To enable offline authentication, configure Samba to use winbind in nsswitch and for PAM (Setting up PAM)
Then ensure that smb.conf contains:
"winbind offline logon = yes"
Enabling offline authentication in pam_winbind
First, ensure that you can log in using PAM and your Windows credentials, for example via SSH:
ssh YOURDOM\\youruser@localhost
You cannot proceed if login via PAM (pam_winbind) is not working.
Next, pam_winbind must also set the offline flag. You can do this by either
- adding "cached_login = yes" to /etc/security/pam_winbind.conf. The file should look like this:
# # pam_winbind configuration file # # /etc/security/pam_winbind.conf # [global] # request a cached login if possible # (needs "winbind offline logon = yes" in smb.conf) cached_login = yes
This will enable offline capability globally for all applications using PAM. If you want more granular control over which services use pam_winbind's offline mode, you can do so by
- adding the "cached_login" option into individual PAM configuration files (usually located below /etc/pam.d/$SERVICE)
Testing offline authentication
Start winbindd, and successfully authenticate at least once while winbind is online.
/etc/init.d/winbind start wbinfo -K YOURDOM\\youruser%password
You can now manually switch winbindd to offline mode (for testing purposes) using the smbcontrol command.
smbcontrol winbind offline
If you now repeat the command
wbinfo -K YOURDOM\\youruser%password
You should receive
user_flgs: LOGON_CACHED_ACCOUNT
in the output.
Your system is now prepared to use pam_winbind while offline. Please try to log in to your localhost, for example via SSH.
ssh YOURDOM\\youruser@localhost
решил так создал файл /etc/security/pam_winbind.conf с такими опциями Код:
#
# pam_winbind configuration file
#
# /etc/security/pam_winbind.conf
#
[global]
# turn on debugging
debug = no
# request a cached login if possible
# (needs "winbind offline logon = yes" in smb.conf)
cached_login = yes
# authenticate using kerberos
krb5_auth = yes
# when using kerberos, request a "FILE" krb5 credential cache type
# (leave empty to just do krb5 authentication but not have a ticket
# afterwards)
krb5_ccache_type = FILE
# make successful authentication dependend on membership of one SID
# (can also take a name)
;require_membership_of =
silent = yes
а /etc/pam.d/gnome-screensaver теперь выглядит так
auth sufficient pam_unix.so nullok_secure
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so
/etc/pam.d/common-auth
auth optional pam_group.so
auth sufficient pam_unix.so nullok_secure use_first_pass
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so