FIX: 'Cannot Write Pam Settings' when Joining a Windows Domain in SuSE 10.3

Today I attacked my 2008 technical to do list and setup a subversion server for backups/source control. It was actually pretty darn easy in SUSE 10.3. After I got it going, I wondered if I could have it automatically authenticate against my HOME domain. So, using SuSE’s menu driven interface YaST, I easily added my Linux machine to my Windows domain.

Initially, YaST wasn’t able to find or join the domain. This happens sometimes in Windows clients too when:
1. In TCP/IP, the DNS settings are pointed to servers outside of the domain
2. The fully qualified domain name (ex. corp.windomain.com) is not given when joining the domain
3. The FQDN is not listed as a DNS search suffix

After adjusting /etc/resolv.conf to reflect my fully qualified domain name, YaST made it surprisingly easy to find and join the domain. But right as it was finishing up, it ran into the error “cannot write pam settings.” I looked around the web and saw about 2 other people had the same problem but no solution was offered. After poking around, I noticed that “pam-smb” was not installed. Generally, SuSE will automatically detect when rpms need to be added but in this case it didn’t.

In order to get it all working, I added pam-smb, samba-winbind and krb5-client then I easily plugged into my Windows 2003 domain. Years ago, I tried to do something similar and it seemed to work but I was never able to login via SSH. I’m pretty sure I didn’t prefix the domain (in proper case, at that) when attempting to login. Knowing that, I was successfully able to login to my Linux machine using a Windows domain login this time around.

login as: HOME\testuser
Using keyboard-interactive authentication.
Password: *****************
Creating directory '/home/HOME/testuser'.
Creating directory '/home/HOME/testuser/public_html'.
Creating directory '/home/HOME/testuser/bin'.
Creating directory '/home/HOME/testuser/Documents'.
Have a lot of fun...
HOME\[email protected]:~>

Awesome! This is much easier than doing user mapping with NIS.

Chrissy is a PowerShell MVP who has worked in IT for nearly 20 years, and currently serves as a Sr. Database Engineer in Belgium. Always an avid scripter, she attended the Monad session at Microsoft’s Professional Developers Conference in Los Angeles back in 2005 and has worked and played with PowerShell ever since. Chrissy is currently pursuing an MS in Systems Engineering at Regis University and helps maintain RealCajunRecipes.com in her spare time. She holds a number of certifications, including those relating to SQL Server, SuSE Linux, SharePoint and network security. She recently became co-lead of the SQL PASS PowerShell Virtual Chapter. You can follow her on Twitter at @cl.

Posted in Active Directory, Linux, Networking
7 comments on “FIX: 'Cannot Write Pam Settings' when Joining a Windows Domain in SuSE 10.3
  1. vikkut says:

    Try to install pam_ssh :))

  2. Daniel says:

    Thanks for your post!

    I ran into the “cannot write pam settings” error. After reading your blog, I installed pam-smb, samba-winbind and krb5-client then everything was fine.

    Merci!

  3. ryan says:

    Very nice. This is the first search result I checked and found exactly what I needed. Thanks.

  4. mike says:

    Im not able to find pam-smb. Its not in my package to install. I see pam-modules?

  5. mike says:

    I guess it was installed in the pam-modules as I was able to join the domain. Thanks!

  6. m says:

    Why did you remove my comments?

  7. guest from germany says:

    THANK YOU, after two hours of trial-and-error, your post fixed it.

Leave a Reply

Your email address will not be published. Required fields are marked *

*