2K3 Server RRAS Authentication via OSX PDC

[awsedit]

Hello. Here’s my situation…

I have a 10.4.10 server which acts as my OD master and PDC.

On my network, I have a 2K3 box that has ISA Serer(RRAS) implemented to facilitate client PPTP VPN connections to the network.

When I have the 2K3 box set to it’s own workgroup, VPN users can authenticate without issue.

When I have the 2K3 box bound to the OSX Domain, my users can’t authenticate, RRAS is setup on the 2K3 box to permit the specific group I setup in OD, however this doesn’t seem enough.

I do see this error in the logs:

2007/12/01 15:56:42, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setup_new_vc_session(662)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2007/12/01 15:56:42, 2] /SourceCache/samba/samba-100.7/samba/source/smbd/sesssetup.c:setup_new_vc_session(662)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2007/12/01 15:56:42, 0] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_pipe.c:api_pipe_bind_req(993)
api_pipe_bind_req: unknown auth type 1 requested.
[2007/12/01 15:56:43, 1] auth_ods.c:opendirectory_smb_pwd_check_ntlmv1(387)
opendirectory_smb_pwd_check_ntlmv1: [0]opendirectory_user_auth_and_session_key key_length(16)
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [20]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1028]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1026]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [80]
[2007/12/01 15:56:43, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [1025]
[2007/12/01 15:56:43, 2] /SourceCache/samba/samba-100.7/samba/source/auth/auth.c:check_ntlm_password(360)
check_ntlm_password: authentication for user [user] -> [user] -> [user] succeeded
[2007/12/01 15:56:51, 2] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_samr_nt.c:access_check_samr_function(154)
_samr_lookup_domain: ACCESS DENIED (granted: 0x00000020; required: 0x00000010)
[2007/12/01 15:56:51, 2] /SourceCache/samba/samba-100.7/samba/source/rpc_server/srv_samr_nt.c:access_check_samr_function(154)
_samr_lookup_domain: ACCESS DENIED (granted: 0x00000020; required: 0x00000010)

Any ideas? I’m pulling my hair out on the one….

Thanks…

[awsedit]

I found something online about Samba’s PDC implementation not allowing computers to be added to the domain?

On the surface, this appears to make sense. I also know that editing the smb.conf file is tricky since the UI rewrites is constantly.

Could this be a solution? And if so, what is the best way to modify the file? I saw a posting the under Leo Server, there is a separate SMB.CONF file that is avail for user modification that lives separately from the main one in the /run directory? I’m on 10.4.11 however…

Please advise.

—-

The solution:

add this to smb.conf:

enable privileges = yes

This allows you to grant special privileges to users (see man smb.conf
for more detail)

reload the samba config:

$ smbcontrol smbd reload-config

and grant the necessary rights to Administrator:

$ net -U Administrator rpc rights list
SeMachineAccountPrivilege Add machines to domain
SePrintOperatorPrivilege Manage printers
SeAddUsersPrivilege Add users and groups to the domain
SeRemoteShutdownPrivilege Force shutdown from a remote system
SeDiskOperatorPrivilege Manage disk shares

$ net -U Administrator rpc rights list Administrator

$ net -U Administrator rpc rights grant Administrator SeMachineAccountPrivilege
Successfully granted rights.

Now one can add machines to the domain. Better yet, the
administrator account does _not_ have to have a uid of 0!

[Author]

Posts