[Samba] W2k/SQL Authentication problems 3.0.1, help please
Jason Jeremias
jason at penguinsolutions.com
Mon Jan 12 19:02:44 GMT 2004
I upgraded from Samba 2.2.8a to Samba 3.0.1, since doing I'm having
problems with my SQL Server and applications running on Windows 2000.
When a users (running a windows 98 client) attempts to query the SQL
Server, either using ODBC (even the Test Sources) or an application that
uses the db. I get a login failed from the sql app, and from the ODBC I
get:
"Login failed for user '(null)', Reason: Not associated with a trusted
SQL Server connection."
That error shows up in the SQL Server Logs, and its displayed at the client.
On the Samba side I see some NT user token: (NULL), in the logs but I'm
not sure what else to look for..
I'm not sure what is going on but it seems like the W2k/SQL Server is
not doing the Windows Authentication properly.
I've attached a testparm -vs and my smb.conf, I can provide logs or
whatever is needed to help me solve the problem.
-------------- next part --------------
# Global parameters
[global]
dos charset = CP850
unix charset = UTF-8
display charset = LOCALE
workgroup = UNICOM
afs username map =
netbios name = CARTMAN
netbios aliases =
netbios scope =
server string = Cartman Anchorage Samba Server %v
interfaces =
bind interfaces only = No
security = USER
auth methods =
encrypt passwords = Yes
update encrypted = No
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
hosts equiv =
min passwd length = 5
map to guest = Never
null passwords = No
obey pam restrictions = No
password server = *
smb passwd file = /etc/samba/private/smbpasswd
private dir = /etc/samba/private
passdb backend = smbpasswd
algorithmic rid base = 1000
root directory =
guest account = nobody
pam password change = No
passwd program =
passwd chat = *new*password* %n\n *new*password* %n\n *changed*
passwd chat debug = No
passwd chat timeout = 2
username map =
password level = 0
username level = 0
unix password sync = No
restrict anonymous = 0
lanman auth = Yes
ntlm auth = Yes
client NTLMv2 auth = No
client lanman auth = Yes
client plaintext auth = Yes
preload modules =
log level = 3
syslog = 1
syslog only = No
log file = /var/log/samba3/log.%m
max log size = 850
timestamp logs = Yes
debug hires timestamp = No
debug pid = No
debug uid = No
smb ports = 445 139
protocol = NT1
large readwrite = Yes
max protocol = NT1
min protocol = CORE
unicode = Yes
read bmpx = No
read raw = Yes
write raw = Yes
disable netbios = No
acl compatibility =
nt pipe support = Yes
nt status support = Yes
announce version = 4.9
announce as = NT
max mux = 50
max xmit = 16644
name resolve order = lmhosts wins host bcast
max ttl = 259200
max wins ttl = 518400
min wins ttl = 21600
time server = No
unix extensions = Yes
use spnego = Yes
client signing = auto
server signing = No
client use spnego = Yes
change notify timeout = 60
deadtime = 0
getwd cache = Yes
keepalive = 300
kernel change notify = Yes
lpq cache time = 10
max smbd processes = 0
paranoid server security = Yes
max disk size = 0
max open files = 10000
read size = 16384
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
use mmap = Yes
hostname lookups = No
name cache timeout = 660
load printers = Yes
printcap name = cups
disable spoolss = No
enumports command =
addprinter command =
deleteprinter command =
show add printer wizard = Yes
os2 driver map =
mangling method = hash2
mangle prefix = 1
stat cache = Yes
machine password timeout = 604800
add user script = /usr/sbin/useradd -s /bin/false '%u'
delete user script = /usr/sbin/userdel '%s'
add group script = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print $3}'
delete group script = /usr/sbin/groupdel '%g'
add user to group script = /usr/bin/gpasswd -a '%u' '%g'
delete user from group script = /usr/bin/gpasswd -d '%u' '%g'
set primary group script = /usr/sbin/usermod -g '%g' '%u'
add machine script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u
shutdown script =
abort shutdown script =
logon script = %U.bat
logon path =
logon drive =
logon home =
domain logons = Yes
os level = 65
lm announce = Auto
lm interval = 60
preferred master = Yes
local master = Yes
domain master = Yes
browse list = Yes
enhanced browsing = Yes
dns proxy = No
wins proxy = No
wins server =
wins support = Yes
wins hook =
wins partners =
kernel oplocks = Yes
lock spin count = 3
lock spin time = 10
oplock break wait time = 0
ldap suffix =
ldap machine suffix =
ldap user suffix =
ldap group suffix =
ldap idmap suffix =
ldap filter = (uid=%u)
ldap admin dn =
ldap ssl =
ldap passwd sync = no
ldap delete dn = No
add share command =
change share command =
delete share command =
config file =
preload =
lock directory = /var/cache/samba
pid directory = /var/run/samba
utmp directory =
wtmp directory =
utmp = No
default service =
message command =
dfree command =
get quota command =
set quota command =
remote announce = 192.168.3.2
remote browse sync = 192.168.3.2
socket address = 0.0.0.0
homedir map = auto.home
time offset = 0
NIS homedir = No
source environment =
panic action =
host msdfs = No
enable rid algorithm = Yes
idmap backend =
idmap uid =
idmap gid =
template primary group = nobody
template homedir = /home/%D/%U
template shell = /bin/false
winbind separator = \
winbind cache time = 300
winbind enable local accounts = Yes
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = No
winbind trusted domains only = No
comment =
path =
username =
invalid users =
valid users =
admin users =
read list =
write list =
printer admin = @domadmin
force user =
force group =
read only = Yes
create mask = 0744
force create mode = 00
security mask = 0777
force security mode = 00
directory mask = 0755
force directory mode = 00
directory security mask = 0777
force directory security mode = 00
inherit permissions = No
inherit acls = No
guest only = No
guest ok = No
only user = No
hosts allow = 192.168.1., 192.168.3., 127.
hosts deny =
nt acl support = Yes
profile acls = No
map acl inherit = No
afs share = No
block size = 1024
max connections = 0
min print space = 0
strict allocate = No
strict sync = No
sync always = No
use sendfile = No
write cache size = 0
max reported print jobs = 0
max print jobs = 1000
printable = No
printing = cups
print command = lpr -r -P'%p' %s
lpq command = lpq -P'%p'
lprm command = lprm -P'%p' %j
lppause command =
lpresume command =
queuepause command =
queueresume command =
printer name =
use client driver = No
default devmode = No
default case = lower
case sensitive = No
preserve case = Yes
short preserve case = Yes
mangle case = No
mangling char = ~
hide dot files = Yes
hide special files = No
hide unreadable = No
hide unwriteable files = No
delete veto files = No
veto files =
hide files =
veto oplock files =
map system = No
map hidden = No
map archive = Yes
mangled names = Yes
mangled map =
browseable = Yes
blocking locks = Yes
csc policy = manual
fake oplocks = No
locking = Yes
oplocks = Yes
level2 oplocks = Yes
oplock contention limit = 2
posix locking = Yes
strict locking = Yes
share modes = Yes
copy =
include =
exec =
preexec close = No
postexec =
root preexec =
root preexec close = No
root postexec =
available = Yes
volume =
fstype = NTFS
set directory = No
wide links = Yes
follow symlinks = Yes
dont descend =
magic script =
magic output =
delete readonly = No
dos filemode = No
dos filetimes = No
dos filetime resolution = No
fake directory create times = No
vfs objects =
msdfs root = No
msdfs proxy =
[homes]
comment = Home Directories
read only = No
browseable = No
[netlogon]
comment = Network Logon Service
path = /home/samba/netlogon
write list = @admins
guest ok = Yes
share modes = No
root preexec = /home/samba/scripts/genlogon.py %U %G %I %m %a %U.bat
root postexec = /bin/rm -f /home/samba/netlogon/%U.bat
[printers]
comment = All Printers
path = /home/samba/spool
create mask = 0700
guest ok = Yes
printable = Yes
print command = lpr-cups -P %p -o raw %s -J'%J' -r # using client side printer drivers.
browseable = No
[print$]
path = /home/samba/printers
write list = @domadmin, root
force user = +root
force group = +misgroup
create mask = 02775
directory mask = 02775
[backup]
path = /home/samba/backups
valid users = @misgroup, root
write list = +misgroup, root
browseable = No
delete readonly = Yes
[misgroup]
comment = The MIS group drive
path = /home/samba/groups/misgroup
valid users = @misgroup
write list = @misgroup
force group = +misgroup
create mask = 0760
directory mask = 0770
browseable = No
delete readonly = Yes
[accting]
comment = The Accounting group drive
path = /home/samba/groups/accting
valid users = @accting
write list = @accting
force group = +accting
create mask = 0760
directory mask = 0770
browseable = No
delete readonly = Yes
[custcare]
comment = The Customer Service group drive
path = /home/samba/groups/custcare
valid users = @custcare
write list = @custcare
force group = +custcare
create mask = 0760
directory mask = 0770
delete readonly = Yes
[purchase]
comment = The Purchasing group share
path = /home/samba/groups/purchase
valid users = @purch
write list = @purchase
force group = +purchase
create mask = 0760
directory mask = 0770
delete readonly = Yes
[nscgroup]
comment = The NSC group share
path = /home/samba/groups/nscgroup
valid users = @nscgroup
write list = @nscgroup
force group = +nscgroup
create mask = 0760
directory mask = 0770
delete readonly = Yes
[unicom]
comment = The Unicom group share
path = /home/samba/groups/unicom
valid users = @unicom
write list = @unicom
force group = +unicom
create mask = 0760
directory mask = 0770
delete readonly = Yes
[revreq]
comment = The Revenue Requirements group share
path = /home/samba/groups/revreq
valid users = @revreq
write list = @revreq
force group = +revreq
create mask = 0760
directory mask = 0770
delete readonly = Yes
[coengnr]
comment = The Central Office group share
path = /home/samba/groups/coengnr
valid users = @coengnr
write list = @coengnr
force group = +coengnr
create mask = 0760
directory mask = 0770
delete readonly = Yes
[ospgroup]
comment = The Outside Plant group share
path = /home/samba/groups/ospgroup
valid users = @ospgroup
write list = @ospgroup
force group = +ospgroup
create mask = 0760
directory mask = 0770
delete readonly = Yes
[execgrp]
comment = The Executive group share
path = /home/samba/groups/execgrp
valid users = @execgrp
write list = @execgrp
force group = +execgrp
create mask = 0760
directory mask = 0770
delete readonly = Yes
[purch]
comment = The Purchasing group share
path = /home/samba/groups/purch
valid users = @purch
write list = @purch
force group = +purch
create mask = 0760
directory mask = 0770
delete readonly = Yes
[facmaint]
comment = The Facility Maintenance
path = /home/samba/groups/facmaint
valid users = @facmaint
write list = @facmaint
force group = +facmaint
create mask = 0760
directory mask = 0770
delete readonly = Yes
[apps]
comment = The Applications Share
path = /home/samba/apps
valid users = @ancusers, @misgroup
write list = jasonj, cgreen
force user = root
force group = +misgroup
create mask = 0755
directory mask = 0775
[open]
comment = The OpenGroups Share
path = /home/samba/open
valid users = @ancusers
write list = @ancusers
force group = +ancusers
create mask = 0766
directory mask = 0777
[pdfdropbox]
comment = The pdfdropbox share
path = /var/spool/cups-pdf
valid users = @ancusers
write list = @ancusers
[tsphere]
comment = The Telesphere Share
path = /home/samba/tsphere
valid users = @tsphere
write list = @tsphere
force group = +tsphere
create mask = 0760
directory mask = 0770
veto oplock files = /*.ini/
[acaduser]
comment = The Autocad Data Share
path = /home/samba/acaddata
valid users = @acaduser
write list = @acaduser
force group = +acaduser
create mask = 0760
directory mask = 0770
[images]
comment = The MIS Images Share
path = /home/samba/images
valid users = @misgroup
write list = @misgroup
force group = +misgroup
create mask = 0760
directory mask = 0770
[audit]
path = /home/samba/audit
write list = @cartman, @stan
force user = root
force group = +misgroup
create mask = 0766
directory mask = 0770
browseable = No
[admindata]
path = /home/samba/admin_data
write list = @misgroup
force user = root
force group = +misgroup
create mask = 0775
directory mask = 0775
browseable = No
[VPCFO]
comment = The VPCFO Share
path = /home/samba/data/finance
valid users = @finance
write list = @finance
force group = +finance
create mask = 0760
directory mask = 0770
[LEGAL]
comment = The Legal Share
path = /home/samba/data/legal
valid users = @legal
write list = @legal
force group = +legal
create mask = 0760
directory mask = 0770
[pcAnywhere$]
comment = pcAnywhere host authenticaton
path = /home/samba/pcAnywhere
valid users = @rempcaw
browseable = No
[castelle]
path = /home/samba/castelle
read only = No
guest ok = Yes
[fpressdb]
path = /home/samba/castelle/archive/database
read only = No
guest ok = Yes
[mismp3]
path = /home/samba/mp3
valid users = jasonj, cgreen
write list = jasonj, cgreen
force user = root
force group = +misgroup
create mask = 0760
directory mask = 0770
browseable = No
[allhome]
path = /home
valid users = root
browseable = No
[syslog]
path = /var/log/
valid