: request location of privileged pipe
=A0=A0=A0=A0=A0=A0=A0=A0[ 3141]: request domain name
=A0=A0=A0=A0=A0=A0=A0=A0[ 3141]: request misc info
=A0=A0=A0=A0=A0=A0=A0=A0[ 3141]: pam auth MYDOMAIN\usr1
=A0=A0=A0=A0=A0=A0=A0=A0rpc_dc_name: Returning DC PASSV_SERV (_the_ip_) f=
or domain MYDOMAIN
=A0=A0=A0=A0=A0=A0=A0=A0IPC$ connections done anonymously
=A0=A0=A0=A0=A0=A0=A0=A0Connecting to host=3DPASSV_SERV
=A0=A0=A0=A0=A0=A0=A0=A0Connecting to _the_ip_ at port 445

I suspect this means that my samba/winbind configuration is correct.
The trouble is that I still can't login (login or ssh) with usernames
from the domain.
If I try with MYDOMAIN\usr1 I just get an Access Denied.
The worse is that I'm not sure that I'm looking for the logs in the=20
right place, the auth.log of messages doesn't show any trace of
winbind beeing called.

My smb.conf :

workgroup =3D MYDOMAIN
netbios name =3D MY_BSD
password server =3D passwd_serv_ip
security =3D domain
encrypt passwords =3D yes
#passdb backend =3D tdbsam guest
server string =3D MY_BSD Samba Server

# separate domain and username with '\', like DOMAIN\username
winbind separator =3D \\
# use uids from 10000 to 20000 for domain users
idmap uid =3D 10000-20000
# use gids from 10000 to 20000 for domain groups
idmap gid =3D 10000-20000
# allow enumeration of winbind users and groups
winbind enum users =3D yes
winbind enum groups =3D yes
# give winbind users a real shell (only needed if they have telnet access=
)
template homedir =3D /home/winnt/%D%U
template shell =3D /usr/local/bin/bash

My nsswitch.conf

group: compat winbind
group_compat: nis
hosts: files dns winbind
networks: files
passwd: compat winbind
passwd_compat: nis
shells: files

and finally my /etc/pam.d/sshd

# auth
auth            required        pam_nologin.so          no_warn
#auth           sufficient      pam_opie.so             no_warn no_fake_p=
rompts
#auth           requisite       pam_opieaccess.so       no_warn allow_loc=
al
#auth           sufficient      pam_krb5.so             no_warn try_first=
_pass
#auth           sufficient      pam_ssh.so              no_warn try_first=
_pass
#auth           required        pam_unix.so             no_warn try_first=
_pass
#tfa
auth            sufficient      pam_winbind.so          debug try_first_p=
ass
auth            sufficient      pam_unix.so             no_warn try_first=
_pass

# account
#account        required        pam_krb5.so
account         required        pam_login_access.so
account         sufficient      pam_winbind.so          debug
account         sufficient      pam_unix.so

# session
#session        optional        pam_ssh.so
session         required        pam_permit.so

# password
#password       sufficient      pam_krb5.so             no_warn try_first=
_pass
password        sufficient      pam_winbind.so          debug try_first_p=
ass
password        sufficient      pam_unix.so             no_warn try_first=
_pass

I hope this question is not silly but only for NT authentication smbd/nmb=
d
is not necessary to run, isn't it ? Winbind should do de job.

This is the 2'nd week I keep trying setting this thing up, and one of the=
 most
frustrating experience ever...
Can anybody give me some hints (other then going to a psychiatrist)

Thomas

--=20
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba