Ubuntu 20.04 client no home dirs being created for domain users

Helder · February 16, 2022, 3:14pm

NethServer Version: 7.9.2009
Module: Active Directory

Hello.
Has anyone been able to get Ubuntu 20.04 to work with Active Directory?
I can get the machines to join.
I can get the users to authenticate.
But I can not get the users home dirs to be created on the server.

Is there an up to date guide on how to achieve this with NS 7.9.2009 and Ubuntu 20.04?

(I could not find one anywhere that still works, only for an older version of xubuntu)

Many thanks in advance!

stephdl · February 16, 2022, 6:28pm

where is the path where you are looking for, normally it is /var/lib/nethserver/homes

mrmarkuz · February 16, 2022, 6:35pm

Do you see errors in the client logfiles?

I had similar issues with opensuse clients recently. In my case the dir was created but not accessible. Changing the SMB protocol version to for example “vers=2.0” in the pam options for the shares seems to work.

Helder · February 17, 2022, 1:04pm

Thanks for the replies.

I made some progress but not the whole way there just yet. I’m pretty sure it has to do with something I did.

So i followed this how-to but it did not work for me. I made the changes from this support request, and still no luck.

This is where I am:

The AD is:

ad.nethserver.lan

The AD IP is:

10.0.0.3

The user folders get created on the correct folder ( /var/lib/nethserver/home ) when I test my settings with:

su myusername@nethserver.lan

I can find the folder on my NS server, it resides at /var/lib/nethserver/home
I can not access the folder on the AD IP ( 10.0.0.3 ) if I mount it manually.
However If I mount the IP of my Green port ( 10.0.0.2 ) and login using my login details, I can access the folder. ( myusername@nethserver.lan with the correct password).

Where I think I messed up:
Looking at the output of:

local@client02:~$ su myusername@nethserver.lan
Password:
(mount.c:72): Messages from underlying mount program:
(mount.c:76): mount error(2): No such file or directory
(mount.c:76): Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
(pam_mount.c:522): mount of myusername@ad.nethserver.lan failed
Invalid user name
su: failed to execute /usr/libexec/openssh/sftp-server: No such file or directory
Invalid user name
(mount.c:72): umount messages:
(mount.c:76): umount: /home/myusername@ad.nethserver.lan: no mount point specified.
(mount.c:886): unmount of myusername@ad.nethserver.lan failed

The ad.nethserver.lan part of the domain seems to be part of the issue, and hopefully hints at were I messed up, to someone who knows what they are doing.

This is what I have added to /etc/security/pam_mount.conf.xml (i have played around with both IP addresses, with the same result):
<volume user="*" fstype="cifs" server="10.0.0.3" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="nosuid,nodev" /> <mkmountpoint enable="1" remove="true" />

And this is my /etc/sssd/sssd.conf :

[sssd]
domains = ad.nethserver.lan
config_file_version = 2
services = nss, pam
debug_level = 0

[domain/ad.nethserver.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = AD.NETHSERVER.LAN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = ad.nethserver.lan
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
debug_level=0

Please tell me that I’ve committed a really simple mistake

mrmarkuz · February 17, 2022, 7:11pm

That’s ok.
The file server including home shares runs on the NethServer whereas the DC runs in a container, see documentation.

Changing server from 10.0.0.3 to 10.0.0.2 should solve your issue.

Helder · February 17, 2022, 10:08pm

Thanks @mrmarkuz .

I’m a bit further along now, I had to change a couple of things.
They are probably ugly to anyone that knows, but hey, I’m learning.

So changing the IP by itself did not do the trick, i got the same error. /etc/security/pam_mount.conf.xml was changed to this: notice the $(USER) instead of $(DOMAIN_USER)

<volume user="$(USER)@nethserver.lan" fstype="cifs" server="10.0.0.2" path="%(USER)" mountpoint="/home/%(USER)" options="nosuid,nodev" /> <mkmountpoint enable="1" remove="true" />

But that still fails to get me across the finish line:

su myusername
Password:
(pam_mount.c:365): pam_mount 2.16: entering auth stage
(pam_mount.c:568): pam_mount 2.16: entering session stage
(pam_mount.c:629): no volumes to mount
command: ‘pmvarrun’ ‘-u’ ‘myusername’ ‘-o’ ‘1’
(pmvarrun.c:258): parsed count value 0
(pam_mount.c:441): pmvarrun says login count is 1
(pam_mount.c:660): done opening session (ret=0)
> su: failed to execute /usr/libexec/openssh/sftp-server: No such file or directory
(pam_mount.c:706): received order to close things
(pam_mount.c:709): No volumes to umount
command: ‘pmvarrun’ ‘-u’ ‘myusername’ ‘-o’ ‘-1’
(pmvarrun.c:258): parsed count value 1
(pam_mount.c:441): pmvarrun says login count is 0
(pam_mount.c:743): pam_mount execution complete
(pam_mount.c:116): Clean global config (0)
(pam_mount.c:133): clean system authtok=0x563b1bd35ec0 (0)

slowly getting closer, i hope

mrmarkuz · February 17, 2022, 10:37pm

This setting may collide with local users on the client.
I use following line in opensuse. User needs to be under options like options="user=...

<volume mountpoint="~" fstype="cifs" options="user=%(DOMAIN_USER),vers=2.0" server="192.168.0.2" path="%(DOMAIN_USER)"/>

Another way to join a client is this script based on CID.

Maybe it helps to enable shell policy in server manager settings? See documentation.

Helder · February 27, 2022, 10:06pm

Finally got it working. Thanks for the help, I realized that some more careful reading of the manuals was required.
I think the problem might have been that I had accepted the default settings for the AD name (ad.MYSERVER.DOMAIN) and changed it to just MYSERVER.DOMAIN seems to have made the authentication work as expected.
But that is my assumption, which I do not know enough about to fully prove or disproof.

If someone else is interested this is what I ended up going for, please note I’m firmly a “know enough to be dangerous” user, so others will for sure be able to do it better than me:

My test server FQDN is:

my.nethserver.lan

NS Green adapter IP:

10.0.0.2

Local Active Directory:

nethserver.lan
NETHSERVER.LAN
10.0.0.3

Activate, create passwords for the (domain) administrator account.

NS is set up as DHCP.

UBUNTU 20.04 client, connected to the 10.0.0.1/24 network:
> sudo at-get update

sudo apt-get upgrade
sudo apt -y install realmd libnss-sss libpam-sss sssd sssd-tools adcli samba-common-bin oddjob oddjob-mkhomedir packagekit ssh smbclient gvfs-fuse gvfs-backends gvfs-bin cifs-utils libpam-mount

sudo realm discover nethserver.lan
sudo realm join -U administrator nethserver.lan
sudo realm list
sudo realm permit --all

These files were edited, so make sure you replace the nethserver.lan with whatever you went with:
/etc/sssd/sssd.conf

[sssd]
domains = nethserver.lan
config_file_version = 2
services = nss, pam
Default_domain_suffix = nethserver.lan

[domain/nethserver.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = NETHSERVER.LAN
realmd_tags = manages-system joined-with-adcli 
id_provider = ad
fallback_homedir = /home/%u@%d
#fallback_homedir = /home/%u
ad_domain = nethserver.lan
use_fully_qualified_names = True
#use_fully_qualified_names = False
ldap_id_mapping = True
access_provider = ad

#New rules
debug_level=10
ad_gpo_ignore_unreadable = True
ad_gpo_access_control = Permissive

#attempt from nethserver forum
override_homedir = /home/%u@%d
override_shell = /bin/bash

Then:

sudo systemctl restart sssd|

/etc/security/pam_mount.conf.xml

<volume user="*" sgrp="domain users@nethserver.lan" fstype="cifs" server="10.0.0.2" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="vers=3.0,mfsymlinks,nodev,nosuid" />
<mkmountpoint enable="1" remove="true" />

/securetty /etc/securetty

# /etc/securetty: list of terminals on which root is allowed to login.
# See securetty(5) and login(1).

console

# Local X displays (allows empty passwords with pam_unix's nullok_secure)
:0
:0.0
:0.1
:1
:1.0
:1.1
:2
:2.0
:2.1
:3
:3.0
:3.1
#...


# ==========================================================
#
# TTYs sorted by major number according to Documentation/devices.txt
#
# ==========================================================

# Virtual consoles
tty1
tty2
tty3
tty4
tty5
tty6
tty7
tty8
tty9
tty10
tty11
tty12
tty13
tty14
tty15
tty16
tty17
tty18
tty19
tty20
tty21
tty22
tty23
tty24
tty25
tty26
tty27
tty28
tty29
tty30
tty31
tty32
tty33
tty34
tty35
tty36
tty37
tty38
tty39
tty40
tty41
tty42
tty43
tty44
tty45
tty46
tty47
tty48
tty49
tty50
tty51
tty52
tty53
tty54
tty55
tty56
tty57
tty58
tty59
tty60
tty61
tty62
tty63

# UART serial ports
ttyS0
ttyS1
ttyS2
ttyS3
ttyS4
ttyS5
#...ttyS191

# Serial Mux devices    (Linux/PA-RISC only)
ttyB0
ttyB1
#...

# Chase serial card
ttyH0
ttyH1
#...

# Cyclades serial cards
ttyC0
ttyC1
#...ttyC31

# Digiboard serial cards
ttyD0
ttyD1
#...

# Stallion serial cards
ttyE0
ttyE1
#...ttyE255

# Specialix serial cards
ttyX0
ttyX1
#...

# Comtrol Rocketport serial cards
ttyR0
ttyR1
#...

# SDL RISCom serial cards
ttyL0
ttyL1
#...

# Hayes ESP serial card
ttyP0
ttyP1
#...

# Computone IntelliPort II serial card
ttyF0
ttyF1
#...ttyF255

# Specialix IO8+ serial card
ttyW0
ttyW1
#...

# Comtrol VS-1000 serial controller
ttyV0
ttyV1
#...

# ISI serial card
ttyM0
ttyM1
#...

# Technology Concepts serial card
ttyT0
ttyT1
#...

# Specialix RIO serial card
ttySR0
ttySR1
#...ttySR511

# Chase Research AT/PCI-Fast serial card
ttyCH0
ttyCH1
#...ttyCH63

# Moxa Intellio serial card
ttyMX0
ttyMX1
#...ttyMX127

# SmartIO serial card
ttySI0
ttySI1
#...

# USB dongles
ttyUSB0
ttyUSB1
ttyUSB2
#...

# LinkUp Systems L72xx UARTs
ttyLU0
ttyLU1
ttyLU2
ttyLU3

# StrongARM builtin serial ports
ttySA0
ttySA1
ttySA2

# SCI serial port (SuperH) ports and SC26xx serial ports
ttySC0
ttySC1
ttySC2
ttySC3
ttySC4
ttySC5
ttySC6
ttySC7
ttySC8
ttySC9

# ARM "AMBA" serial ports
ttyAM0
ttyAM1
ttyAM2
ttyAM3
ttyAM4
ttyAM5
ttyAM6
ttyAM7
ttyAM8
ttyAM9
ttyAM10
ttyAM11
ttyAM12
ttyAM13
ttyAM14
ttyAM15

# Embedded ARM AMBA PL011 ports (e.g. emulated by QEMU)
ttyAMA0
ttyAMA1
ttyAMA2
ttyAMA3

# DataBooster serial ports
ttyDB0
ttyDB1
ttyDB2
ttyDB3
ttyDB4
ttyDB5
ttyDB6
ttyDB7

# SGI Altix console ports
ttySG0

# Motorola i.MX ports
ttySMX0
ttySMX1
ttySMX2

# Marvell MPSC ports
ttyMM0
ttyMM1

# PPC CPM (SCC or SMC) ports
ttyCPM0
ttyCPM1
ttyCPM2
ttyCPM3
ttyCPM4
ttyCPM5

# Altix serial cards
ttyIOC0
ttyIOC1
#...ttyIOC31

# NEC VR4100 series SIU
ttyVR0

# NEC VR4100 series SSIU
ttyVR1

# Altix ioc4 serial cards
ttyIOC84
ttyIOC85
#...ttyIOC115

# Altix ioc3 serial cards
ttySIOC0
ttySIOC1
#...ttySIOC31

# PPC PSC ports
ttyPSC0
ttyPSC1
ttyPSC2
ttyPSC3
ttyPSC4
ttyPSC5

# ATMEL serial ports
ttyAT0
ttyAT1
#...ttyAT15

# Hilscher netX serial port
ttyNX0
ttyNX1
#...ttyNX15

# Xilinx uartlite - port
ttyUL0
ttyUL1
ttyUL2
ttyUL3

# Xen virtual console - port 0
xvc0

# pmac_zilog - port
ttyPZ0
ttyPZ1
ttyPZ2
ttyPZ3

# TX39/49 serial port
ttyTX0
ttyTX1
ttyTX2
ttyTX3
ttyTX4
ttyTX5
ttyTX6
ttyTX7

# SC26xx serial ports (see SCI serial ports (SuperH))

# MAX3100 serial ports
ttyMAX0
ttyMAX1
ttyMAX2
ttyMAX3

# OMAP serial ports
ttyO0
ttyO1
ttyO2
ttyO3

# User space serial ports
ttyU0
ttyU1

# A2232 serial card
ttyY0
ttyY1

# IBM 3270 terminal Unix tty access
3270/tty1
3270/tty2
#...

# IBM iSeries/pSeries virtual console
hvc0
hvc1
#...
#IBM pSeries console ports
hvsi0
hvsi1
hvsi2

# Equinox SST multi-port serial boards
ttyEQ0
ttyEQ1
#...ttyEQ1027

# ==========================================================
#
# Not in Documentation/Devices.txt
#
# ==========================================================

# Embedded Freescale i.MX ports
ttymxc0
ttymxc1
ttymxc2
ttymxc3
ttymxc4
ttymxc5

# LXC (Linux Containers)
lxc/console
lxc/tty1
lxc/tty2
lxc/tty3
lxc/tty4

# Serial Console for MIPS Swarm
duart0
duart1

# s390 and s390x ports in LPAR mode
ttysclp0

# ODROID XU4 serial console
ttySAC0
ttySAC1
ttySAC2
ttySAC3

And this should be it.
You might have to log in with the user@domain.tld for the first time.
Nautilus took over 10 minutes to open for me, I installed Nemo, and that works fine.