Sample Header Ad - 728x90

How to use cached credentials in Samba/Winbind on Debian Buster?

0 votes
1 answer
3464 views
While using Debian and Windows in mixed environments for a huge amount of time now I am stuck on trying to use cached credentials for logging in within a domain environment. Once I used the credentials to login, I still want to login when the machine isn't connected to the domain controller anymore. This behaviour is implemented by Windows clients, so that a laptop user can still login. Only mount points can't be used unless a connection is there. I want to achieve the same on my Debian/GNU Linux client. --- **Further explanation** The workstation is using Debian Buster with GUI (Xorg, XFCE, LightDM) and Samba (Winbind). It's a pretty much default installation.
:~$ uname -a
Linux client-ph-wkst 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1 (2020-01-26) x86_64 GNU/Linux
:~$ sudo samba -V
Version 4.9.5-Debian
The workstation is sucessfully connected to a domain controller (Samba 4). Everything is working fine. I'm using this setup since Jessie and it's nice. All domain users can login on that machine, are having an auto-created home directory and so on. The only exception to that is the missing offline authentication. According to the Samba Wiki (https://wiki.samba.org/index.php/PAM_Offline_Authentication) the smb.conf has been modified to contain winbind offline logon = yes. While testing this it works as expected. When setting winbind to offline manually(sudo smbcontrol winbind offline), I can verify that PAM is using cached credentials. Even by unplugging the cable physically I can achieve the same. **Problem** But when I unplug the cable and reboot the system, I can't login. It hangs on LightDM logon screen. I can switch to console by pressing Ctrl+Alt+F1. I can logon with the system's root account, because this doesn't request the domain controller. When I look into the services with root I can see, that nmbd is not running. By examining it's logs with journalctl -xe I see, that it's not starting because of *No local IPv4 non-loopback interfaces available*. The default network configuration tool in Debian's GUI installation is NetworkManager. With nmcli general I can see that I'm __not__ connected. **Solution quick-and-dirty** Without plugging in the cable physically I manually activate the interface by entering nmcli connection up pewpewdefaultconnection. I restart samba and nmbd service. Voilà! It's working. I can enter my credentials, even restart lightdm service and enter everything with my cached credentials. **Solution nice and clean to be found** Since I don't want such an ugly solution as described before I am asking you to help me. Is there anyone who as accomplished this in a clean way? I would really appreciate any help. I don't want to setup a script that makes the calls, that I described before, since they seem to be ugly. I'd like to prefer something in a configuration style if possible. Note: I tried to use auto eth0 in network interfaces and make it being grabbed by NetworkManager's configuration file with managed=true. This doesn't show any improvement.
Asked by Pewpew (123 rep)
Apr 23, 2020, 01:45 PM
Last activity: May 14, 2020, 06:20 AM