net vampire panic - was RE: Samba4 ADS BDC howto/help/status, please?

[Brian Dickson]

Okay, I tried that, and here's what I got:

net -U Administrator vampire CONCERTIA
Password for [CONCERTIA\Administrator]:
talloc: double free error - first free may be at librpc/rpc/dcerpc_connect.c:809
Bad talloc magic value - double free
PANIC: Bad talloc magic value - double free
BACKTRACE: 36 stack frames:
 #0 net(call_backtrace+0x2b) [0x86e2ce7]
 #1 net(smb_panic+0x226) [0x86e2fc1]
 #2 net [0x86fbc2b]
 #3 net [0x86fbcd4]
 #4 net [0x86fbde2]
 #5 net [0x86fc544]
 #6 net(_talloc_steal_loc+0xb4) [0x86fc79b]
 #7 net(data_blob_talloc_named+0x58) [0x86e85a2]
 #8 net [0x81c1793]
 #9 net(gensec_update+0x3a) [0x81b93c5]
 #10 net [0x81e8511]
 #11 net [0x81e9612]
 #12 net(gensec_update+0x3a) [0x81b93c5]
 #13 net [0x815a262]
 #14 net(smb_composite_sesssetup_send+0x1a7) [0x815a5b3]
 #15 net [0x8158219]
 #16 net [0x815884e]
 #17 net [0x8158939]
 #18 net [0x8162718]
 #19 net(packet_recv+0x756) [0x821361e]
 #20 net [0x8161601]
 #21 net [0x86d3524]
 #22 net [0x86d3bd4]
 #23 net(_tevent_loop_once+0xdf) [0x86cff4f]
 #24 net(composite_wait+0x44) [0x8248abe]
 #25 net [0x80dc8f3]
 #26 net(libnet_RpcConnect_recv+0xb4) [0x80dcce6]
 #27 net(libnet_RpcConnect+0x5e) [0x80dcd7a]
 #28 net(libnet_JoinDomain+0x197) [0x80de162]
 #29 net(libnet_Vampire+0x1bd) [0x80ea9a2]
 #30 net(net_vampire+0x17f) [0x80d282f]
 #31 net(net_run_function+0xc5) [0x80d0d11]
 #32 net [0x80d151e]
 #33 net(main+0x22) [0x80d15b8]
 #34 /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xf742b685]
 #35 net [0x80d0941]
Aborted

uname -a output:
Linux mail.concertia.com 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC 2009 x86_64 GNU/Linux

Samba4 version info: /usr/local/src/samba-4.0.0alpha11/source4

Let me know if there's any other info you need (config files, for instance) to help figure out what is at fault...

Thanks,

Brian

-----Original Message-----
From: Matthias Dieter Wallnöfer [mailto:mdw at samba.org] 
Sent: January-22-10 4:02 AM
To: Brian Dickson
Cc: samba-technical at lists.samba.org
Subject: Re: Samba4 ADS BDC howto/help/status, please?

Hi Brian,

Brian Dickson wrote:
> Hi,
>
> I'm interested in deploying Samba4 in a non-critical (but very useful!) role, as an AD backup DC, for authentication purposes only.
>
> Specifically, the environment in which this is to be deployed is:
>
> (A) An AD PDC (and two BDCs) all running Windows Server 2003 SP2 (not, unfortunately, R2 :-) ).
>
> (B) Lots of users and groups, for some smallish value of "lots" (a few dozen).
>
> (C) Add to this, the desire to have Linux host(s) which will authenticate users via PAM with one of pam_winbind, pam_ldap, and/or pam_krb5, by way of Samba4.
>
> The need to have a Linux host do the mappings between UID/GID, and RID/SID (or whatever *ID exists), is why I think Samba4 as BDC (possibly read-only) would be ideal. Samba3 only supports queries against AD PDC with the "support for unix" stuff that came in R2, or against a stand-alone Linux Samba3 PDC.
>    
What do you exactly mean with BDC? Do you mean to interoperate with 
NT4-compatible DCs? Since if you would like to achieve this you are for 
sure using the "NT4/Interim" domain levels (Windows 2000 Mixed or 
Windows 2003 Interim) which we don't support. If you mean to use s4 only 
as an additional DC for plain AD structures, you are fine. We support 
currently the Windows 2003 and Windows 2008 Native mode. There are plans 
to support also Windows 2008R2 Native in the future and maybe also 
Windows 2000 Native, but as you may know, it requires some development 
work to do, since all domain levels have differences in the protocols, 
on which we have to care about.
Regarding Read-only DCs: unfortunately, we don't support this yet.
> The mappings UID/GID would be one-way only, on one host, so the scope is very limited. No conflicts, no race conditions, no data sharing, just authentication (and creating home directories, natch.)
>
> So, my questions are:
>
> (1) Will Samba4 in its current state, be able to handle this?
>    
I think it should work. As Winbind daemon I suggest the s4 one at least 
for now, I'm a bit unsure if the s3 one already works fully against s4 
(since we on the s4 side lack the support for some query constraints - 
this bug shows what I mean: 
https://bugzilla.samba.org/show_bug.cgi?id=6511). Maybe someone more 
involved with winbind like Kai could answer this better.
> (2) What compile/install/provision/configure steps/instructions are (or will be) required?
> (3) Can anyone point me at relevant bits and pieces that might need to be added or tweaked, to support this, if there's still work to be done? (I have incentive to do this, of course.)
> (4) Would anyone object to me adding this to the Wiki/howto, as I think this will be a common use-case?
>    
You can find a page on our mediawiki 
(http://wiki.samba.org/index.php/Samba4/HOWTO) or consider the 
"howto4.txt" included in each source distribution. If you would like to 
join an existing AD domain you have to follow the guide until the 
installation, then make sure to have your computer point to the DNS 
server for AD. Afterwards, instead of running the provision you should 
launch "net vampire <domain>" under the "source4/bin" directory. If all 
went well you should have it up and running. If not, please post here or 
in bugzilla your problem.
Last note: At the moment we suggest always to use a source distribution 
since we evolve fast. Please try to keep your version uptodate since we 
are fixing bugs only if they still persist in new releases (otherwise we 
suggest to update).
> P.S. Sorry for posting to -technical, but I think this is probably the best case to get answers to the above...
>    
No problem!

Matthias