Samba 4 ads, ldap, krb, не работают права по группам

 
drwxrwx---   2 root          users     4096 дек  8 10:43 test1 

 
C:\>net use \\fileskladtest\scan\test1 /user:tu3 
Недействительный пароль для \\fileskladtest\scan\test1.

Введите пароль для 'tu3' для подключения к 'fileskladtest': 
Системная ошибка 5.

Отказано в доступе.

 
# id tu3 
uid=100278(tu3) gid=100(users) группы=100(users),1018(*****),1010(*****) 

 
# uname -a 
Linux fileskladtest.spec.local 3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 11:03:55 
UTC 2016 x86_64 x86_64 x86_64 GNU/Linux 
# smbd -V 
Version 4.2.10 

 
# cat /etc/samba/smb.conf | grep -v '^#' | grep -v '^;' | 
grep -v '^$' 
[global] 
   workgroup = SPEC 
   realm = SPEC.LOCAL 
   security = ads 
   template homedir = /home/%U 
   template shell = /bin/bash 
   kerberos method = secrets only 
   winbind use default domain = true 
   winbind offline logon = false 
        idmap config * : backend  = ad 
        idmap config * : range = 0-9999999 
        idmap config * : schema_mode = sfu 
        auth methods = winbind 

        server string = Samba Server Version %v 
        netbios name = FILESKLADTEST 

        hosts allow = 127. 192.168.
        # log files split per-machine: 
        log file = /var/log/samba/log.%m 

        # maximum size of 50KB per log file, then rotate: 
        max log size = 50000 
        log level = 0 vfs:2 
        syslog = 0 

    vfs objects = full_audit 
    full_audit:prefix = %u|%I|%S 
    full_audit:facility = local5 
    full_audit:priority = notice 
    full_audit:success = none 
    full_audit:failure = none 
        load printers = no 

        # obtain a list of printers automatically on UNIX System V systems: 
        disable spoolss = Yes 

        show add printer wizard = No 
        read only = No 

        create mask = 0666 

        directory mask = 0777 

        map to guest = Bad User 
        logon path = \\%L\profiles\.msprofile 

        logon home = \\%L\%U\.9xprofile 

        logon drive = P: 

        usershare allow guests = No 
[scan] 
    comment = Сканированные документы 
    path = /data/scan 
    full_audit:success = all 
    full_audit:failure = all 



# cat /etc/nslcd.conf | grep -v '^#' | grep -v '^;' | 
grep -v '^$' 
uid nslcd 
gid ldap 
uri ldap://dc5.spec.local 
uri ldap://dc1.spec.local 
uri ldap://dc2.spec.local 
uri ldap://dc4.spec.local 
ldap_version 3 
base dc=spec,dc=local 
binddn CN=unix,OU=Scripts,DC=SPEC,DC=LOCAL 
bindpw ***paSsWoRd*** 
scope sub 
filter passwd (objectClass=User) 
map    passwd uid              msSFU30Name 
map    passwd homeDirectory    unixHomeDirectory 
filter shadow (objectClass=User) 
filter group  (objectClass=Group) 
ssl no 
tls_cacertdir /etc/openldap/cacerts 



# cat /etc/krb5.conf | grep -v '^#' | grep -v '^;' | 
grep -v '^$' 
[logging] 
 default = FILE:/var/log/krb5libs.log 
 kdc = FILE:/var/log/krb5kdc.log 
 admin_server = FILE:/var/log/kadmind.log 
[libdefaults] 
 dns_lookup_realm = false 
 ticket_lifetime = 24h 
 renew_lifetime = 7d 
 forwardable = true 
 rdns = false 
 default_ccache_name = KEYRING:persistent:%{uid} 
 default_realm = SPEC.LOCAL 
 clockskew = 3600 
[realms] 
 SPEC.LOCAL = { 
  kdc = dc5.spec.local 
  kdc = dc1.spec.local 
  kdc = dc2.spec.local 
  kdc = dc4.spec.local 
  admin_server = dc5.spec.local 
 } 
 DC5.SPEC.LOCAL = { 
  kdc = dc5.spec.local 
  admin_server = dc5.spec.local 
 } 
 SPEC.LOCAL = { 
  kdc = spec.local 
  admin_server = spec.local 
  kdc = spec.local 
 } 
[domain_realm] 
 spec.local = spec.local 
 .spec.local = spec.local 
 dc1.spec.local = DC1.SPEC.LOCAL 
 .dc1.spec.local = DC1.SPEC.LOCAL 
 dc5.spec.local = DC5.SPEC.LOCAL 
 .dc5.spec.local = DC5.SPEC.LOCAL 



# cat /etc/nsswitch.conf | grep -v '^#' | grep -v '^;' | 
grep -v '^$' 
passwd:     files ldap 
shadow:     files 
group:      files ldap 
hosts:      files dns 
bootparams: nisplus [NOTFOUND=return] files 
ethers:     files 
netmasks:   files 
networks:   files 
protocols:  files 
rpc:        files 
services:   files sss 
netgroup:   files sss ldap 
publickey:  nisplus 
automount:  files ldap 
aliases:    files nisplus