[Samba] Domain Trust on ADS.

[Gerald (Jerry) Carter]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Gaurang Pandya wrote:
| Hi Jerry,
|
| Here is the output for debug level 10. Though there
| are so many things there (ofcourse) I am pasting only
| few line which I think will give you clue. If you need
| any more of those please tel me.
|
| rpc_api_pipe: len left: 0 smbtrans read: 48
| rpc_api_pipe: fragment first and last both set
| 000018 samr_io_r_connect
|     000018 smb_io_pol_hnd connect_pol
|         0018 data1: 00000000
|         001c data2: 00000000
|         0020 data3: 0000
|         0022 data4: 0000
|         0024 data5: 00 00 00 00 00 00 00 00
|     002c status: NT_STATUS_ACCESS_DENIED
| refresh_sequence_number: backend returned 0xc0000022
| refresh_sequence_number: seq number is now -1
| client_write: wrote 1304 bytes.
| client_write: need to write 38 extra data bytes.
| client_write: wrote 38 bytes.
| client_write: client_write: complete response written.
| read failed on sock 11, pid 939: EOF

Yup.  This is the problem.  This is a native mode
domain right?  You need to give winbindd a username/pw
pair to connect to the DC since the domain policy has
been set to disallow anonymous access to the SAMR pipe.

The other option is to upgrade to 3.0 which works
around this both in security = domain and security = ads
modes but either using cached user information from
the net_samlogon() reply or by using the kerberos
ticket for the machine account to connect to any
2k trusted DC's.





cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/2c21IR7qMdg1EfYRAqI7AJ0SzzUfBfVIW1bLNGlMWXakrp64KACgnY/X
p2R6s+bi4MU8m7U/Mn3NNfY=
=2KjU
-----END PGP SIGNATURE-----