Samba + PDC & WinXP
John Zakhar
jzakhar at ventusnetworks.com
Fri Mar 11 15:36:33 GMT 2005
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Good Morning Folks.
I have a reoccurring error here when trying to join a Windows XP SP2
workstation to a Samba domain (accounts stored in LDAP) The error is
"The user name cannot be found"
Our LDAP directory looks like this
dc=na
~ o=ourdomain
~ ou=Groups
~ ou=Staff
~ ou=Computers
My problem at the moment is all the windows clients are using pGina to
login to the windows workstations,
and modifying the LDAP directories is really less than desirable as we
have several fail over servers (replication etc..)
Mail and all user SSH logins depend on that structure. It would be a
VERY large task on my part to change the structure,
however I need a solution as pGina is no longer something we can
continue to use. pam_ldap along with nsswitch is in place and working
just fine for ldap
The user accounts are all stored in ou=Staff, and during the joining
process the machine account is created in ou=Computers via the IDEALX
smbldap scripts.
According to the trace I am sending with this email the root user is
round and authorized so what gives ? This Winblows machine was patched
to current yesterday.
Samba versions:
[root at vnpdc01 root]# rpm -qa |grep samba
samba-common-3.0.10-1.fc2
samba-3.0.10-1.fc2
samba-client-3.0.10-1.fc2
Any advice or thoughts would be much appreciated.
- --
John Zakhar <jzakhar at ventusnetworks.com>
Systems Administrator.
Ventus Networks
800 Connecticut Ave
Norwalk, CT. 06854
Work 1-(203)-642-2800
Home 1-(860)-318-0276
Cell 1-(203)-257-4165
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
iD8DBQFCMbsAY1bWd3KJkG4RAtJSAKCD3Du5DaN57zjuMRR+5W4ETKZ2zgCcCQ8h
NE+TmW//gB/eJrkYFxPzW1E=
=rysW
-----END PGP SIGNATURE-----
-------------- next part --------------
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 00 00 00 00 64 00 00 C0 .....d.. .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,116)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,116) wrote 116
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 33 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2048
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29396 (0x72D4)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 06 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 01 00 00 00 00 00 05 00 00 ........ ........
[030] 00 00 00 00 00 5F BA 31 42 8F 78 00 00 ....._.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "samr" (pnum 72d4)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x84709e8 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d4 name: samr open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000006
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0xcd2770
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000005
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5f ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 05 00 00 00 00 00 00 00 5F BA 31 42 ........ ...._.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(365)
samr_reply_close_hnd: 365
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d4 name: samr len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000006
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2048
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 34 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2112
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29396 (0x72D4)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 07 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 01 00 00 00 00 00 04 00 00 ........ ........
[030] 00 00 00 00 00 5F BA 31 42 8F 78 00 00 ....._.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "samr" (pnum 72d4)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x84709e8 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d4 name: samr open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000007
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0xcd2770
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000004
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5f ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 5F BA 31 42 ........ ...._.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(365)
samr_reply_close_hnd: 365
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d4 name: samr len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000007
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2112
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 35 of length 45
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2176
smt_wct=3
smb_vwv[ 0]=29396 (0x72D4)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 5] smbd/pipes.c:reply_pipe_close(258)
reply_pipe_close: pnum:72d4
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=72d4 (pipes_open=1)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2176
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 36 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2240
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29393 (0x72D1)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........
[030] 00 00 00 00 00 5E BA 31 42 8F 78 00 00 .....^.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d1
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=1)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "lsarpc" (pnum 72d1)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x8470b88 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d1 name: lsarpc open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000004
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0000
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\lsarpc
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[4].fn == 0xca1fb0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 lsa_io_q_close
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000001
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5e ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5E BA 31 42 ........ ....^.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5E BA 31 42 ........ ....^.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 lsa_io_r_close
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called lsarpc successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d1 name: lsarpc len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000004
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2240
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 37 of length 45
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2304
smt_wct=3
smb_vwv[ 0]=29393 (0x72D1)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d1
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=1)
[2005/03/11 10:33:52, 5] smbd/pipes.c:reply_pipe_close(258)
reply_pipe_close: pnum:72d1
[2005/03/11 10:33:52, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe lsarpc
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name lsarpc pnum=72d1 (pipes_open=0)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2304
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 39
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x27
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 38 of length 43
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=39
smb_com=0x74
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=2368
smt_wct=2
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBulogoffX (pid 30863) conn 0x0
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 5] auth/auth_util.c:free_server_info(1344)
attempting to free (and zero) a server_info structure
[2005/03/11 10:33:52, 3] smbd/reply.c:reply_ulogoffX(1249)
ulogoffX vuid=100
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=39
smb_com=0x74
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=2368
smt_wct=2
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,43)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,43) wrote 43
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 35
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x23
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 39 of length 39
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2432
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtdis (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 3] smbd/service.c:close_cnum(836)
ibm-zus90725eca (172.28.0.64) closed connection to service IPC$
[2005/03/11 10:33:52, 3] smbd/connection.c:yield_connection(69)
Yielding connection to IPC$
[2005/03/11 10:33:52, 4] smbd/vfs.c:vfs_ChDir(654)
vfs_ChDir to /
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2432
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_socket_data(378)
read_socket_data: recv of 4 returned 0. Error = Success
[2005/03/11 10:33:52, 10] lib/util_sock.c:receive_smb_raw(556)
receive_smb_raw: length < 0!
[2005/03/11 10:33:52, 3] smbd/process.c:timeout_processing(1336)
timeout_processing: End of file from client (client has disconnected).
[2005/03/11 10:33:52, 5] lib/gencache.c:gencache_shutdown(88)
Closing cache file
[2005/03/11 10:33:52, 5] libsmb/namecache.c:namecache_shutdown(79)
namecache_shutdown: netbios namecache closed successfully.
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 2] smbd/server.c:exit_server(571)
Closing connections
[2005/03/11 10:33:52, 3] smbd/connection.c:yield_connection(69)
Yielding connection to
[2005/03/11 10:33:52, 5] smbd/oplock.c:receive_local_message(107)
receive_local_message: doing select with timeout of 1 ms
[2005/03/11 10:33:52, 3] smbd/server.c:exit_server(614)
Server exit (normal exit)
More information about the samba-technical
mailing list