How to use cached credentials in Samba/Winbind on Debian Buster?
0
votes
1
answer
3464
views
While using Debian and Windows in mixed environments for a huge amount of time now I am stuck on trying to use cached credentials for logging in within a domain environment. Once I used the credentials to login, I still want to login when the machine isn't connected to the domain controller anymore.
This behaviour is implemented by Windows clients, so that a laptop user can still login. Only mount points can't be used unless a connection is there. I want to achieve the same on my Debian/GNU Linux client.
---
**Further explanation**
The workstation is using Debian Buster with GUI (Xorg, XFCE, LightDM) and Samba (Winbind). It's a pretty much default installation.
:~$ uname -a
Linux client-ph-wkst 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1 (2020-01-26) x86_64 GNU/Linux
:~$ sudo samba -V
Version 4.9.5-Debian
The workstation is sucessfully connected to a domain controller (Samba 4). Everything is working fine. I'm using this setup since Jessie and it's nice. All domain users can login on that machine, are having an auto-created home directory and so on. The only exception to that is the missing offline authentication.
According to the Samba Wiki (https://wiki.samba.org/index.php/PAM_Offline_Authentication) the smb.conf
has been modified to contain winbind offline logon = yes
.
While testing this it works as expected. When setting winbind to offline manually(sudo smbcontrol winbind offline
), I can verify that PAM is using cached credentials. Even by unplugging the cable physically I can achieve the same.
**Problem**
But when I unplug the cable and reboot the system, I can't login. It hangs on LightDM logon screen. I can switch to console by pressing Ctrl+Alt+F1. I can logon with the system's root account, because this doesn't request the domain controller. When I look into the services with root I can see, that nmbd is not running. By examining it's logs with journalctl -xe
I see, that it's not starting because of *No local IPv4 non-loopback interfaces available*.
The default network configuration tool in Debian's GUI installation is NetworkManager. With nmcli general
I can see that I'm __not__ connected.
**Solution quick-and-dirty**
Without plugging in the cable physically I manually activate the interface by entering nmcli connection up pewpewdefaultconnection
. I restart samba and nmbd service. Voilà! It's working. I can enter my credentials, even restart lightdm service and enter everything with my cached credentials.
**Solution nice and clean to be found**
Since I don't want such an ugly solution as described before I am asking you to help me. Is there anyone who as accomplished this in a clean way? I would really appreciate any help.
I don't want to setup a script that makes the calls, that I described before, since they seem to be ugly. I'd like to prefer something in a configuration style if possible.
Note: I tried to use auto eth0
in network interfaces and make it being grabbed by NetworkManager's configuration file with managed=true
. This doesn't show any improvement.
Asked by Pewpew
(123 rep)
Apr 23, 2020, 01:45 PM
Last activity: May 14, 2020, 06:20 AM
Last activity: May 14, 2020, 06:20 AM