[Samba] users cannot change their passwords in domain

[Dmitry Sukhodoev]

hello, samba.

i have running samba 2.2.8a from the ports on the system:
FreeBSD bingo.ru 4.7-STABLE FreeBSD 4.7-STABLE #2: Tue Mar 25 20:30:51 YEKT
2003 root at bingo.ru:/usr/obj/usr/src/sys/bingo  i386

with config:
=== cut ===
[global]
 workgroup = bingo
 netbios name = emily
 server string = bingo samba daemon
 hosts allow = 192.168.2. 127.
 hosts deny = 192.168.1.
 interfaces = xl2
 bind interfaces only = yes
 map archive = no
 inherit permissions = yes
 logon drive = z:

 domain logons = yes
 domain admin group = raven vova root toor

 logon path = \\%L\profiles\%U

 guest account = guest
 map to guest = bad user
 security = domain

 log file = /var/log/samba/%m.log
 max log size = 512
 pid directory = /var/run
 lock directory = /var/lock

 encrypt passwords = yes
 socket options = TCP_NODELAY

 local master = yes
 os level = 64
 domain master = yes
 preferred master = yes

 client code page = 866
 character set = KOI8-R
 syslog = 0
 hide local users = yes

 include = /usr/local/etc/samba/office_%U.conf

[profiles]
 path = /usr/local/samba/profiles
 browseable = no
 writeable = yes
 guest ok = no
 create mode = 600
 directory mode = 700
 map archive = yes
 inherit permissions = no

[homes]
 comment = home directories
 browsable = no
 guest ok = no
 read only = no
 create mode = 644
 root preexec = /usr/local/raven/samba/exec/root_exec.pl %u %S %I open
 root postexec = /usr/local/raven/samba/exec/root_exec.pl %u %S %I close
=== cut ===

my samba is primary domain controller for my microsoft network with windowzes.
all was well, but from some time my users cannot change their passwords in
domain. windows reports about domain is not available and the smbd writes to
log:

=== cut ===
[2003/04/13 16:39:39, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:39:39, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:39, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:39:39, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:39:39, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:39, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:39:39, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:39, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:39:39, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:39, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:39:40, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:39:40, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:40, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:39:40, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:39:40, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:40, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:39:40, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:39:40, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:40, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:39:40, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:39:40, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:39:40, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,1666) now set to (1666,1666) uid=(0,1666)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] lib/util_sec.c:assert_gid(114)
  Failed to set gid privileges to (0,31) now set to (31,31) uid=(0,2048)
[2003/04/13 16:40:06, 0] lib/util.c:smb_panic(1094)
  PANIC: failed to set gid

[2003/04/13 16:40:06, 0] smbd/password.c:domain_client_validate(1558)
  domain_client_validate: could not fetch trust account password for domain BINGO
=== cut ===

what happen? where is solution? please help - i don't want use native windoze
domain controlle, cause windows servers sucks.

-- 
Dmitry Sukhodoev, network administrator of bingo.ru, icq#550315