[Samba] W2K RAS Server in Samba 3.0.0 Domain

[Andrew Bartlett]

On Sat, 2003-10-11 at 02:37, Beschorner Daniel wrote:
> We set up a DialIn W2K SP4 member server in our Samba 3.0.0 domain.
> 
> When a client dials in the RAS server complains:
> 
> Error 930: The authentication server did not respond to authentication
> requests in a timely fashion. 
> 
> 
> I tracked down the RAS logfile IASSAM.LOG:
> 
> [576] 18:30:34:921: NT-SAM Names handler received request with user identity
> root.
> [576] 18:30:34:921: Prepending default domain.
> [576] 18:30:34:921: SAM-Account-Name is "DOMAIN\root".
> [576] 18:30:34:921: NT-SAM Authentication handler received request for
> DOMAIN\root.
> [576] 18:30:34:921: Processing MS-CHAP v2 authentication.
> [576] 18:30:34:968: LogonUser succeeded.
> [576] 18:30:34:968: NT-SAM User Authorization handler received request for
> DOMAIN\root.
> [576] 18:30:34:968: Using downlevel dial-in parameters.
> [576] 18:30:34:968: DS not installed for domain DOMAIN.
> [576] 18:30:34:968: Connecting to SAM server on \\SERVER.
> [576] 18:30:35:093: Connecting to SAM server on \\SERVER.
> [576] 18:30:35:093: Per-user attribute retrieval failed: Access denied
> 
> 
> Here a corresponding "suspect" part of the level 10 smbd.log that breaks
> it?!?
> 
> 
> [2003/10/10 18:30:37, 5] rpc_parse/parse_prs.c:dbg_rw_punival(806)
>           0028 buffer     : D.O.M.A.I.N.
> [2003/10/10 18:30:37, 4]
> rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>   Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 AD DE 86 3F
> ........ ....­Þ.?
>   [010] 56 50 00 00                                       VP..
> [2003/10/10 18:30:37, 5]
> rpc_server/srv_samr_nt.c:access_check_samr_function(106)
>   _samr_lookup_domain: access check ((granted: 0x00000020;  required:
> 0x00000010)
> [2003/10/10 18:30:37, 2]
> rpc_server/srv_samr_nt.c:access_check_samr_function(115)
>   _samr_lookup_domain: ACCESS DENIED (granted: 0x00000020;  required:
> 0x00000010)
> [2003/10/10 18:30:37, 5] rpc_parse/parse_prs.c:prs_debug(81)
>   000000 samr_io_r_lookup_domain
> [2003/10/10 18:30:37, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>       0000 ptr: 00000000
> [2003/10/10 18:30:37, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>       0004 status: NT_STATUS_ACCESS_DENIED

This looks like a bug to me - can you file it in bugzilla.samba.org - I
was involved in adding the access controls here, and I know there are
issues - we didn't get all the access masks perfect.

However, even when access is permitted, I'm not sure we serve up all the
right attributes anyway...

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba/attachments/20031011/8c4fd697/attachment.bin