Turnkey Linux (TKL) produce a Fileserver appliance which includes Samba and Webmin. I use JumpCloud's LDAP-as-a-Service. I know that Samba can authenticate to JumpCloud's LDAP service but how do I configure this for Samba Windows File Sharing?
Webmin provides access to "Edit Config File". I've used the following based on a JumpCloud LDAP NAS/Samba Integration Step-by-Step Worksheet (note: obviously not my actual org id or user id).
[global] security = User workgroup = WORKGROUP netbios name = WORKGROUP protocol = smb3 server min protocol = smb2 server string = Samba Server %v log file = /var/log/samba/log.%m max log size = 100 log level = 3 passdb backend = ldapsam:ldaps://ldap.jumpcloud.com:636 ldap ssl = no ldap suffix = o=5cf42d8c2adc6777b54ec1d3,dc=jumpcloud,dc=com ldap admin dn = uid=samba_srv,ou=Users,o=5cf42d8c2adc6777b54ec1d3,dc=jumpcloud,dc=com ldap user suffix = ou=Users ldap group suffix = ou=Users # FYI, the password for this user is stored in # /etc/samba/secrets.tdb. It is created by running # 'smbpasswd -w passwd' [homes] comment = Home Directory browseable = no read only = no valid users = %S [cdrom] comment = CD-ROM read only = yes locking = no guest ok = yes path = /media/cdrom preexec = /bin/mount /media/cdrom postexec = /bin/umount /media/cdrom [storage] comment = Public Share path = /srv/storage browseable = yes writeable = yes read only = no create mask = 0644 directory mask = 0755 valid users = @sambausers
smbpasswd -w my-samba-passwd and restarted the fileserver.
The error in the Samba logs is:
Failed to find a Unix account for 'my-user'
User 'my-user' in passdb, but getpwnam() fails!
For Debian 9 Stretch, which is the underlying OS for the TKL Fileserver, LDAP/NSS is set up from the configuration screens with these installs:
apt-get install libnss-ldapd
apt-get install libpam-ldapd
I've run through the elements in the Debian wiki for LDAP NSS and my configuration appears correct but
getent passwd doesn't return the users from JumpCloud so it's probable that the configuration of NSS is incorrect?