[Samba] 3.0.23 PDC with ldapsam:trusted backend - failed to setup guest info.

Tue Aug 22 05:34:51 GMT 2006

Hi everybody.

This is my first post here - Im hoping that someone out there can  
shed some light on my little problem, it's starting to drive me  
nuts!  :)

Ive had a look through the archives as well as other methods for  
finding a solution to my problem but to no avail, so I decided to  
post here - hope you dont mind!

Im migrating an old samba 2.2 PDC to a new system running 3.0.23, we  
have a requirement not to have local users on this new machine - no  
problems says I , this will give me a chance to try out an ldapsam  
backend with ldapsam:trusted.

I have populated the nobody and root user accounts (as well as some  
test users) into LDAP but when I try to start samba, it fails with a  
"ERROR: failed to setup guest info." error in log.smbd.

 From what I have seen from a debug level 3 log (attached) of this  
sequence, it binds to the LDAP directory, finds the root user, hits a  
permission error (WERR_ACCESS_DENIED) along the way, starts to find  
my nobody user (I see references to nobody's uid - 60001 - in the  
log) and then bombs out. nmdb starts up but smbd doesnt come up (for  
more than a second anyway, if at all)

Our directory already has the samba schemas installed and this  
directory serves PDC requests for another of our domains (that has  
local unix users defined) - so I am assuming that this is not a  
schema issue. I am thinking that I have missed something rather  
obvious along the way, as it is my first time attempting this, or i  
have done something completely wrong fundamentally and digging myself  
a deeper and deeper hole as I continue?!

Any help would be GREATLY appreciated  :)

I have included copies of my log.smbd (debug level 3) , my smb.conf  
and a dump of my root,nobody and nobody group ldap entries. If you  
need any more information - just ask.

Thanks

Simon

(log.smbd)

[2006/08/22 11:44:58, 0] smbd/server.c:main(847)
   smbd version 3.0.23 started.
   Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
   Processing section "[homes]"
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
   Processing section "[netlogon]"
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
   Processing section "[Profiles]"
[2006/08/22 11:44:58, 3] param/loadparm.c:lp_add_ipc(2629)
   adding IPC service
[2006/08/22 11:44:58, 3] printing/pcap.c:pcap_cache_reload(117)
   reloading printcap cache
[2006/08/22 11:44:59, 3] printing/print_svid.c:sysv_cache_reload(72)
   No Printers found!!!
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(223)
   reload status: error
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(117)
   reloading printcap cache
[2006/08/22 11:44:59, 3] printing/print_svid.c:sysv_cache_reload(72)
   No Printers found!!!
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(223)
   reload status: error
[2006/08/22 11:44:59, 2] lib/interface.c:add_interface(81)
   added interface ip=130.95.72.10 bcast=130.95.72.255  
nmask=255.255.255.0
[2006/08/22 11:44:59, 2] lib/interface.c:add_interface(81)
   added interface ip=130.95.136.10 bcast=130.95.136.255  
nmask=255.255.255.0
[2006/08/22 11:44:59, 3] smbd/server.c:main(877)
   loaded services
[2006/08/22 11:44:59, 3] smbd/server.c:main(892)
   Becoming a daemon.
[2006/08/22 11:44:59, 2] lib/tallocmsg.c:register_msg_pool_usage(61)
   Registered MSG_REQ_POOL_USAGE
[2006/08/22 11:44:59, 2] lib/dmallocmsg.c:register_dmalloc_msgs(71)
   Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
[2006/08/22 11:44:59, 2] lib/smbldap_util.c:smbldap_search_domain_info 
(219)
   smbldap_search_domain_info: Searching for:[(& 
(objectClass=sambaDomain)(sambaDomainName=EE-CIIPS2))]
[2006/08/22 11:44:59, 2] lib/smbldap.c:smbldap_open_connection(788)
   smbldap_open_connection: connection opened
[2006/08/22 11:44:59, 3] lib/smbldap.c:smbldap_connect_system(992)
   ldap_connect_system: succesful connection to the LDAP server
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:push_sec_ctx(208)
   push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] smbd/uid.c:push_conn_ctx(345)
   push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:set_sec_ctx(241)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541)
   init_sam_from_ldap: Entry found for user: root
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:pop_sec_ctx(339)
   pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:store_gid_sid_cache(1038)
   store_gid_sid_cache: gid 0 in cache -> S-1-22-2-0
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_sid_from_uid_cache 
(907)
   fetch sid from uid cache 0 ->  
S-1-5-21-2285122461-3938449209-3485319758-1000
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache 
(979)
   fetch sid from gid cache 0 -> S-1-22-2-0
[2006/08/22 11:44:59, 3] lib/util_seaccess.c:se_access_check(250)
[2006/08/22 11:44:59, 3] lib/util_seaccess.c:se_access_check(251)
   se_access_check: user sid is S-1-1-0
   se_access_check: also S-1-5-2
   se_access_check: also S-1-5-7
[2006/08/22 11:44:59, 0] services/services_db.c:svcctl_init_keys(420)
   init_services_keys: key lookup failed! (WERR_ACCESS_DENIED)
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:push_sec_ctx(208)
   push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] smbd/uid.c:push_conn_ctx(345)
   push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:set_sec_ctx(241)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:store_gid_sid_cache(1038)
   store_gid_sid_cache: gid 60001 in cache -> S-1-22-2-60001
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_gid_from_cache(999)
   fetch gid from cache 60001 -> S-1-22-2-60001
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:pop_sec_ctx(339)
   pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 0] smbd/server.c:main(960)
   ERROR: failed to setup guest info.

(smb.conf)

[global]

log level = 3

# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
    workgroup = EE-CIIPS2
    netbios name = ee-ciips2

# server string is the equivalent of the NT Description field
    server string = CIIPS Access Server

# Security mode. Defines in which mode Samba will operate. Possible
# values are share, user, server, domain and ads. Most people will want
# user level security. See the Samba-HOWTO-Collection for details.
    security = user

# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
    hosts allow = 130.95.72. 130.95.149.

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
#   load printers = no

#   printer admin = @eeadmin

# you may wish to override the location of the printcap file
;   printcap name = /etc/printcap

# on SystemV system setting printcap name to lpstat should allow
# you to automatically obtain a printer list from the SystemV spool
# system
;   printcap name = lpstat

# It should not be necessary to specify the print system type unless
# it is non-standard. Currently supported print systems include:
# bsd, cups, sysv, plp, lprng, aix, hpux, qnx
#   printing = lprng

# Uncomment this if you want a guest account, you must add this to / 
etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest

# this tells Samba to use a separate log file for each machine
# that connects
    log file = /usr/local/daemon/samba-ciips/var/log.%m

# Put a capping on the size of the log files (in Kb).
    max log size = 50

# Use password server option only with security = server
# The argument list may include:
#   password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
#   password server = *
;   password server = <NT-Server-Name>

# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
;   realm = MY_REALM

# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
;   passdb backend = tdbsam
    passdb backend = ldapsam:ldaps://ldap.ee.uwa.edu.au

ldap admin dn = cn=LDAPMgr,dc=ee,dc=uwa,dc=edu,dc=au
ldap ssl = on
ldap suffix = ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
ldap machine suffix =
ldap user suffix =
ldap group suffix = ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
;ldap idmap=suffix = ou=ciips
ldapsam:trusted=yes

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
#       this line.  The included file is read at that point.
;   include = /usr/local/samba/lib/smb.conf.%m

# Most people will find that this option gives better performance.
# See the chapter 'Samba performance issues' in the Samba HOWTO  
Collection
# and the manual pages for details.
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
    socket options = TCP_NODELAY

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
    interfaces = bge903002 bge907002

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
    local master = yes

# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
    os level = 33

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
    domain master = yes

# Preferred Master causes Samba to force a local browser election on  
startup
# and gives it a slightly higher chance of winning the election
    preferred master = yes

# Enable this if you want Samba to be a domain logon server for
# Windows95 workstations.
    domain logons = yes

# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
;   logon script = %m.bat
# run a specific logon batch file per username
;   logon script = %U.bat
    logon script = login.bat

# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
    logon path = \\%L\Profiles\%U
    logon drive = H:
    logon home = \\%L\%U

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's  
WINS Server
    wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#       Note: Samba can be either a WINS Server, or a WINS Client,  
but NOT both
;   wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one  WINS Server on the network. The default is NO.
;   wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The default is NO.
    dns proxy = no

# These scripts are used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
;  add user script = /usr/sbin/useradd %u
;  add group script = /usr/sbin/groupadd %g
   add machine script = /usr/sbin/adduser -n -g machines -c Machine - 
d /dev/null -s /bin/false %u
;  delete user script = /usr/sbin/userdel %u
;  delete user from group script = /usr/sbin/deluser %u %g
;  delete group script = /usr/sbin/groupdel %g

#============================ Share Definitions  
==============================
[homes]
    path = /eeqfs1/home/ciips/%H
    comment = Home Directories
    browseable = no
    writable = yes

# Un-comment the following and create the netlogon directory for  
Domain Logons
[netlogon]
    comment = Network Logon Service
    path = /usr/local/daemon/samba-ciips/lib/netlogon
    writable = yes
    browseable = no
    create mode = 444
    guest ok = no
    volume = "Network"

# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
[Profiles]
     path = /eeqfs1/home/ciips/home/profiles
     create mode = 0600
     directory mode = 0700
     writable = yes
     browsable = no
     profile acls = yes

(Relevant LDAP entries)

dn: sambaDomainName=EE- 
CIIPS2,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaRefuseMachinePwdChange:
sambaForceLogoff: -1
sambaLockoutThreshold: 0
sambaLockoutObservationWindow: 30
sambaLockoutDuration: 30
sambaMinPwdAge: 0
sambaMaxPwdAge: -1
sambaLogonToChgPwd: 0
sambaPwdHistoryLength: 0
sambaMinPwdLength: 5
sambaDomainName: EE-CIIPS2
sambaSID: S-1-5-21-2285122461-3938449209-3485319758
sambaAlgorithmicRidBase: 1000
objectClass: sambaDomain
sambaNextUserRid: 1000

dn: uid=root,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaPwdLastSet: 1150944364
sambaPwdCanChange: 1150944364
sambaKickoffTime: 2147483647
sambaAcctFlags: [U          ]
userPassword:: eXXXXXXXXXXXXXXXXXXXXXXXXXs=
displayName: Super-User
sambaPwdMustChange: 2147483647
sambaLogoffTime: 2147483647
objectClass: account
objectClass: sambaSamAccount
objectClass: top
objectClass: eeAccount
objectClass: posixAccount
uid: root
uidNumber: 0
cn: root
loginShell: /bin/sh
gidNumber: 0
gecos: Super User
homeDirectory: /
sambaSID: S-1-5-21-2285122461-3938449209-3485319758-1000
cn: Super-User
sambaNTPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
sambaLogonTime: 0
sambaPrimaryGroupSID: S-1-5-21-2285122461-3938449209-3485319758-1001
sambaLMPassword: XXXXXXXXXXXXXXXXXXXXXXXX
eeType: other

dn: uid=nobody,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaLMPassword: LOCKED
sambaPrimaryGroupSID: S-1-5-21-2285122461-3938449209-3485319758-121003
objectClass: top
objectClass: account
objectClass: eeAccount
objectClass: posixAccount
objectClass: sambaSamAccount
sambaLogonTime: 0
uid: nobody
uidNumber: 60001
cn: uid no body
sambaLogoffTime: 2147483647
loginShell: /noshell
sambaAcctFlags: [UX         ]
gidNumber: 60001
sambaPwdMustChange: 2147483647
sambaNTPassword: LOCKED
sambaPwdCanChange: 0
gecos: uid no body
sambaSID: S-1-5-21-2285122461-3938449209-3485319758-121002
homeDirectory: /
sambaKickoffTime: 2147483647
eeType: other
userPassword:: e0NXXXXXfSpMSyo=

dn: cn=nobody,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
gidNumber: 60001
objectClass: posixGroup
objectClass: top
cn: nobody
userPassword:: e0NXXXXXfSpMSyo=