winbind is half working: can't auth but can do everything else!

adp dap99 at i-55.com
Sun May 2 14:35:18 GMT 2004


I forgot to mention that I can connect to the 445/tcp port on the DC:

# telnet 192.168.1.146 445
Trying 192.168.1.146...
Connected to 192.168.1.146 (192.168.1.146).
Escape character is '^]'.
lksdjf
^]quit

Connection closed.
# telnet 192.168.1.146 3389
Trying 192.168.1.146...
Connected to 192.168.1.146 (192.168.1.146).
Escape character is '^]'.
lksjdf
^]quit

Connection closed.

----- Original Message -----
From: "adp" <dap99 at i-55.com>
To: <samba-technical at lists.samba.org>
Sent: Sunday, May 02, 2004 9:30 AM
Subject: winbind is half working: can't auth but can do everything else!


> I am using Red Hat ES 3 with Samba 3.0.2-6.3E. I have a weird problem with
> Samba, and I'm sure I'm doing something wrong. I hope someone can give me
a
> pointer.
>
> Problem: When I try to use winbind for authentication I get the following
> error message:
>
> May  2 02:33:46 myserv winbindd[2953]: [2004/05/02 02:33:46, 0]
> rpc_client/cli_pipe.c:rpc_api_pipe(424)
> May  2 02:33:46 myserv winbindd[2953]:   cli_pipe: return critical error.
> Error was Call timed out: server did not respond after 10000 milliseconds
> May  2 02:33:46 myserv winbindd[2953]: [2004/05/02 02:33:46, 0]
> rpc_client/cli_netlogon.c:cli_nt_setup_creds(249)
> May  2 02:33:46 myserv winbindd[2953]:   cli_nt_setup_creds: request
> challenge failed
>
> I had authentication (ssh specifically) working on another test server,
but
> I can't seem to get this working on two new servers. Not sure what is
wrong!
>
> I will go through a few things that I am doing, but first here is smb.conf
> and krb5.conf:
>
> # cat smb.conf
> [global]
>         netbios name = myserv
>         workgroup = MYDOM
>         encrypt passwords = yes
>         realm = MYDOM.COM
>         password server = *
>         security = ADS
>         winbind separator = -
>         idmap uid = 10000-20000
>         idmap gid = 10000-20000
>         winbind enum users = yes
>         winbind enum groups = yes
>         template homedir = /home/%U
>         template shell = /bin/bash
>         winbind use default domain = yes
>
> # cat /etc/krb5.conf
> [logging]
>  default = FILE:/var/log/krb5libs.log
>  kdc = FILE:/var/log/krb5kdc.log
>  admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
>  ticket_lifetime = 24000
>  default_realm = MYDOM.COM
>  dns_lookup_realm = true
>  dns_lookup_kdc = true
>
> [realms]
>  MYDOM.COM= {
>   kdc = dc.mydom.com:88
>   admin_server = dc.mydom.com:749
>   default_domain = mydom.com
>  }
>
> [domain_realm]
>  .mydom.com= MYDOM.COM
>  mydom.com= MYDOM.COM
>
> [kdc]
>  profile = /var/kerberos/krb5kdc/kdc.conf
>
> [appdefaults]
>  pam = {
>    debug = false
>    ticket_lifetime = 36000
>    renew_lifetime = 36000
>    forwardable = true
>    krb4_convert = false
>  }
>
> (I also have /etc/pam.d/system-auth and /etc/nsswitch.conf configured for
> winbind.)
>
>
> Okay, let's first check out Kerb:
>
> [root at myserv samba]# klist
> klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)
>
>
> Kerberos 4 ticket cache: /tmp/tkt0
> klist: You have no tickets cached
> [root at myserv samba]# kinit Administrator
> Password for Administrator at MY.DOM:
> [root at myserv samba]# klist
> Ticket cache: FILE:/tmp/krb5cc_0
> Default principal: Administrator at MY.DOM
>
> Valid starting     Expires            Service principal
> 05/02/04 02:43:30  05/02/04 12:43:30  krbtgt/MY.DOM at MY.DOM
>
>
> Kerberos 4 ticket cache: /tmp/tkt0
> klist: You have no tickets cached
>
> That works. Now let's try an ADS join:
>
> [root at myserv samba]# net ads join
> Using short domain name -- MYDOM
> Joined 'MYSERV' to realm MY.DOM
> [root at myserv samba]# net ads testjoin
> Join is OK
>
> Great!
>
> Now list some home directories on this box for ADS users:
>
> # ll /home/
> total 24
> drwxr-xr-x    2 bob      Domain Users     4096 May  2 01:41 bob
> drwxr-xr-x    2 f        Domain Users     4096 May  2 02:32 f
> drwxr-xr-x    2 root     root        16384 May  1 23:24 lost+found
>
> Now ssh:
>
> # ssh bob at localhost
>
> May  2 02:45:38 myserv winbindd[3127]: [2004/05/02 02:45:38, 0]
> rpc_client/cli_pipe.c:rpc_api_pipe(424)
> May  2 02:45:38 myserv winbindd[3127]:   cli_pipe: return critical error.
> Error was Call timed out: server did not respond after 10000 milliseconds
> May  2 02:45:38 myserv winbindd[3127]: [2004/05/02 02:45:38, 0]
> rpc_client/cli_netlogon.c:cli_nt_setup_creds(249)
> May  2 02:45:38 myserv winbindd[3127]:   cli_nt_setup_creds: request
> challenge failed
> May  2 02:45:38 myserv pam_winbind[3162]: request failed: No logon
servers,
> PAM error was 4, NT error was NT_STATUS_NO_LOGON_SERVERS
> May  2 02:45:38 myserv pam_winbind[3162]: internal module error (retval =
4,
> user = `bob'
> May  2 02:45:38 myserv sshd(pam_unix)[3162]: check pass; user unknown
>
> Weird. ???? What's the problem here? The kinit worked earlier! It seems
like
> it can't find the DC, even though I have this all specified in krb5.conf.
>
> Let's try rpc instead. Maybe that is what winbind is trying to use?
>
> # net rpc join -U Administrator
>
> Unable to find a suitable server
>
> Unable to find a suitable server
>
> # net rpc join -U Administrator -d 3
> [2004/05/02 02:47:50, 3] param/loadparm.c:lp_load(3819)
>   lp_load: refreshing parameters
> [2004/05/02 02:47:50, 3] param/loadparm.c:init_globals(1300)
>   Initialising global parameters
> [2004/05/02 02:47:50, 3] param/params.c:pm_process(566)
>   params.c:pm_process() - Processing configuration file
> "/etc/samba/smb.conf"
> [2004/05/02 02:47:50, 3] param/loadparm.c:do_section(3331)
>   Processing section "[global]"
> [2004/05/02 02:47:50, 2] lib/interface.c:add_interface(79)
>   added interface ip=192.168.1.33 bcast=192.168.1.255 nmask=255.255.255.0
> [2004/05/02 02:47:50, 3] libsmb/namequery.c:resolve_lmhosts(850)
>   resolve_lmhosts: Attempting lmhosts lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:50, 3] libsmb/namequery.c:resolve_wins(748)
>   resolve_wins: Attempting wins lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:50, 3] libsmb/namequery.c:resolve_wins(751)
>   resolve_wins: WINS server resolution selected and no WINS servers
listed.
> [2004/05/02 02:47:50, 3] libsmb/namequery.c:name_resolve_bcast(690)
>   name_resolve_bcast: Attempting broadcast lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:51, 1] utils/net.c:net_find_server(274)
>   no server to connect to
>
> Unable to find a suitable server
> [2004/05/02 02:47:51, 3] libsmb/namequery.c:resolve_lmhosts(850)
>   resolve_lmhosts: Attempting lmhosts lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:51, 3] libsmb/namequery.c:resolve_wins(748)
>   resolve_wins: Attempting wins lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:51, 3] libsmb/namequery.c:resolve_wins(751)
>   resolve_wins: WINS server resolution selected and no WINS servers
listed.
> [2004/05/02 02:47:51, 3] libsmb/namequery.c:name_resolve_bcast(690)
>   name_resolve_bcast: Attempting broadcast lookup for name MYDOM<0x1b>
> [2004/05/02 02:47:51, 1] utils/net.c:net_find_server(274)
>   no server to connect to
>
> Unable to find a suitable server
> [2004/05/02 02:47:51, 2] utils/net.c:main(767)
>   return code = 1
>
> Now watch if I specify a DC:
>
> # net rpc join -S thedc -d 3
> [2004/05/02 09:14:32, 3] param/loadparm.c:lp_load(3819)
>   lp_load: refreshing parameters
> [2004/05/02 09:14:32, 3] param/loadparm.c:init_globals(1300)
>   Initialising global parameters
> [2004/05/02 09:14:32, 3] param/params.c:pm_process(566)
>   params.c:pm_process() - Processing configuration file
> "/etc/samba/smb.conf"
> [2004/05/02 09:14:32, 3] param/loadparm.c:do_section(3331)
>   Processing section "[global]"
> [2004/05/02 09:14:32, 2] lib/interface.c:add_interface(79)
>   added interface ip=192.168.1.33 bcast=192.168.1.255 nmask=255.255.255.0
> [2004/05/02 09:14:32, 3] libsmb/namequery.c:resolve_lmhosts(850)
>   resolve_lmhosts: Attempting lmhosts lookup for name thedc<0x20>
> [2004/05/02 09:14:32, 3] libsmb/cliconnect.c:cli_start_connection(1337)
>   Connecting to host=thedc
> [2004/05/02 09:14:32, 3] lib/util_sock.c:open_socket_out(710)
>   Connecting to 192.168.1.146 at port 445
> [2004/05/02 09:14:43, 0] rpc_client/cli_pipe.c:rpc_api_pipe(424)
>   cli_pipe: return critical error. Error was Call timed out: server did
not
> respond after 10000 milliseconds
> [2004/05/02 09:14:43, 0] rpc_client/cli_netlogon.c:cli_nt_setup_creds(249)
>   cli_nt_setup_creds: request challenge failed
> [2004/05/02 09:14:43, 3] libsmb/trusts_util.c:just_change_the_password(43)
>   just_change_the_password: unable to setup creds
(NT_STATUS_UNSUCCESSFUL)!
> [2004/05/02 09:14:43, 1] utils/net_rpc.c:run_rpc_command(138)
>   rpc command function failed! (NT_STATUS_UNSUCCESSFUL)
> [2004/05/02 09:14:43, 1] utils/net_rpc.c:run_rpc_command(138)
>   rpc command function failed! (NT_STATUS_UNSUCCESSFUL)
> Password:
> [Control-C]
> Interupted by signal.
>
> Notice the 11 second pause at 'Connecting to 192.168.1.146 at port 445'!
>
> I did just now add thedc to my /etc/samba/lmhosts file:
>
> # cat lmhosts
> 127.0.0.1 localhost
> 192.168.1.146   THEDC#20
>
> But this same thing was happening before I did anything to lmhosts.
>
> I have no firewall up on my Linux machine:
>
> # iptables -L -n
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Nor am I running nscd:
>
> # ps auxww|grep nscd
> root     16739  0.0  0.0  3676  660 pts/1    S    09:21   0:00 grep nscd
>
> The above is from a real server running RHES. I have an older server that
I
> initially worked on that is running under VMware that has RHES, and is
> working:
>
> old# ll -d /home/bob/
> drwx------    3 bob Domain Users     4096 May  1 13:08 /home/bob/
>
> old# ssh bob at localhost
> bob at localhost's password: MYDOMPASSWORD
> bob$
>
> What!?
>
> old# klist
> klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)
>
>
> Kerberos 4 ticket cache: /tmp/tkt0
> klist: You have no tickets cached
>
> old# net rpc testjoin
> Join to 'MYDOM' is OK
> [root at smb1 root]# net rpc testjoin -d 1
> Join to 'MYDOM' is OK
> old# net rpc testjoin -d 3
> [2004/05/02 09:27:00, 3] param/loadparm.c:lp_load(3926)
>   lp_load: refreshing parameters
> [2004/05/02 09:27:00, 3] param/loadparm.c:init_globals(1303)
>   Initialising global parameters
> [2004/05/02 09:27:00, 3] param/params.c:pm_process(566)
>   params.c:pm_process() - Processing configuration file
> "/etc/samba/smb.conf"
> [2004/05/02 09:27:00, 3] param/loadparm.c:do_section(3429)
>   Processing section "[global]"
> [2004/05/02 09:27:00, 2] lib/interface.c:add_interface(79)
>   added interface ip=192.168.1.104 bcast=192.168.1.255 nmask=255.255.255.0
> [2004/05/02 09:27:00, 3] libsmb/cliconnect.c:cli_start_connection(1290)
>   Connecting to host=THEDC
> [2004/05/02 09:27:00, 3] lib/util_sock.c:open_socket_out(690)
>   Connecting to 192.168.1.146 at port 445
> Join to 'MYDOM' is OK
> [2004/05/02 09:27:00, 2] utils/net.c:main(758)
>   return code = 0
>
> This machine is configured the same other than having a different 'netbios
> name' in smb.conf. Hmm, also it has samba-3.0.0-14 instead of 3.0.2. (I
> tested the other machine with 3.0.0-14 and 3.0.2.)
>
> I'm not sure what is happening here.
>
>



More information about the samba-technical mailing list