求助：linux加入域后，域用户访问samba服务提示登陆失败

xllgix718

服务都装了,我帖下我的配置文件.
AD server :192.168.10.100   hcq.bazz.local
samba:192.168.10.10      hcq
1、krb5配置
#vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log


[libdefaults]
default_realm = BAZZ.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
BAZZ.LOCAL = { #
kdc = 192.168.10.100:88 #
admin_server = 192.168.10.100:749 #
default_domain = bazz.local
}

[domain_realm]
.bazz.local= BAZZ.LOCAL
  bazz.local= BAZZ.LOCAL

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

连接AD server
kinit administrator@ BAZZ.LOCAL
密码后一切正常

2、smb.conf配置
#vi /etc/samba/smb.conf
#===================== Global Settings =========================
[global]
        workgroup = BAZZ
        netbios name = hcq
        idmap uid    = 15000-20000
        idmap gid    = 15000-20000
        winbind enum groups = yes
        winbind enum users  = yes
        winbind separator   = /
;       winbind use default domain = yes
        template homedir = /home/%D/%U
        template shell   = /bin/bash
        hosts allow =192.168.10. 127.

# ----------------------- Domain Members Options ------------------------
        security = domain
;       passdb backend = tdbsam
；      realm = BAZZ.LOCAL
        encrypt passwords = yes
        password server = 192.168.10.100

[homes]
   path = /home/%D/%U
   browseable = no
   writable = yes
   valid users = bazz.local/%U
   create mode = 0777
   directory mode = 0777


3、配置nsswitch.conf
#vi /etc/nsswitch.conf
修改以下位置
passwd:     files winbind
shadow:     files
group:      files winbind


4、启动服务，加入AD域
[root@lamp ~]# net rpc join -S hcq.bazz.local -U administrator
Password:
Joined domain BAZZ.
5、验证
[root@lamp ~]# net rpc testjoin
Join to 'BAZZ' is OK


在2003里也可以看到linux的主机名加入到域了，但是我登陆samba用户时输入administrator时提示我登录失败。。。。。。。。。。



请各位前辈帮忙。。

[ 本帖最后由 xllgix718 于 2009-3-7 20:21 编辑 ]

kns1024wh

testparm 测试一下samba
ldap的认证可能有问题

jerrywjl

把wbinfo -t和wbinfo -u的内容拿来。或者你要用wbinfo -u显示出来的用户名格式登录。