Hi,
I am setting up a Samba PDC which uses LDAP for account information.
It is a debian installation with samba 3.0.14a and slapd 2.2.23 (I'm
also using ldap-account-manager, but I don't think that has anything to
do with this).
I have checked the release notes whether it might have been fixed in a
new release, but there's nothing I recognize that seems related to this.
The problem is that when I attempt to join a w2k machine (the first one,
actually) to the domain it reports 'Logon failure: unknown user name or
password'.
Samba, at the same time, reports in the logfile for that machine:
[2005/09/06 13:12:58, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
pop_sec_ctx (1000, 1000) - sec_ctx_stack_ndx = 0
[2005/09/06 13:12:58, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo(3077)
_samr_set_userinfo: does not possess sufficient rights
[2005/09/06 13:12:58, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2961)
Attempting administrator password change for user krauq$
[2005/09/06 13:12:58, 10] lib/account_pol.c:account_policy_get(210)
account_policy_get: maximum password age:-1
[2005/09/06 13:12:58, 10] lib/account_pol.c:account_policy_get(210)
account_policy_get: minimum password age:0
[2005/09/06 13:12:58, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2981)
Changing trust account or non-unix-user password, not updating /etc/passwd
[2005/09/06 13:12:58, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2999)
set_user_info_pw: pdb_update_pwd()
[2005/09/06 13:12:58, 5] lib/smbldap.c:smbldap_search(1038)
smbldap_search: base => [dc=XXX,dc=XXX,dc=org], filter =>
[(&(uid=krauq$)(objectclass=sambaSamAccount))], scope => [2]
[2005/09/06 13:12:58, 0] lib/smbldap.c:smbldap_open(882)
smbldap_open: cannot access LDAP when not root..
[2005/09/06 13:12:58, 1] lib/smbldap.c:another_ldap_try(1011)
Connection to LDAP server failed for the 1 try!
These last two are repeasted 15 times and then gives up.
[2005/09/06 13:13:13, 0] lib/smbldap.c:smbldap_open(882)
smbldap_open: cannot access LDAP when not root..
[2005/09/06 13:13:13, 0] lib/smbldap.c:smbldap_search_suffix(1176)
smbldap_search_suffix: Problem during the LDAP search: (Timed out)
[2005/09/06 13:13:13, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_set_userinfo
[2005/09/06 13:13:13, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0000 status: NT_STATUS_ACCESS_DENIED
[2005/09/06 13:13:13, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2005/09/06 13:13:13, 10] rpc_server/srv_pipe.c:api_rpcTNP(1587)
api_rpcTNP: rpc input buffer underflow (parse error?)
[2005/09/06 13:13:13, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
021c : 00
I don't understand this as smbd and nmbd are running as root, so why is
it complaining about not being root?
I am sure that there is no problem with the LDAP connection itself. It
is already used for unix authentication (using pam_ldap) and also on
this w2k machine I can browse (windows explorer) the shares on the PDC
using the same username/password used to join the machine to the domain.
So I guess that samba is getting information from LDAP just fine (the
logfile also shows this in other places).
I have a logfile with loglevel 10. I will not publish it on this list (I
think it is too much), but I can share sections with interested developers.
If there is other information that is useful, please just ask.
Has this been fixed already and did I miss it in the releasenotes?
Is there a work-around that I can use?
This has been filed as 3064 with the samba bugzilla.
Thanks,
Jan Evert van Grootheest
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
