[Samba] Samba 3.0.26a, windows 2k3 r2 SFU, problems with auth/nss

Ross Anderson Mon, 05 Nov 2007 10:00:03 -0800

  Dear samba list,

For some time we've had servers connecting to a w2k3 r2 server viaADS setup. Wins was working fine and users were able to authenticate.Recently we've added a GFS like system. This required getting theUID/GID's unified. Suggestions were made on the samba IRC channel toinstall SFU on the PDC. I'm receiving some very strange output.Usernames/pwd have been sanitized from logs/pwd files below. As itstands only 2 users of the PDC are seen with a getent passwd call. Whatis even stranger is that thier UID/GID appears correct but the home dirmatches the old winbind info not the information on the PDC. I'm not seton using SFU and will take other suggestions to keep uid/gid unified.Big concern is simplicity in keeping synced.

I'm concerned I've gotten turned around with all the SMB.conf switchesin this migration. Any help is appreciated thanks!


Ross

wbinfo returns users from PDC however they are not the SFU users butinstead all.


#net ads testjoin
Join is OK
#net rpc testjoin
Join to 'GUTHRIESOUND' is OK


#wbinfo -u

administrator
guest
support_388945a0
krbtgt
iusr_guinevere
iwam_guinevere
dns
2a62ec20-1013-4155-a
rosander
thrust-op
pro-op
studio-op
sedwards
pestby
lobby
reidr
design
apacheglobal
proftpd
dustin
smanager
giga-op
jnordin
bsmith
montanaj
rhealey
rgastelum
jcrehorst
apache


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/false
daemon:x:2:2:daemon:/sbin:/bin/false
adm:x:3:4:adm:/var/adm:/bin/false
lp:x:4:7:lp:/var/spool/lpd:/bin/false
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/bin/false
news:x:9:13:news:/usr/lib/news:/bin/false
uucp:x:10:14:uucp:/var/spool/uucppublic:/bin/false
operator:x:11:0:operator:/root:/bin/nologin
man:x:13:15:man:/usr/share/man:/bin/false
postmaster:x:14:12:postmaster:/var/spool/mail:/bin/false
nut:x:84:84:nut:/var/state/nut:/bin/false
postfix:x:207:207:postfix:/var/spool/postfix:/bin/false
smmsp:x:209:209:smmsp:/var/spool/mqueue:/bin/false
portage:x:250:250:portage:/var/tmp/portage:/bin/false
nobody:x:65534:65534:nobody:/:/bin/false
sshd:x:22:22:added by portage for openssh:/var/empty:/bin/false
cron:x:16:16:added by portage for cronbase:/var/spool/cron:/bin/false
ntp:x:123:123:added by portage for ntp:/dev/null:/usr/sbin/nologin
mysql:x:60:60:added by portage for mysql:/dev/null:/usr/sbin/nologin

ldap:x:439:439:added by portage foropenldap:/usr/lib64/openldap:/usr/sbin/nologin

named:x:40:40:added by portage for bind:/etc/bind:/usr/sbin/nologin
icecast:x:11125:11125::/home/icecast:/bin/bash
apache:x:81:81:added by portage for apache:/var/www:/usr/sbin/nologin
ftp:x:21:21:added by portage for ftpbase:/home/ftp:/usr/sbin/nologin
rpc:x:111:111:added by portage for portmap:/dev/null:/usr/sbin/nologin
tcpdump:x:101:11150:added by portage for tcpdump:/dev/null:/sbin/nologin
clamav:x:102:11147:added by portage for clamav:/dev/null:/sbin/nologin

sedwards:*:10013:10000:Scott W.Edwards:/cluster-general/home/GUTHRIESOUND/sedwards:/bin/falsereidr:*:10012:10000:ReidReisa:/cluster-general/home/GUTHRIESOUND/reidr:/bin/false


[global]
      realm = GUTHRIESOUND.ORG
      workgroup = GUTHRIESOUND
      security = ads
      password server = pdc.guthriesound.org

socket options = TCP_NODELAY SO_KEEPALIVE SO_RCVBUF=8192SO_SNDBUF=8192

      netbios name = AURTHOR
      server string = AURTHOR.GUTHRIESOUND.ORG
      load printers = no
      log file = /var/log/samba/log.%m
      max log size = 50
      log level = 5
      encrypt passwords = yes
      username map = /etc/samba/smbusers
      winbind use default domain = yes
      obey pam restrictions = yes
      template shell = /bin/false
      idmap backend = ad
      idmap uid = 10000-100000
      idmap gid = 10000-100000
      winbind nss info = sfu
      winbind cache time = 60
      allow trusted domains = No
      winbind enum users = yes
      winbind enum groups = yes
      winbind nested groups = yes
      winbind offline logon = yes
      winbind use default domain = yes
      interfaces = 10.0.0.0/24
      client use spnego = yes
      dns proxy = yes
      kernel oplocks = no


*** log.winbindd-idmap

[2007/11/05 09:59:28, 1] nsswitch/idmap_ad.c:idmap_ad_sids_to_unixids(514)
ADS uninitialized

[2007/11/05 09:59:28, 2]nsswitch/idmap.c:idmap_backends_sids_to_unixids(1148)

ERROR: NTSTATUS = 0xc0000001
[2007/11/05 09:59:28, 4] nsswitch/winbindd_dual.c:fork_domain_child(1054)
child daemon request 49

[2007/11/05 09:59:28, 3]nsswitch/winbindd_async.c:winbindd_dual_sid2gid(558)

[ 1427]: sid to gid S-1-5-21-2463403574-2708018288-3802609275-513

***log.winbindd

[2007/11/05 09:59:25, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:25, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:25, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam rosander

[2007/11/05 09:59:26, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:26, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:26, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam ROSANDER

[2007/11/05 09:59:26, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:26, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:26, 3] nsswitch/winbindd_misc.c:winbindd_ping(470)
[ 1438]: ping
[2007/11/05 09:59:26, 3] nsswitch/winbindd_misc.c:winbindd_domain_info(385)
[ 1438]: domain_info [GUTHRIESOUND]

[2007/11/05 09:59:26, 3]nsswitch/winbindd_pam.c:winbindd_pam_auth_crap(1683)

[ 1438]: pam auth crap domain: [GUTHRIESOUND] user: rosander
[2007/11/05 09:59:26, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam guthriesound#rosander

[2007/11/05 09:59:26, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:26, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:26, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam GUTHRIESOUND#rosander

[2007/11/05 09:59:27, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:27, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:27, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam GUTHRIESOUND#ROSANDER

[2007/11/05 09:59:27, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:27, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:27, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam rosander

[2007/11/05 09:59:27, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:27, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:27, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam ROSANDER

[2007/11/05 09:59:27, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:27, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:27, 3] nsswitch/winbindd_misc.c:winbindd_ping(470)
[ 1438]: ping
[2007/11/05 09:59:27, 3] nsswitch/winbindd_misc.c:winbindd_domain_info(385)
[ 1438]: domain_info [GUTHRIESOUND]

[2007/11/05 09:59:27, 3]nsswitch/winbindd_pam.c:winbindd_pam_auth_crap(1683)

[ 1438]: pam auth crap domain: [GUTHRIESOUND] user: rosander
[2007/11/05 09:59:27, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam guthriesound#rosander

[2007/11/05 09:59:28, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:28, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:28, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam GUTHRIESOUND#rosander

[2007/11/05 09:59:28, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:28, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:28, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam GUTHRIESOUND#ROSANDER

[2007/11/05 09:59:28, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:28, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:28, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam rosander

[2007/11/05 09:59:28, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:28, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:28, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[ 1438]: getpwnam ROSANDER

[2007/11/05 09:59:28, 5]nsswitch/winbindd_async.c:winbindd_sid2gid_recv(527)

sid2gid returned an error

[2007/11/05 09:59:28, 5]nsswitch/winbindd_user.c:getpwsid_sid2gid_recv(293)

Could not query gid for user GUTHRIESOUND\rosander
[2007/11/05 09:59:28, 3] nsswitch/winbindd_misc.c:winbindd_ping(470)
[ 1438]: ping

[2007/11/05 10:00:01, 3]nsswitch/winbindd_misc.c:winbindd_interface_version(491)

[ 1443]: request interface version

[2007/11/05 10:00:01, 3]nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)

[ 1443]: request location of privileged pipe
[2007/11/05 10:00:01, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1273)
[ 1443]: getgroups root

[2007/11/05 10:00:01, 3]nsswitch/winbindd_misc.c:winbindd_interface_version(491)

[ 1445]: request interface version

[2007/11/05 10:00:01, 3]nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)

[ 1445]: request location of privileged pipe
[2007/11/05 10:00:01, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1273)
[ 1445]: getgroups root
[2007/11/05 10:00:01, 5] nsswitch/winbindd_async.c:lookupname_recv2(801)
lookup_name returned an error
[2007/11/05 10:00:01, 5] nsswitch/winbindd_async.c:lookupname_recv2(801)
lookup_name returned an error

[2007/11/05 10:02:31, 3]nsswitch/winbindd_misc.c:winbindd_interface_version(491)

[ 1462]: request interface version

[2007/11/05 10:02:31, 3]nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)

[ 1462]: request location of privileged pipe
[2007/11/05 10:02:31, 3] nsswitch/winbindd_user.c:winbindd_list_users(754)
[ 1462]: list users
[2007/11/05 10:02:31, 3] nsswitch/winbindd_ads.c:query_user_list(169)
ads: query_user_list

[2007/11/05 10:02:31, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for (objectCategory=user) in <dc=GUTHRIESOUND,dc=ORG> gave 29replies[2007/11/05 10:02:31, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:31, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:31, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

[2007/11/05 10:02:31, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:31, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:31, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

[2007/11/05 10:02:32, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:32, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:32, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:32, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:32, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:32, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

[2007/11/05 10:02:33, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:33, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:33, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:33, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:33, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:33, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:33, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

[2007/11/05 10:02:34, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:34, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:34, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:34, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:34, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED

[2007/11/05 10:02:34, 2]nsswitch/idmap_ad.c:ad_idmap_cached_connection(152)

ad_idmap_cached_connection: Failed to obtain schema details!

[2007/11/05 10:02:35, 5]libads/ldap_utils.c:ads_do_search_retry_internal(64)Search for(|(attributeId=1.2.840.113556.1.6.18.1.310)(attributeId=1.2.840.113556.1.6.18.1.311)(attributeId=1.2.840.113556.1.6.18.1.344)(attributeId=1.2.840.113556.1.6.18.1.312)(attributeId=1.2.840.113556.1.6.18.1.337))in <CN=Schema,CN=Configuration,DC=guthriesound,DC=org> gave 0 replies[2007/11/05 10:02:35, 3]libads/ldap_schema.c:ads_check_posix_schema_mapping(243)

ads_check_posix_schema_mapping: failed NT_STATUS_NONE_MAPPED