[Samba] Can't validate USER@DOMAIN in Runas

[Linda W]

I have my XP-Pro machine setup as a member of an Samba-based Domain server.

I usually run as "linda@<localmachine>", but wanted to try running a
program using "RunAs" in the "Home", DOMAIN my machine belongs to. The
runas command says:
RUNAS [ [/noprofile | /profile] [/env] [/netonly] ]
/user:<UserName> program
with Notes:
NOTE: Enter user's password only when prompted.
NOTE: ***@DOMAIN is not compatible with /netonly.
NOTE: /profile is not compatible with /netonly.

runas /noprofile /user:mymachine\administrator cmd
runas /profile /env /user:mydomain\admin "mmc %windir%\system32\dsa.msc"

Enter the password for ***@Home:
Attempting to start bash.exe as user "***@Home" ...
RUNAS ERROR: Unable to run - bash.exe
1326: Logon failure: unknown user name or bad password.
---
I verified on my "Samba" server (running SuSE 9.1)
to have the following in my "/etc/samba/smbpasswd" file:

linda:1000:08...<long hex string>...:8...<guid looking thing>...B: \
[ ]:LCT-4<##>E:

I ran smbpasswd on the server to verify I'd set the correct password,
and "linda" is in the "Domain Users" and the "Domain Admins" group.

Is there something I am missing in how I'm supposed to do this? It's
the first time trying "runas". The XP machine "knows" it's part of
the "Home" domain. The Domain server is setup as a logon server.
Since it is my first time trying this it's likely some config problem
"somewhere". Any clues? Has anyone done this that might have
some tips?

Thanks,
Linda

[Otto Müller]

Post by Linda W
...
I verified on my "Samba" server (running SuSE 9.1)
linda:1000:08...<long hex string>...:8...<guid looking thing>...B: \

As the man page of the smbpasswd file says, the Account Flags (the stuff
between the square brackets) should contain a "U" to indicate that this
is a "User" account.

Otto

[Linda W]

Post by Otto Müller

Post by Linda W
...
I verified on my "Samba" server (running SuSE 9.1)
linda:1000:08...<long hex string>...:8...<guid looking thing>...B: \

As the man page of the smbpasswd file says, the Account Flags (the stuff
between the square brackets) should contain a "U" to indicate that this
is a "User" account.
Otto

----

Sorry, in my trying to clean up the line wrap I deleted the "U". There
is one between the brackets. My bad.

===========================================================================

Post by Otto Müller
can you open a session on your machine with the username/domain you wish to
"runas" ?
hth

---

I tried the domain\user, I haven't tried login from the console -- I believe
I didn't have a "profile" directory last time I tried and it said so, but it
did validate the ***@domain w/the correct password -- will try that again
to see if that sheds any more light.

thanks both,
Linda

[Linda W]

Post by Otto Müller
can you open a session on your machine with the username/domain you wish to
"runas" ?

-------
This was a "semi"-yes. It couldn't find the profile for Home/Linda, so
said it would use the local profile -- then it said it couldn't find it, so it
logged me in to a temporary directory. My "home" directory was setup as
//<servername>/<user> -- not //DOMAIN/<user>. Despite unexpected location
for the home directory, it did allow me to log in with the Domain/User
credentials.

It *may* be that I have drives mounted from the server and windows
generally complains about having more than 1 connection to a server
with different credentials (lame!?), but usually it says that's the
problem instead of giving a failure with with wrong user/password,
no?

Maybe a better question might be how to make my local login and
the domain login map to the same USER on my winXP machine?

It's been quite a while since I've read the NT-Domain specific
documentation. I'm not entirely sure why my local logon _isn't_
the same as the DOMAIN/user logon -- I'm able to access files
as though I were logged in as the same username on the domain host.

I was hoping to have "runas" act as something like a "su" in linux...

Linda

[Thierry ITTY]

Post by Linda W

Post by Otto Müller
can you open a session on your machine with the username/domain you wish to
"runas" ?

-------
This was a "semi"-yes. It couldn't find the profile for Home/Linda, so
said it would use the local profile -- then it said it couldn't find it, so it
logged me in to a temporary directory. My "home" directory was setup as
//<servername>/<user> -- not //DOMAIN/<user>. Despite unexpected location
for the home directory, it did allow me to log in with the Domain/User
credentials.
It *may* be that I have drives mounted from the server and windows
generally complains about having more than 1 connection to a server
with different credentials (lame!?), but usually it says that's the
problem instead of giving a failure with with wrong user/password,
no?

maybe
if you access a share on a server as user1 and want to access another share
on the same server as user2, windows complains that you can't use different
credentials at the same time (error 1236 ? I think)
thought this doesn't forbid you to have shares accessed as user1 and runas
something as user2

the following works : open a session as user1, access a share, run cmd,
then "net use" : you will see your share
then runas "cmd" as user2. what will happen is that from user2's command
prompt "net use" will show an empty list. but you'll be able to access the
same or another share from there and "net use" will show it.
user1 and user2 will access their shares each with their own credentials
even on the same server

the following doesn't work : open a session as user1, access a share
(implicitely "as" user1), access a share as user2 on the same server (net
use /user:...), this pops up the credentials error message

I remember (?) that the program (bash ?) you want to exec is on a share
then runas will set up user2's environment in which there are no shares (at
least no one set up in user1's session) and thus thought "bash.exe" existed
at the time "runas" was invoked, it didn't exist anymore when runas had to
call it

so the only solution I see is : open your session as user1, runas cmd as
user2 (local program, no problem), access the share where bash is on, then
run bash from the share

Post by Linda W
I was hoping to have "runas" act as something like a "su" in linux...

I hoped this too a while ago
the main difference in such situations is that linux (and other unices)
sets up "shares" at the system level whereas windows sets them up at the
user level

hth

[Linda W]

Post by Thierry ITTY
maybe
if you access a share on a server as user1 and want to access another share
on the same server as user2, windows complains that you can't use different
credentials at the same time (error 1236 ? I think)

---
Yeah, something similar

Post by Thierry ITTY
thought this doesn't forbid you to have shares accessed as user1 and runas
something as user2

----
I doesn't seem like it should.

Post by Thierry ITTY
the following works : open a session as user1, access a share, run cmd,
then "net use" : you will see your share

---
Yes.

Post by Thierry ITTY
then runas "cmd" as user2. what will happen is that from user2's command
prompt "net use" will show an empty list.

---
Yes.
but you'll be able to access the

Post by Thierry ITTY
same or another share from there and "net use" will show it.

----
Yes. (had to map local account to remote user 'user1'), as local
user2 didn't exist on the server.

Post by Thierry ITTY
user1 and user2 will access their shares each with their own credentials
even on the same server

---
Yep -- as soon as I created "user2" on the server (:-)).

Post by Thierry ITTY
the following doesn't work : open a session as user1, access a share
(implicitely "as" user1), access a share as user2 on the same server (net
use /user:...), this pops up the credentials error message

---
Haven't tried that scenario, specifically. Where I've seen it is
on trying to add sharing permissions on a directory:
- Click "Menu" (right click on my mouse) over a folder to share and choose
"Sharing and Security".
- Select Sharing tab, select "Share this folder", then select "Permissions".
(You can duplicate the problem using the Security tab as well on an NTFS-based
directory)
- Click "Add...". On my computer, the *default* location to select objects
from is my domain name. If you are not part of a domain, I'm not sure if
this error will come up. I should note that my "file server" in my home
also functions as the PDC (right now I really only have a 2 computer setup:
1 server (linux based), 1 client (Win XP-Pro)).
- Select a username from the domain (or the computer you have open share's to).
(in my case, I chose "user1" using your above examples).
- click "OK"; Now I see a Popup Dialog that says:
***
"Enter Network Password":
Enter the name and password of an account with permissions
for <DOMAINNAME>.
***

I have tried "user1" as well as "Domain\user1". I get the dual connection
error message here:
***
The following error occured while using the username (user1) and
password you entered:
Multiple connections to a server or shared resource by the same user, using
more than one user name, are not allowed. Disconnect all previous connections
to the server or shared resource and try again.
***

The only way I've gotten around this is by unsharing
(net use [drive|sharename] /d).
...
Hm...ok...now RUNAS is working (though not exactly as I'd like...but can
probably figure that out by consulting my books)...
Seems ***@domain doesn't work in simple case -- their example shows:
***@domain.microsoft.com. Maybe it needs the dots in the domain name?
As for the "\\" syntax...it doesn't want a double slash in front of
the domain name and I have to remember to quote the backslash before
the user, either double \ or single (not double! *kick self*) quotes around
the argument.

Post by Thierry ITTY
so the only solution I see is : open your session as user1, runas cmd as
user2 (local program, no problem), access the share where bash is on, then
run bash from the share

-----
Bash.exe (cygwin toolset) is on the local machine. I can now
start bash, but not "explorer". When I try to start Explorer, I get
no error message and nothing happens (or starts).

Even though my remote user is listed as being in the Domain Admins
group, trying to run, say the disk defragmenter gives an error about my
remote user not having administrative priviledges. Well...guess that's
more work to figure out in the future...

Post by Thierry ITTY
I hoped this too a while ago
the main difference in such situations is that linux (and other unices)
sets up "shares" at the system level whereas windows sets them up at the
user level

----
Yes, I can see that if I log in as a different user.

Thanks for the things to try...made some progress on this-- just have
to figure out what is needed for remote users to have their remote privileges.

My original intent was to have my credential information be on
the Domain Server (but cached locally), and to have my home directory on the
local machine. What I think I ended up with is a local-only account that
happens to work with "file-sharing" because the passwords for the two users on
the two boxes are the same. I'd wanted "domain based" security and know I had
security=domain in my smb.conf file, but it appears to have been removed,
perhaps by an upgrade in my SuSE version around December of last year.

Do you happen to know the default for security when a server is setup
to be both a domain master and a domain logon server?

Thanks,
Linda

p.s. -- think I'll take a break; at least I know how to get "runas" working --
though I still find the requirement to unmount all my drivers to athenticate
users from the domain. But I guess that's another windows bug....(?)...

[Thierry ITTY]

Post by Linda W

Post by Thierry ITTY
thought this doesn't forbid you to have shares accessed as user1 and runas
something as user2

----
I doesn't seem like it should.

why ?

Post by Linda W
Haven't tried that scenario, specifically. Where I've seen it is
...
The only way I've gotten around this is by unsharing
(net use [drive|sharename] /d).

I should need time to test, which of course I haven't :-)

Post by Linda W
..
Hm...ok...now RUNAS is working (though not exactly as I'd like...but can
probably figure that out by consulting my books)...

the syntax ***@domain.com is the w2k dns based naming scheme whereas the
domain\user is the old netbios one. both should work but with some
third-party tools which don't understand dns naming.

Post by Linda W
Bash.exe (cygwin toolset) is on the local machine. I can now
start bash, but not "explorer". When I try to start Explorer, I get
no error message and nothing happens (or starts).

Explorer is a much more funny thing to handle
I got it from m$ support : you just can't run explorer as runas with
another user, officially it conflicts with the desktop explorer instance.
but the following works : open a dos command prompt window, start the task
manager, kill explorer : your desktop disappears. then run explorer from
command line : your desktop comes to life again, then you can runas a
second instance of explorer as another user. this _is_ the official way...

Post by Linda W
Even though my remote user is listed as being in the Domain Admins
group, trying to run, say the disk defragmenter gives an error about my
remote user not having administrative priviledges. Well...guess that's
more work to figure out in the future...

maybe you'd have to check that domain admins are members of the local admin
group ?

hth