Ok here's the deal. I believe I have set up RHEL 5 to authenticate against a Windows 2003 Active Directory. When I do wbinfo -u and -g all of the users and groups show up. I can finger users that are on active directory and have no user account created on the linux server and the net ads info appears to be correct. However when I type getent passwd I don't see anything from the active directory just the linux server.

We're trying to get it so users in active directory can ssh into the linux server to run a program but no other user except root seems to be able to log in via SSH. Could some one tell me where I went wrong and how to fix this possibly?

On a possibly related not when I finger a username it takes a while. Is this a related issue or something completely different?

My guess is that you need to use PAM authentication in /etc/ssh/sshd_config, and configure PAM for AD.

Try logging in with "ssh -vv <user@server>" and see at which stage it fails.

The main problem was that the SSH program we use (Anzio) would lock up if we tried to log in with any user other than root. I downloaded OpenSSH for windows and installed it on my computer and tried to log in to my regular account with ssh -vv <username>@<Linux Server IP> it received the keys and asked for a password which I gave and then waited a few min. Long story short I managed to log in and was at the bash shell. I logged out and tried with Anzio and was able to log in no problem, almost no hesitation. To check this I tried another username and password the same way and was successful.

I tried it again a bit later and the same issue and now i can use openSSH for my comp either.

I checked /etc/ssh/sshd_config and it is configured to use PAM. As far as making sure PAM is using the AD that's in the system-auth file correct? if so I can post the contents so someone can see where i might have went wrong.

I don't use AD at home. Post the contents "ls /etc/security/" and "ls /etc/pam.d/". There may be a pam file that has the AD settings. Does RHEL have a wizard setting for AD authentication. If not you might want to google for 'RHEL 5 Active Directory". There will be other settings as well such as /etc/libnss-ldap.conf and you will need kerberos installed. You will also need to configure the ldap client. RHEL may have a wizard to do this. This url might help:
http://www.networkcomputing.com/show...cleID=55301455
You will also need to configure AD with the Linux username, uid, gid etc. I have no experience with this, but you probably do.

When a user logs into that machine locally, how is authentication handled? I think you need to configure it for AD authentication generally. The problem may have nothing to do with ssh at all.

By the way, you might consider using Cygwin/X. You could run graphical programs remotely as well, even if the server is in "init level 3". The remote program will be displayed locally where you are. The X server is on the machine you are on rather than on the remote. This would enable using the graphical system-config-* config programs.

Here are the results of the ls commands.

ls /etc/security/

-rw-r--r-- 1 root root 4266 Jul 23 2007 access.conf
-rw-r--r-- 1 root root 82 Jul 23 2007 chroot.conf
drwxr-xr-x 2 root root 4096 Jan 30 10:45 console.apps
-rw-r--r-- 1 root root 710 Jul 23 2007 console.handlers
-rw-r--r-- 1 root root 933 Jul 23 2007 console.perms
drwxr-xr-x 2 root root 4096 Jan 30 10:38 console.perms.d
-rw-r--r-- 1 root root 3450 Jul 23 2007 group.conf
-rw-r--r-- 1 root root 1802 Jul 23 2007 limits.conf
drwxr-xr-x 2 root root 4096 Jul 23 2007 limits.d
-rw-r--r-- 1 root root 1442 Jul 23 2007 namespace.conf
-rwxr-xr-x 1 root root 980 Jul 23 2007 namespace.init
-rw------- 1 root root 0 Jul 23 2007 opasswd
-rw-r--r-- 1 root root 3088 Jul 23 2007 pam_env.conf
-rw-r--r-- 1 root root 568 Jul 9 2007 pam_winbind.conf
-rw-r--r-- 1 root root 2180 Jul 23 2007 time.conf

ls /etc/pam.d/

-rw-r----- 1 root daemon 390 Aug 23 2006 atd
-rw-r--r-- 1 root root 97 Dec 13 2006 authconfig
-rw-r--r-- 1 root root 97 Dec 13 2006 authconfig-gtk
-rw-r--r-- 1 root root 97 Dec 13 2006 authconfig-tui
lrwxrwxrwx 1 root root 29 Jan 30 10:45 bindconf -> /etc/pam.d/system-config-bind
-rw-r--r-- 1 root root 192 Jun 25 2007 chfn
-rw-r--r-- 1 root root 192 Jun 25 2007 chsh
-rw-r--r-- 1 root root 232 Jul 23 2007 config-util
-rw------- 1 root root 297 Jun 22 2007 crond
-rw-r--r-- 1 root root 65 Aug 6 2007 cups
-rw-r--r-- 1 root root 97 Jan 16 2007 dateconfig
-rw-r--r-- 1 root root 115 Nov 10 2006 eject
-rw-r--r-- 1 root root 394 Jun 25 2007 ekshell
-rw-r--r-- 1 root root 351 Jul 30 2007 gdm
-rw-r--r-- 1 root root 353 Jul 30 2007 gdm-autologin
-rw-r--r-- 1 root root 142 Jul 30 2007 gdmsetup
-rw-r--r-- 1 root root 325 Jun 25 2007 gssftp
-rw-r--r-- 1 root root 147 Dec 11 2006 halt
-rw-r--r-- 1 root root 115 Oct 30 2006 kbdrate
-rw-r--r-- 1 root root 293 Jun 11 2007 kcheckpass
-rw-r--r-- 1 root root 354 Jun 11 2007 kdm
-rw-r--r-- 1 root root 369 Jun 11 2007 kdm-np
-rw-r--r-- 1 root root 115 Sep 28 2006 klaptop_acpi_helper
-rw-r--r-- 1 root root 97 Sep 6 2006 kppp
-rw-r--r-- 1 root root 293 Jun 11 2007 kscreensaver
-rw-r--r-- 1 root root 393 Jun 25 2007 kshell
-rw-r--r-- 1 root root 643 Jun 25 2007 login
-rw-r--r-- 1 root root 97 Aug 15 04:46 neat
-rw-r--r-- 1 root root 172 Jun 27 2007 newrole
-rw-r--r-- 1 root root 154 Jul 23 2007 other
-rw-r--r-- 1 root root 103 Jul 17 2006 passwd
-rw-r--r-- 1 root root 97 Dec 13 2006 pirut
-rw-r--r-- 1 root root 169 Oct 2 10:30 pm-hibernate
-rw-r--r-- 1 root root 169 Oct 2 10:30 pm-powersave
-rw-r--r-- 1 root root 169 Oct 2 10:30 pm-suspend
-rw-r--r-- 1 root root 169 Oct 2 10:30 pm-suspend-hybrid
-rw-r--r-- 1 root root 147 Dec 11 2006 poweroff
-rw-r--r-- 1 root root 138 Dec 1 2006 ppp
-rw-r--r-- 1 root root 97 Dec 13 2006 pup
-rw-r--r-- 1 root root 147 Dec 11 2006 reboot
-rw-r--r-- 1 root root 603 Jun 25 2007 remote
-rw-r--r-- 1 root root 97 Dec 6 2006 rhn_register
-rw-r--r-- 1 root root 167 Jun 27 2007 run_init
-rw-r--r-- 1 root root 143 Nov 27 2006 runuser
-rw-r--r-- 1 root root 105 Nov 27 2006 runuser-l
-rw-r--r-- 1 root root 97 Jun 25 2007 sabayon
-rw-r--r-- 1 root root 169 Jul 9 2007 samba
-rw-r--r-- 1 root root 36 Dec 4 2006 screen
lrwxrwxrwx 1 root root 22 Jan 30 10:39 serviceconf -> system-config-services
-rw-r--r-- 1 root root 145 Dec 1 2006 setup
lrwxrwxrwx 1 root root 25 Jan 30 10:39 smtp -> /etc/alternatives/mta-pam
-rw-r--r-- 1 root root 72 Nov 28 2006 smtp.sendmail
-rw-r--r-- 1 root root 67 Mar 23 2007 squid
-rw-r--r-- 1 root root 285 Jul 13 2007 sshd
-rw-r--r-- 1 root root 487 Nov 27 2006 su
-rw-r--r-- 1 root root 179 Oct 1 2006 sudo
-rw-r--r-- 1 root root 164 Oct 1 2006 sudo-i
-rw-r--r-- 1 root root 137 Nov 27 2006 su-l
lrwxrwxrwx 1 root root 14 Jan 30 10:45 system-auth -> system-auth-ac
-rw-r--r-- 1 root root 1463 Feb 4 13:49 system-auth-ac
-rw-r--r-- 1 root root 97 Dec 13 2006 system-cdinstall-helper
-rw-r--r-- 1 root root 97 Dec 13 2006 system-config-authentication
-rw-r--r-- 1 root named 97 Dec 14 2006 system-config-bind
-rw-r--r-- 1 root root 97 Nov 28 2006 system-config-boot
-rw-r--r-- 1 root root 97 Jan 16 2007 system-config-date
-rw-r--r-- 1 root root 97 Dec 15 2006 system-config-display
-rw-r--r-- 1 root root 97 Jan 8 2007 system-config-httpd
-rw-r--r-- 1 root root 97 Sep 11 19:48 system-config-kdump
-rw-r--r-- 1 root root 97 Nov 21 2006 system-config-keyboard
-rw-r--r-- 1 root root 97 Dec 13 2006 system-config-language
-rw-r--r-- 1 root root 282 Jan 22 2007 system-config-lvm
-rw-r--r-- 1 root root 97 Aug 15 04:46 system-config-network
-rw-r--r-- 1 root root 97 Aug 15 04:46 system-config-network-cmd
-rw-r--r-- 1 root root 97 Dec 12 2006 system-config-nfs
-rw-r--r-- 1 root root 97 Dec 14 2006 system-config-printer
-rw-r--r-- 1 root root 97 Jan 3 2007 system-config-rootpassword
-rw-r--r-- 1 root root 118 Jan 15 2007 system-config-samba
-rw-r--r-- 1 root root 97 Dec 14 2006 system-config-securitylevel
-rw-r--r-- 1 root root 260 Jun 27 2007 system-config-selinux
-rwxr-xr-x 1 root root 118 Dec 6 2006 system-config-services
-rw-r--r-- 1 root root 97 Dec 21 2006 system-config-soundcard
-rw-r--r-- 1 root root 97 Jan 16 2007 system-config-time
-rw-r--r-- 1 root root 118 Dec 21 2006 system-config-users
-rw-r--r-- 1 root root 97 Dec 13 2006 system-install-packages
-rw-r--r-- 1 root root 97 Dec 18 2006 system-switch-mail
-rw-r--r-- 1 root root 97 Dec 18 2006 system-switch-mail-nox
-rw-r--r-- 1 root root 142 Jul 24 2007 virt-manager
-rw-r--r-- 1 root root 97 Nov 22 2006 vm_applet_wrapper

also to maybe save a bit of time here is the contents of system-auth

auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_krb5.so use_first_pass
auth sufficient pam_ldap.so use_first_pass
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so

account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account [default=bad success=ok user_unknown=ignore] pam_winbind.so
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nis nullok try_first_pass use_authtok
password sufficient pam_krb5.so use_authtok
password sufficient pam_ldap.so use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_krb5.so
session optional pam_ldap.so

Here are my krb5.conf, ldap.conf, and smb.conf for the system as well to see if there is something I missed in them.

krb.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = <my domain>.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com:88
admin_server = kerberos.example.com:749
default_domain = example.com
}

<my domain>.LOCAL = {
kdc = <AD server>.<my domain>.local:88
admin_server = <AD server>.<my domain>.local:749
}

<my domain>.LOCAL = {
kdc = <kdc server>
}

[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

<my domain>.local = <my domain>.LOCAL
.<my domain>.local = <my domain>.LOCAL

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}


ldap.conf

# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# The man pages for this file are nss_ldap(5) and pam_ldap(5)
#
# PADL Software
# http://www.padl.com
#

# Your LDAP server. Must be resolvable without using LDAP.
# Multiple hosts may be specified, each separated by a
# space. How long nss_ldap takes to failover depends on
# whether your LDAP client library supports configurable
# network or connect timeouts (see bind_timelimit).
#host 127.0.0.1

# The distinguished name of the search base.
base dc=<my domain>,dc=local

# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator

# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3

# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com

# The credentials to bind with.
# Optional: default is no credential.
#bindpw secret

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
#rootbinddn cn=manager,dc=example,dc=com

# The port.
# Optional: default is 389.
#port 389

# The search scope.
#scope sub
#scope one
#scope base

# Search timelimit
#timelimit 30
timelimit 120

# Bind/connect timelimit
#bind_timelimit 30
bind_timelimit 120

# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
#bind_policy hard

# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600
idle_timelimit 3600

# Filter to AND with uid=%s
#pam_filter objectclass=account

# The user ID attribute (defaults to uid)
#pam_login_attribute uid

# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes

# Check the 'host' attribute for access control
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr yes

# Check the 'authorizedService' attribute for access
# control
# Default is no; if set to yes, and the user has no
# value for the authorizedService attribute, and
# pam_ldap is configured for account management
# (authorization) then the user will not be allowed
# to login.
#pam_check_service_attr yes

# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com

# Group member attribute
#pam_member_attribute uniquemember

# Specify a minium or maximum UID number allowed
#pam_min_uid 0
#pam_max_uid 0

# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody

# HEADS UP: the pam_crypt, pam_nds_passwd,
# and pam_ad_passwd options are no
# longer supported.
#
# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
#pam_password clear

# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service.
#pam_password crypt

# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
#pam_password clear_remove_old
#pam_password nds

# RACF is an alias for the above. For use with
# IBM RACF
#pam_password racf

# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad

# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop

# Redirect users to a URL or somesuch on password
# changes.
#pam_password_prohibit_message Please visit http://internal to change your password.

# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
#nss_base_passwd ou=People,dc=example,dc=com?one
#nss_base_shadow ou=People,dc=example,dc=com?one
#nss_base_group ou=Group,dc=example,dc=com?one
#nss_base_hosts ou=Hosts,dc=example,dc=com?one
#nss_base_services ou=Services,dc=example,dc=com?one
#nss_base_networks ou=Networks,dc=example,dc=com?one
#nss_base_protocols ou=Protocols,dc=example,dc=com?one
#nss_base_rpc ou=Rpc,dc=example,dc=com?one
#nss_base_ethers ou=Ethers,dc=example,dc=com?one
#nss_base_netmasks ou=Networks,dc=example,dc=com?ne
#nss_base_bootparams ou=Ethers,dc=example,dc=com?one
#nss_base_aliases ou=Aliases,dc=example,dc=com?one
#nss_base_netgroup ou=Netgroup,dc=example,dc=com?one

# Just assume that there are no supplemental groups for these named users
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman

# attribute/objectclass mapping
# Syntax:
#nss_map_attribute rfc2307attribute mapped_attribute
#nss_map_objectclass rfc2307objectclass mapped_objectclass

# configure --enable-nds is no longer supported.
# NDS mappings
#nss_map_attribute uniqueMember member

# Services for UNIX 3.5 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount User
#nss_map_attribute uid msSFU30Name
#nss_map_attribute uniqueMember msSFU30PosixMember
#nss_map_attribute userPassword msSFU30Password
#nss_map_attribute homeDirectory msSFU30HomeDirectory
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#pam_login_attribute msSFU30Name
#pam_filter objectclass=User
#pam_password ad

# configure --enable-mssfu-schema is no longer supported.
# Services for UNIX 2.0 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup Group
#nss_map_attribute cn msSFUName
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad

# RFC 2307 (AD) mappings
#nss_map_objectclass posixAccount user
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid sAMAccountName
#nss_map_attribute homeDirectory unixHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup group
#nss_map_attribute uniqueMember member
#pam_login_attribute sAMAccountName
#pam_filter objectclass=User
#pam_password ad

# configure --enable-authpassword is no longer supported
# AuthPassword mappings
#nss_map_attribute userPassword authPassword

# AIX SecureWay mappings
#nss_map_objectclass posixAccount aixAccount
#nss_base_passwd ou=aixaccount,?one
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_base_group ou=aixgroup,?one
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear

# Netscape SDK LDAPS
#ssl on

# Netscape SDK SSL options
#sslpath /etc/ssl/certs

# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
#ssl start_tls
#ssl on

# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is to use libldap's default behavior, which can be configured in
# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
#tls_checkpeer yes

# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertdir /etc/ssl/certs

# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool

# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1

# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key

# Disable SASL security layers. This is needed for AD.
#sasl_secprops maxssf=0

# Override the default Kerberos ticket cache location.
#krb5_ccname FILE:/etc/.ldapcache

# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
uri ldap://<AD server>.<my domain>.local
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

smb.conf

# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options (perhaps too
# many!) most of which are not shown in this example
#
# For a step to step guide on installing, configuring and using samba,
# read the Samba-HOWTO-Collection. This may be obtained from:
# http://www.samba.org/samba/docs/Samb...Collection.pdf
#
# Many working examples of smb.conf files can be found in the
# Samba-Guide which is generated daily and can be downloaded from:
# http://www.samba.org/samba/docs/Samba-Guide.pdf
#
# Any line which starts with a ; (semi-colon) or a # (hash)
# is a comment and is ignored. In this example we will use a #
# for commentry and a ; for parts of the config file that you
# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not made any basic syntactic errors.
#
#---------------
# SELINUX NOTES:
#
# If you want to use the useradd/groupadd family of binaries please run:
# setsebool -P samba_domain_controller on
#
# If you want to share home directories via samba please run:
# setsebool -P samba_enable_home_dirs on
#
# If you create a new directory you want to share you should mark it as
# "samba-share_t" so that selinux will let you write into it.
# Make sure not to do that on system directories as they may already have
# been marked with othe SELinux labels.
#
# Use ls -ldZ /path to see which context a directory has
#
# Set labels only on directories you created!
# To set a label use the following: chcon -t samba_share_t /path
#
# If you need to share a system created directory you can use one of the
# following (read-only/read-write):
# setsebool -P samba_export_all_ro on
# or
# setsebool -P samba_export_all_rw on
#
# If you want to run scripts (preexec/root prexec/print command/...) please
# put them into the /var/lib/samba/scripts directory so that smbd will be
# allowed to run them.
# Make sure you COPY them and not MOVE them so that the right SELinux context
# is applied, to check all is ok use restorecon -R -v /var/lib/samba/scripts
#
#--------------
#
#======================= Global Settings =====================================

[global]

# ----------------------- Netwrok Related Options -------------------------
#
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
#
# server string is the equivalent of the NT Description field
#
# netbios name can be used to specify a server name not tied to the hostname
#
# Interfaces lets you configure Samba to use multiple interfaces
# If you have multiple network interfaces then you can list the ones
# you want to listen on (never omit localhost)
#
# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
# specifiy it as a per share option as well
#
workgroup = <my domain>
server string = Samba Server Version %v

; netbios name = MYSERVER

; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
; hosts allow = 127. 192.168.12. 192.168.13.

# --------------------------- Logging Options -----------------------------
#
# Log File let you specify where to put logs and how to split them up.
#
# Max Log Size let you specify the max size log files should reach

# logs split per machine
; log file = /var/log/samba/%m.log
# max 50KB per log file, then rotate
; max log size = 50

# ----------------------- Standalone Server Options ------------------------
#
# Scurity can be set to user, share(deprecated) or server(deprecated)
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.

security = ads
passdb backend = tdbsam


# ----------------------- Domain Members Options ------------------------
#
# Security must be set to domain or ads
#
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Use password server option only with security = server or if you can't
# use the DNS to locate Domain Controllers
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *


; security = domain
; passdb backend = tdbsam
; realm = MY_REALM

; password server = <NT-Server-Name>

# ----------------------- Domain Controller Options ------------------------
#
# Security must be set to user for domain controllers
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
#
# Domain Logons let Samba be a domain logon server for Windows workstations.
#
# Logon Scrpit let yuou specify a script to be run at login time on the client
# You need to provide it in a share called NETLOGON
#
# Logon Path let you specify where user profiles are stored (UNC path)
#
# Various scripts can be used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
#
; security = user
; passdb backend = tdbsam

; domain master = yes
; domain logons = yes

# the login script name depends on the machine name
; logon script = %m.bat
# the login script name depends on the unix user used
; logon script = %u.bat
; logon path = \\%L\Profiles\%u
# disables profiles support by specifing an empty path
; logon path =

; add user script = /usr/sbin/useradd "%u" -n -g users
; add group script = /usr/sbin/groupadd "%g"
; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"
; delete user script = /usr/sbin/userdel "%u"
; delete user from group script = /usr/sbin/userdel "%u" "%g"
; delete group script = /usr/sbin/groupdel "%g"


# ----------------------- Browser Control Options ----------------------------
#
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
#
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
; local master = no
; os level = 33
preferred master = no

#----------------------------- Name Resolution -------------------------------
# Windows Internet Name Serving Support Section:
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#
# - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
#
# - WINS Server: Tells the NMBD components of Samba to be a WINS Client
#
# - WINS Proxy: Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
#
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.

; wins support = yes
; wins server = w.x.y.z
; wins proxy = yes

; dns proxy = yes

# --------------------------- Printing Options -----------------------------
#
# Load Printers let you load automatically the list of printers rather
# than setting them up individually
#
# Cups Options let you pass the cups libs custom options, setting it to raw
# for example will let you use drivers on your Windows clients
#
# Printcap Name let you specify an alternative printcap file
#
# You can choose a non default printing system using the Printing option

load printers = yes
cups options = raw

; printcap name = /etc/printcap
#obtain list of printers automatically on SystemV
; printcap name = lpstat
; printing = cups

# --------------------------- Filesystem Options ---------------------------
#
# The following options can be uncommented if the filesystem supports
# Extended Attributes and they are enabled (usually by the mount option
# user_xattr). Thess options will let the admin store the DOS attributes
# in an EA and make samba not mess with the permission bits.
#
# Note: these options can also be set just per share, setting them in global
# makes them the default for all shares

; map archive = no
; map hidden = no
; map read only = no
; map system = no
; store dos attributes = yes


#============================ Share Definitions ==============================

password server = <AD server>
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = true
realm = <my domain>.LOCAL
[homes]
comment = Home Directories
browseable = no
writable = yes
; valid users = %S
; valid users = <my domain>\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons
; [netlogon]
; comment = Network Logon Service
; path = /var/lib/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no


# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
; [Profiles]
; path = /var/lib/samba/profiles
; browseable = no
; guest ok = yes


# A publicly accessible directory, but read only, except for people in
# the "staff" group
; [public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; writable = yes
; printable = no
; write list = +staff

Just a suggestion: You might want to use [ code ] [ / code ] (without the spaces of course) tags to wrap your output in. It will preserve spaces properly, so the output looks a lot neater and is easier to read.

For e.g.: