Re: Problems with ACLs in 2.2.8
Date: Mon, 24 Mar 2003 19:43:18 + From: [EMAIL PROTECTED] To: Jan Houstek [EMAIL PROTECTED] Cc: Samba technical list [EMAIL PROTECTED] Subject: Re: Problems with ACLs in 2.2.8 Message-ID: [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED]; +0100 References: [EMAIL PROTECTED] Content-Type: text/plain; charset=us-ascii MIME-Version: 1.0 Precedence: list Message: 12 On Mon, Mar 24, 2003 at 08:39:22PM +0100, Jan Houstek wrote: Hi all! I posted this in [EMAIL PROTECTED] but there were no reactions. Particulary I'm interested if anyone observe the same behavior. I'll take a look at this. Jeremy. As long as you're having a look, will you give a look at the mode problem at file create time? In some cases samba over-rides the umask and inherited acls and creates the file as r--r--r--. Only samba's force create will kind of fix that. It's like the --with-acl-support is not always working. Jeff
Re: Problem with nt acl support when saving Excel or Word Files
Michael Steffens wrote: Hi Jeff, Jeff Mandel wrote: I found this is office 2000 v 9.3821 SR1 (not the latest) We are trying to load the latest office update to see if that fixes it first. Is anybody experiencing this with samba later than 9.4402 SR1 or on the latest version, whatever that is? Would also prefer to find W2k or Office 2000 guilty (would be less work for us), but having the vague feeling that it isn't. Last weekend I could *very* partially fix the problem for W2k, when force group is in effect. Found in log that uid_entry_in_group() in smbd/posix_acls.c unsuccessfully tried to lookup the current UID in the enforced group. I added a test for exactly that configuration, and the revokation of owner write permissions disappeared. But, I do not really understand why it did, and it breaks on every other configuration. And with force group ACLs are only half of the fun :) Furthermore, ACLs of NT4 and WinXP clients end up incorrectly, too. Previous owner and group permissions don't get transferred to the new file. You can end up with the previous writer getting permissions revoked, as the file's group changes to the GID of the last writer (with NT4 and W2k, but not with WinXP). On the other hand, in debug level 10, create_canon_ace_lists() always logs that clients attempt to apply the corresponding allow ACEs. This part does work correctly for W2k clients, however. Cheers! Michael The office update did not the fix the rights problem. It was quite for a week, but now it's back. Hmph. I saw a patch posted here the other day, has anyone tested that? Will it be in 2.2.8? Jeff
Re: Solaris fcntl CPU/Lock update
trace from 12327: (gdb) bt #0 0xfecd9794 in __sigprocmask () from /usr/lib/libthread.so.1 #1 0xfecce1e8 in _deliversigs () from /usr/lib/libthread.so.1 #2 0xfecd05c4 in thr_sigsetmask () from /usr/lib/libthread.so.1 #3 signal handler called #4 0xb in ?? () #5 0xfecdb1f0 in usleep () from /usr/lib/libthread.so.1 #6 0xf7d1c in do_lock_spin (fsp=0x26da48, conn=0x257c68, lock_pid=0, count=20, offset=2147483559, lock_type=WRITE_LOCK) at locking/locking.c:175 #7 0x58bb4 in reply_lockingX (conn=0x257c68, inbuf=0x2173c9 , outbuf=0x237819 , length=75, bufsize=16644) at smbd/reply.c:4714 #8 0x739bc in switch_message (type=36, inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:774 #9 0x73a48 in construct_reply (inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:803 #10 0x73cf4 in process_smb (inbuf=0x2173c9 , outbuf=0x237819 ) at smbd/process.c:897 #11 0x74814 in smbd_process () at smbd/process.c:1294 #12 0x314b4 in main (argc=0, argv=0xffbefeac) at smbd/server.c:832 (gdb) The program is running. Quit anyway (and detach it)? (y or n) y This is a much more interesting backtrace than the other. Why is smbd linking in pthread libraries ? smbd is *NOT* a threaded program. The backtrace you have here shows smbd trying to get a fcntl lock on behalf of a client and failing to get it instantaneously, so going into the lock spin code. It will try 3 times, sleeping for 10 usec between each attempt, and then return a fail to the client. This is not in itself a spinning bug or problem, smbd is meant to do this. I'm worried about the interaction between the Solaris lwp libc code and smbd smbd should be a simple program with only one thread of execution. Jeremy. Since it seems that libthread shows up because nss_ldap (padl's) is used, does anyone have suggestions for dealing with this at the nss_ldap level? Jeff
Re: Problem with nt acl support when saving Excel or Word Files
I have seen this problem crop up recently with 2.2.7a and Win2k. Never saw this before win2k. It looks the same as mentioned in the previous post. posthttp://lists.samba.org/pipermail/samba-technical/2003-January/041748.html File starts out rw-rw--- usera groupa ends up r--r userb groupb umask is 022 Doesn't matter if there are extended ACLs, or inherited ACLs, etc. Same client error also sometimes on windows: Document saved successfully. Cannot reopen the saved document due to low memory. Please close the document. I found this is office 2000 v 9.3821 SR1 (not the latest) We are trying to load the latest office update to see if that fixes it first. Is anybody experiencing this with samba later than 9.4402 SR1 or on the latest version, whatever that is?
Re: Solaris fcntl CPU/Lock update
Esh, Andrew wrote: Also, try loading a few other non-Samba programs into gdb, to see what they require. Maybe threading is a common library to load. I have tried this against sshd, httpd, radiusd and lpsched. None are showing libthread anywhere in the list of symbols. After latest libthread patch, I still have runaways. Results were the same for each process. bt gives a greatly shortened output which highlights libthread quite prominently: [Switching to Thread 1 (LWP 1)] 0xfecd9764 in __sigprocmask () from /usr/lib/libthread.so.1 (gdb) bt #0 0xfecd9764 in __sigprocmask () from /usr/lib/libthread.so.1 #1 0xfecce1b8 in _deliversigs () from /usr/lib/libthread.so.1 #2 0xfecd0594 in thr_sigsetmask () from /usr/lib/libthread.so.1 #3 signal handler called (gdb) The program is running. Quit anyway (and detach it)? (y or n) y Any other suggestions for gathering more info, or compile options for samba? Full list again below: root@reiger# gdb /usr/local/samba/bin/smbd 1812 GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as sparc-sun-solaris2.8... /tmp/1812: No such file or directory. Attaching to program `/usr/local/samba/bin/smbd', process 1812 Reading symbols from /usr/lib/libsec.so.1...done. Loaded symbols for /usr/lib/libsec.so.1 Reading symbols from /usr/lib/libgen.so.1...done. Loaded symbols for /usr/lib/libgen.so.1 Reading symbols from /usr/lib/libsocket.so.1...done. Loaded symbols for /usr/lib/libsocket.so.1 Reading symbols from /usr/lib/libnsl.so.1...done. Loaded symbols for /usr/lib/libnsl.so.1 Reading symbols from /usr/lib/libdl.so.1...done. Loaded symbols for /usr/lib/libdl.so.1 Reading symbols from /usr/lib/libpopt.so.0...done. Loaded symbols for /usr/lib/libpopt.so.0 Reading symbols from /usr/lib/libc.so.1...done. Loaded symbols for /usr/lib/libc.so.1 Reading symbols from /usr/lib/libmp.so.2...done. Loaded symbols for /usr/lib/libmp.so.2 Reading symbols from /usr/platform/SUNW,Sun-Fire-280R/lib/libc_psr.so.1...done. Loaded symbols for /usr/platform/SUNW,Sun-Fire-280R/lib/libc_psr.so.1 Reading symbols from /usr/lib/nss_files.so.1...done. Loaded symbols for /usr/lib/nss_files.so.1 Reading symbols from /usr/lib/nss_ldap.so.1...done. Loaded symbols for /usr/lib/nss_ldap.so.1 Reading symbols from /usr/lib/libpthread.so.1...done. Loaded symbols for /usr/lib/libpthread.so.1 Reading symbols from /usr/local/ldapsdk5/lib/libldap50.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libldap50.so Reading symbols from /usr/local/ldapsdk5/lib/libssldap50.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libssldap50.so Reading symbols from /usr/local/ldapsdk5/lib/libssl3.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libssl3.so ---Type return to continue, or q return to quit--- Reading symbols from /usr/local/ldapsdk5/lib/libnss3.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libnss3.so Reading symbols from /usr/local/ldapsdk5/lib/libnspr4.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libnspr4.so Reading symbols from /usr/local/ldapsdk5/lib/libprldap50.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libprldap50.so Reading symbols from /usr/local/ldapsdk5/lib/libplc4.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libplc4.so Reading symbols from /usr/local/ldapsdk5/lib/libplds4.so...done. Loaded symbols for /usr/local/ldapsdk5/lib/libplds4.so Reading symbols from /usr/lib/libdb-3.3.so...done. Loaded symbols for /usr/lib/libdb-3.3.so Reading symbols from /usr/lib/libresolv.so.2...done. Loaded symbols for /usr/lib/libresolv.so.2 Reading symbols from /usr/lib/libthread.so.1...done. Loaded symbols for /usr/lib/libthread.so.1 Reading symbols from /usr/lib/librt.so.1...done. Loaded symbols for /usr/lib/librt.so.1 Reading symbols from /usr/lib/libaio.so.1...done. Loaded symbols for /usr/lib/libaio.so.1 sol-thread active. Retry #1: Retry #2: Retry #3: Retry #4: [New LWP1] [New Thread 1 (LWP 1)] Symbols already loaded for /usr/lib/libsec.so.1 Symbols already loaded for /usr/lib/libgen.so.1 Symbols already loaded for /usr/lib/libsocket.so.1 Symbols already loaded for /usr/lib/libnsl.so.1 Symbols already loaded for /usr/lib/libdl.so.1 Symbols already loaded for /usr/lib/libpopt.so.0 Symbols already loaded for /usr/lib/libc.so.1 Symbols already loaded for /usr/lib/libmp.so.2 Symbols already loaded for /usr/platform/SUNW,Sun-Fire-280R/lib/libc_psr.so.1 Symbols already loaded for /usr/lib/nss_files.so.1 Symbols already loaded for /usr/lib/nss_ldap.so.1 Symbols already loaded for /usr/lib/libpthread.so.1 Symbols already loaded for /usr/local/ldapsdk5/lib/libldap50.so Symbols already loaded for /usr/local/ldapsdk5/lib/libssldap50.so Symbols already loaded for
Re: Solaris fcntl CPU/Lock update
handler called #5 0x65646974 in ?? () #6 0xfecdb1f0 in usleep () from /usr/lib/libthread.so.1 #7 0xf7d1c in do_lock_spin (fsp=0x27d450, conn=0x26e760, lock_pid=0, count=1, offset=2147483538, lock_type=WRITE_LOCK) at locking/locking.c:175 #8 0x58bb4 in reply_lockingX (conn=0x26e760, inbuf=0x2173c9 , outbuf=0x237819 , length=75, bufsize=16644) at smbd/reply.c:4714 #9 0x739bc in switch_message (type=36, inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:774 #10 0x73a48 in construct_reply (inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:803 #11 0x73cf4 in process_smb (inbuf=0x2173c9 , outbuf=0x237819 ) at smbd/process.c:897 #12 0x74814 in smbd_process () at smbd/process.c:1294 #13 0x314b4 in main (argc=0, argv=0xffbefeac) at smbd/server.c:832 (gdb) The program is running. Quit anyway (and detach it)? (y or n) y trace from 12327: (gdb) bt #0 0xfecd9794 in __sigprocmask () from /usr/lib/libthread.so.1 #1 0xfecce1e8 in _deliversigs () from /usr/lib/libthread.so.1 #2 0xfecd05c4 in thr_sigsetmask () from /usr/lib/libthread.so.1 #3 signal handler called #4 0xb in ?? () #5 0xfecdb1f0 in usleep () from /usr/lib/libthread.so.1 #6 0xf7d1c in do_lock_spin (fsp=0x26da48, conn=0x257c68, lock_pid=0, count=20, offset=2147483559, lock_type=WRITE_LOCK) at locking/locking.c:175 #7 0x58bb4 in reply_lockingX (conn=0x257c68, inbuf=0x2173c9 , outbuf=0x237819 , length=75, bufsize=16644) at smbd/reply.c:4714 #8 0x739bc in switch_message (type=36, inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:774 #9 0x73a48 in construct_reply (inbuf=0x2173c9 , outbuf=0x237819 , size=75, bufsize=16644) at smbd/process.c:803 #10 0x73cf4 in process_smb (inbuf=0x2173c9 , outbuf=0x237819 ) at smbd/process.c:897 #11 0x74814 in smbd_process () at smbd/process.c:1294 #12 0x314b4 in main (argc=0, argv=0xffbefeac) at smbd/server.c:832 (gdb) The program is running. Quit anyway (and detach it)? (y or n) y [EMAIL PROTECTED] wrote: On Fri, Jan 31, 2003 at 09:07:23AM -0800, Jeff Mandel wrote: I have followed this fcntl bug closely, and I just applied a T-patch for solaris 8 which brought the kernel 108528-19. This includes the fix for 4735093. This has not fixed the problem of smbd growing to consume all available CPU. Environment is SunOS reiger 5.8 Generic_108528-19 sun4u sparc SUNW,Sun-Fire-280R nss_ldap-203 pam_ldap-137 Here's an excerpt of the truss I've used to diagnose this with sun. 24495/1:*** SUID: ruid/euid/suid = 0 / 3007 / 3007 *** 24495/1:*** SGID: rgid/egid/sgid = 0 / 125 / 125 *** Base time stamp: 1041263328.3198 [ Mon Dec 30 16:48:48 CET 2002 ] 24495/1:psargs: /usr/local/samba/bin/smbd -D -s/usr/local/samba/lib/smb. conf 24495/1: 0.0012 sigprocmask(SIG_SETMASK, 0xFED2AD70, 0xFFBEDF10) = 0 24495/1: set = 0xFFBFFEFF 0x1FFF 0 0 24495/1:oset = 0 0 0 0 24495/1: 0.0016 lwp_kill(1, SIGUSR1)= 0 24495/1: 0.0018 sigprocmask(SIG_SETMASK, 0xFFBEDF10, 0x) = 0 24495/1: set = 0 0 0 0 24495/1: 0.0019 Received signal #16, SIGUSR1 [caught] 24495/1: siginfo: SIGUSR1 pid=24495 uid=0 code=-1 24495/1: 0.0021 setcontext(0xFFBED9C8) 24495/1: 0.0022 sigprocmask(SIG_SETMASK, 0xFED2AD70, 0xFFBEDEB0) = 0 24495/1: set = 0xFFBFFEFF 0x1FFF 0 0 24495/1:oset = 0 0 0 0 24495/1: 0.0025 lwp_kill(1, SIGUSR1)= 0 Please ensure the smbd process is compiled with debug symbols (-g) and then attach to it with gdb and please send in a stack backtrace (bt command in gdb). Thanks, Jeremy. *** Repeats continuously *** Any suggestions?
Re: Update on Samba fcntl problem with Solaris?
I have been trying to get the bug fix from Sun, and based on the trusses I have sent, they believe that the problem I'm having is not the same as that reported in the bug 4700402. They are working on those trusses now. From my experience with this problem and the way I've seen others describe it on the list, I believe I have the same cpu hog/locking problem mentioned in the bug. This has continued through 2.2.7a. A kernel update was released, but did not yet include the fix for 4700402. Jeff
Binaries for solaris disappearing from ftp site
Since the recent announcement for the 2.2.7 release, I looked again for solaris binaries. For a while there were packages up to 2.2.4. After 2.2.5 came out the others vanished and 2.2.2 and 2.0.7 were left. Are you still planning to keep packages for solaris on the samba site?
Re: System documentation of Samba
Date: Thu, 5 Sep 2002 13:14:41 + From: [EMAIL PROTECTED] To: Johannes Tyve [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: System documentation of Samba On Thu, Sep 05, 2002 at 08:59:36AM +0200, Johannes Tyve wrote: One of our servers crashed and when we booted it again one Samba process hung and grabbed one of the servers cpu's. When we killed the samba process, another process generated 100% load on one cpu. From the log file: smbd/open.c:open_mode_check(555) open_mode_check: exlusive oplock left by process 23227 after break ! For file profile/.../office.file.doc, dev = 900, inode = 2704003. Deleting it to continue... lib/util.c:smb_panic(1055) PANIC: open_mode_check: Existant process 23227 left active oplock. We tried to disable oplocks but no luck. After some more testing we deleted all files in /var/opt/samba/lock (brlock.tdb connections.tdb messages.tdb ntdrivers.tdbntprinters.tdb share_info.tdb unexpected.tdb browse.dat locking.tdb ntforms.tdb printing.tdb ) and restarted samba. This time it worked fine. Is there som information about the tdb file and the inner structures of Samba? What do we lose if we delete the diffrent tdb files? We are using Samba 2.2.2 This was one of the problems we fixed after 2.2.2. I would recommend upgrading to 2.2.5. However there are still some scaling problems with Solaris, we are awaiting confirmation of a Sun hotfix on the issue (it's a Solaris bug now, not a Samba one). Jeremy. Could you provide some details the bug in Solaris? 2.2.2 used to work fine for me, but recently it has fallen apart. 2.2.5 behaves the same. I can think of a recent jumbo patch cluster installation that might be to blame, but I'd like to know if it's possible to track it down a back it out for now. Jeff
Re: System documentation of Samba
David Collier-Brown wrote: Jeff Mandel wrote: Could you provide some details the bug in Solaris? 2.2.2 used to work fine for me, but recently it has fallen apart. 2.2.5 behaves the same. I can think of a recent jumbo patch cluster installation that might be to blame, but I'd like to know if it's possible to track it down a back it out for now. Sure: it's a performance problem with locks which shows up when locking the index file of a dbm-style database (which have two files, an index and a data file), and which is being shared via Samba with PC clients. At least one site, and probably two, have the problem. I'm following it with considerable interest (I work for Sun, you see, although not on Samba (:-)) It doesn't affect the performance of Samba on Solaris in general, and oddly enough it doesn't seem to hit MS Access... open_mode_check: exlusive oplock left by process 23227 after break For file profile/.../office.file.doc, It's not related to the problem you see, with ordinary oplocked .doc files. One wouldn't oplock dbm files! --dave It sounds like there are two scenarios here: 1) Locking performance problems on dbm-style databases shared with PCs. (We're not using any of those) 2) Race conditions caused by ??? (We have problem with this big time - and the one I'm more concerned about) Is the solaris bug that causes CPU race that Jeremy was referring to one of locking on samba's own db files in var/locks? Jeff
PANIC: open_mode_check:/CPU hog: still an issue in 2.2.5 on solaris?
I've been troubleshooting a cpu race condition that looks like a problem that's been around for a while on solaris. I upgraded to 2.2.5 and was unable to get any handle on what could cause this, I downgraded to 2.2.2 which was the last one I could remember working well for us and got this before too long: [2002/08/29 08:46:59, 0] smbd/open.c:open_mode_check(555) open_mode_check: exlusive oplock left by process 4768 after break ! For file netscape/cookies.txt, dev = 3052111, inode = 1935369. Deleting it to continue... [2002/08/29 08:46:59, 0] lib/util.c:smb_panic(1055) PANIC: open_mode_check: Existant process 4768 left active oplock. [2002/08/29 08:49:05, 0] smbd/oplock.c:request_oplock_break(1026) request_oplock_break: no response received to oplock break request to pid 4768 on port 24655 for dev = 3052111, inode = 1935369 for dev = 3052111, inode = 1935369, tv_sec = 3d6dc2a7, tv_usec = 88146 The related smbd rose to 50% cpu usage and had to be killed with a kill -9. I've set oplocks = no now to see if that will help, though this has also happened in 2.2.5 with oplocks off. This problem occurs in 2.2.5 where smbds just grow in cpu usage without apparently doing anything, I just don't get the PANIC: open_mode_check error in the logs. It seems fairly well distributed amongst the various clients, though some seem to start this more than others. There are only a few clients (15) sharing on a server with mail and oracle. There's 4G of memory and 2x750Mhz cpu. I'd say is a very lightly loaded system. I've seen some of Fredrik Ohrn's postings with truss and lsof, and it's not clear that it's ever really been fixed. What can I do to narrow in on the cause of this? Am I trading different problems here between 2.2.2 and 2.2.5 or are these cpu races recognized as the same problem? Thanks, Jeff
Re: Prepending \ to user name w/Win98 Domain Login
Simo Sorce wrote:
3) The valadation doesn't really validate in this case since the value
used is not what the sytem returned: \jeff != jeff, but the check in
reply.c is only for != NULL. When this gets looked up the the samba
password db, failure is certain. There's no \jeff in the samba password
database.
what != NULL case do you refer to?
In reply.c line 927
if (sys_getpwnam(dom_user) != NULL) {
pstrcpy(user, dom_user);
DEBUG(3,(Using unix username %s\n, dom_user));
This call checks if sys_getpwnam is the same as the dom_user, but it
doesn't actually check the info returned from sys_getpwnam, it assumes
that if it returns at all, it must be the same. When you throw in the
winbind separator, with NIS on solaris, it seems you can get a positive
return from sys_getpwnam(\jeff).
The returned value though, is not \jeff but that getpwnam string, which
should probably be parsed for the user name if a validation was to be
done. That way you know if the value returned matches the value you were
testing.
perhaps it should be something like
if (parse_user(sys_getpwnam(dom_user)) == dom_user.
sesssetupX:name=[JEFF]
[2002/08/11 12:21:44, 3] smbd/reply.c:reply_sesssetup_and_X(929)
Using unix username \JEFF
[2002/08/11 12:21:44, 2] smbd/reply.c:reply_sesssetup_and_X(982)
Defaulting to Lanman password for \jeff
[2002/08/11 12:21:44, 1] smbd/password.c:pass_check_smb(545)
Couldn't find user '\jeff' in passdb.
[2002/08/11 12:21:44, 1] smbd/reply.c:reply_sesssetup_and_X(998)
Rejecting user '\jeff': authentication failed
This log seem to avail your claim, can you provide informations about
client OS, NIS server OS, samba version
This is win98 sp2 and samba-2.2.5, solaris 8 and NIS service is provided
by padl's ypldapd agains iPlanet directory server. When ypldapd is
searching,, I can see that the request is clean:
[19/Aug/2002:09:01:35 -0700] conn=1908789 op=1583 SRCH base=o=probes
scope=2 filter=((objectclass=posixAccount)(uid=jeff))
[19/Aug/2002:09:01:35 -0700] conn=1908789 op=1583 RESULT err=0 tag=101
nentries=1 etime=0
I'm guessing from this that the NIS client libraries must be cleaning up
the request before passing this along to ypldapd, though it's also
possible the ypldapd is cleaning up the request itself.
When I drop NIS and just use nss_ldap, the leading slashes can be seen
in the ldap logs.
[19/Aug/2002:09:05:52 -0700] conn=1922842 op=1 SRCH base=o=probes
scope=2 filter=((objectclass=posixAccount)(uid=\\jeff))
[19/Aug/2002:09:05:52 -0700] conn=1922842 op=1 RESULT err=0 tag=101
nentries=0 etime=0
There are certainly some other possibilities with nscd in the mix, but I
think it's safe to say that there is a situation when the sys_getpwnam
unexpectedly turns up positive.
4) When the client is win2k which passes a domain in, this code is
called to lookup getpwnam(domainsepuser). Without some special
module, when would a unix system ever return a positive response to this
kind of lookup?
see above (if that lookup fails, username alone is tested)
Maybe it's only in rare cases where people are using ypldapd for NIS on
solaris that these lookups can return true, but I think the real issue
is the use of the winbind separator when winbind is not in use.
sys_getpwnam has only one instance in reply.c. When it gets called it's
always called with winbind separator username - never just user
name. A nullnulluser lookup would have a better chance of sucess
then nullseparatoruser.
This is why I'm wondering if winbind is not in use, why this test is
done this way. Without winbind, when would you use a winbind separator?
Even if the domain came through properly, what other cases would this
syntax (MP\jeff) return true on a getpwnam lookup?
Jeff
Re: Prepending \ to user name w/Win98 Domain Login
While that was an example of how it returns with NIS, a better one might have been to show the lookup quoted - like ypmatch \jeff passwd, but I agree the escaping can be confusing and misleading with the shell there. The log files excerpts and ldap lookups weren't done by shell, per se, but by smbd. How would the shell come into play in those instances? Jeff Mike Gerdts wrote: On Fri, 2002-08-16 at 11:21, Jeff Mandel wrote: 2) The wacky thing here is that \user actually returns successful with NIS. jeff@host% getent passwd jeff jeff:x:6789:6789::/export/home/jeff:/bin/ksh jeff@host% getent passwd \jeff jeff:x:6789:6789::/export/home/jeff:/bin/ksh Not quite right. Your shell handled the \j and determined that it should have just been j. As such, the getent command really saw jeff, not \jeff. The proper test would have been jeff@host% getent passwd \\jeff In this case your shell would have translated \\jeff into \jeff before sending it as an argument to getent. Mike
Prepending \ to user name w/Win98 Domain Login
Using samba as a PDC, logins from win98 don't seem to send a domain name
with the user name when using a domain login. As a result, there's some
kind of null domain which causes a leading slash to be prepended to the
user name. I believe this is the separator character of domain\user
syntax.
If the domain is somhow blank, as shown in Domain=[], I would expect the
user name to just be user not \user, which fails login every time
:) Works OK on win2K.
[2002/08/11 12:21:44, 3] smbd/sec_ctx.c:set_sec_ctx(314)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/08/11 12:21:44, 3] smbd/reply.c:reply_sesssetup_and_X(858)
Domain=[] NativeOS=[Windows 4.0] NativeLanMan=[Windows 4.0]
[2002/08/11 12:21:44, 3] smbd/reply.c:reply_sesssetup_and_X(868)
sesssetupX:name=[JEFF]
[2002/08/11 12:21:44, 3] smbd/reply.c:reply_sesssetup_and_X(929)
Using unix username \JEFF
[2002/08/11 12:21:44, 2] smbd/reply.c:reply_sesssetup_and_X(982)
Defaulting to Lanman password for \jeff
[2002/08/11 12:21:44, 1] smbd/password.c:pass_check_smb(545)
Couldn't find user '\jeff' in passdb.
[2002/08/11 12:21:44, 1] smbd/reply.c:reply_sesssetup_and_X(998)
Rejecting user '\jeff': authentication failed
[2002/08/11 12:21:44, 3] smbd/error.c:error_packet(91)
error string = No such file or directory
[2002/08/11 12:21:44, 3] smbd/error.c:error_packet(126)
error packet at smbd/reply.c(1000) cmd=115 (SMBsesssetupX) eclass=2
ecode=2
[2002/08/11 12:21:44, 3] smbd/process.c:timeout_processing(1102)
end of file from client
[2002/08/11 12:21:44, 3] smbd/sec_ctx.c:set_sec_ctx(314)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2002/08/11 12:21:44, 2] smbd/server.c:exit_server(461)
Closing connections
[2002/08/11 12:21:44, 3] smbd/connection.c:yield_connection(48)
Yielding connection to
[2002/08/11 12:21:44, 3] smbd/server.c:exit_server(495)
Server exit (normal exit)
I made a change to reply.c in 2.2.2, but the funcion has been changed
and no longer take two args.
root@mp5# diff reply.c reply.c.orig
737,739c737
DEBUG(3,(Not PROTOCOL_NT1 user=[%s]\n, user));
pstrcpy(user,dos_to_unix(user,False));
DEBUG(3,(Not PROTOCOL_NT1 dos_to_unix user=[%s]\n, user));
---
pstrcpy(user,dos_to_unix(user,False));
744,746d741
927d921
DEBUG(3,(Using username %s\n, user));
930d923
DEBUG(3,(Using dom_user %s\n, dom_user));
932c925
if (sys_getpwnam(dom_user) != NULL strlen(domain) 0 ) {
---
if (sys_getpwnam(dom_user) != NULL) {
Ideas?
Thanks,
Jeff
