Hi Christopher!
Thank you for that information, I am very much appreciate any deeper
information on that issue.
Is there a chance that you give me the config of your central (major)
ldap server and your smb.conf so we have the
chance to compare it with our system, please?
We see the same error but our PDC does directly access the main ldap
server so it should not be a
problem of an update - reference ...
It would be nice to know the versions of your system too (we use ubuntu
8.04 and Centos 5.5 with ldap 2.4.XX and Samba 3.5.6)
Thank you very much!
regards
Martin
Am 12.01.2011 17:37 schrieb Christopher Springer:
I've finally found the solution (or at least in my case) to this problem.
After looking at the logs for LDAP (slapd) I found that every time a
system on the domain tried to update it's associated account
information in the database I would receive the following error:
RESULT tag=103 err=53 text=shadow context; no update referral
This lead me to find that the account information in LDAP was not
being updated...however the machine's domain user accounts would still
be able to login so it wasn't a major issue...just EXTREMELY
annoying. I added the following line in my slapd.conf file to tell
the slapd daemon where to send its updates since it's a read-only
local authentication server at the remote plants:
updateref ldap://xxx.xxx.xxx.xxx
The remote server now sends the account database updates to the
central master server and eventually replicates those changes back
down to the remote sites...and, thus, eliminating the annoying error
message that I was receiving in my samba and system logs. Just for
reference, the original error was something similar to the following...
_netr_ServerAuthenticate2: netlogon_creds_server_check failed.
Rejecting auth request from client XXXXXXXX machine account
XXXXXXXX$ or
_netr_ServerAuthenticate3: netlogon_creds_server_check failed.
Rejecting auth request from client XXXXXXXX machine account XXXXXXXX$
Thanks all! I hope this helps someone else.
Chris
On 08/19/2010 03:29 PM, Christopher Springer wrote:
My configuration is a multi-subnet, multi-subnet Samba/OpenLDAP
configuration. Everything works fine on both subnets but I'm getting
the following error in /var/log/messages and in
/var/log/samba/log.smbd...
_netr_ServerAuthenticate2: netlogon_creds_server_check failed.
Rejecting auth request from client XXX30874 machine account XXX30874$
This messages seems to be repeated every time someone logs into their
machine or when the machine has to contact the server for
authentication purposes. I have not had a chance to go through all
of the logs and verify what OS's are the offenders but it appears
that a lot of them are old WindowsNT4 machines.
Please note that the only server on the subnet in question is the
BDC. It has a local, replicated LDAP directory against which logins
are authenticated. nmbd/wins is used for host name/netbios visibility.
Any ideas to getting rid of this error in the log file? Again, it
appears that access to files is working fine...it's just an annoyance
because I don't understand why it's happening.
Thanks.
Chris
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
