[Samba] Samba winbindd crash

Wed Jan 31 16:46:51 GMT 2007

Hello dear list!

I'm about to setup a winbind to authenticate my proxy users through Active
Directory.

Unfortunately the daemon winbindd crash while requesting some wbinfo,

Here is a transcript of the problem:

IDCSRV922:~ # cat /etc/krb5.conf

[libdefaults]

        default_realm = MY.DOMAIN.COM

[realms]

[logging]

    kdc = FILE:/var/log/krb5/krb5kdc.log

    admin_server = FILE:/var/log/krb5/kadmind.log

    default = SYSLOG:NOTICE:DAEMON

IDCSRV922:~ # 

IDCSRV922:/var/log # kinit tlabgouverneur at EU.INFLAB.COM

Password for tlabgouverneur at EU.INFLAB.COM: 

IDCSRV922:/var/log # kdestroy

IDCSRV922:/var/log # cat /etc/samba/smb.conf

# smb.conf is the main Samba configuration file. You find a full commented

# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the

# samba-doc package is installed.

# Date: 2006-06-16

[global]

        realm = EU.INFLAB.COM

        workgroup = EU

        socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384

        netbios name = IDCSRV922

        password server = eu.inflab.com

        winbind use default domain = yes

        winbind enum users = yes

        winbind enum groups = yes

        winbind separator = +

        encrypt passwords = yes

        log level = 3 passdb:5 auth:10 winbind:5

        winbind uid = 10000-20000

        winbind gid = 10000-20000

        os level = 20

        server string = IDCSRV922

        password server = *

        prefered master = no

        load printers = no

        acl compatibility = auto

        nt acl support = yes

        inherit acls = yes

        client schannel = no

        idmap uid = 10000-20000

        idmap gid = 10000-20000

        security = ADS

        map to guest = Bad User

IDCSRV922:~ # rcsmb start

Starting Samba SMB daemon - Warning: /var/run/samba/smbd.pid exists.  done

IDCSRV922:~ # rcnmb start

Starting Samba NMB daemon                                             done

IDCSRV922:~ # rcwinbind start

Starting Samba WINBIND daemon                                         done

IDCSRV922:~ # wbinfo -t

checking the trust secret via RPC calls succeeded

IDCSRV922:~ # wbinfo -a EU+tlabgouverneur%testpassword

plaintext password authentication succeeded

challenge/response password authentication succeeded

IDCSRV922:~ # wbinfo -m

INFLAB

EU

NA

RES

IDCSRV922:~ # wbinfo -g

Error looking up domain groups

IDCSRV922:~ # ps aux|grep winbind

IDCSRV922:~ # 

>From here, winbind has crashed and here is what I could find in the logs of
winbind:

============================================================================
=====

[2007/01/31 17:15:03, 3] nsswitch/winbindd_group.c:winbindd_list_groups(810)

  [    0]: list groups

[2007/01/31 17:15:03, 4]
passdb/secrets.c:secrets_fetch_trust_account_password(282)

  Using cleartext machine password

[2007/01/31 17:15:03, 3] lib/util.c:fcntl_lock(1831)

  fcntl_lock: fcntl lock gave errno 11 (Resource temporarily unavailable)

[2007/01/31 17:15:03, 3] lib/util.c:fcntl_lock(1850)

  fcntl_lock: lock failed at offset 0 count 1 op 13 type 0 (Resource
temporarily unavailable)

[2007/01/31 17:15:03, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC23F8640A

[2007/01/31 17:15:03, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(91)

  cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb
[EU\tlabgouverneur]

[2007/01/31 17:15:03, 5] nsswitch/winbindd_cm.c:cm_prepare_connection(272)

  connecting to IDCSRV914 from IDCSRV922 with kerberos principal
[IDCSRV922$@EU.INFLAB.COM]

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(710)

  Doing spnego session setup (blob length=112)

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 48018 1 2 2

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 113554 1 2 2

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 113554 1 2 2 3

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 3 6 1 4 1 311 2 2 10

[2007/01/31 17:15:03, 3] libsmb/cliconnect.c:cli_session_setup_spnego(744)

  got principal=idcsrv914$@EU.INFLAB.COM

[2007/01/31 17:15:03, 2] libsmb/cliconnect.c:cli_session_setup_kerberos(533)

  Doing kerberos session setup

[2007/01/31 17:15:03, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(416)

  ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration
Thu, 01 Feb 2007 03:15:01 CET

[2007/01/31 17:15:03, 4]
passdb/secrets.c:secrets_fetch_trust_account_password(282)

  Using cleartext machine password

[2007/01/31 17:15:03, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081)

  rpc_pipe_bind: Remote machine IDCSRV914 pipe \NETLOGON fnum 0xc007 bind
request returned ok.

[2007/01/31 17:15:03, 3] lib/util.c:fcntl_lock(1831)

  fcntl_lock: fcntl lock gave errno 11 (Resource temporarily unavailable)

[2007/01/31 17:15:03, 3] lib/util.c:fcntl_lock(1850)

  fcntl_lock: lock failed at offset 0 count 1 op 13 type 0 (Resource
temporarily unavailable)

[2007/01/31 17:15:03, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC25F8640A

[2007/01/31 17:15:04, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC25F8640A

[2007/01/31 17:15:04, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC25F8640A

[2007/01/31 17:15:05, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC25F8640A

[2007/01/31 17:15:05, 5] nsswitch/winbindd_cm.c:receive_getdc_response(526)

  Received packet for \MAILSLOT\NET\GETDC25F8640A

[2007/01/31 17:15:06, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(91)

  cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb
[EU\tlabgouverneur]

[2007/01/31 17:15:06, 5] nsswitch/winbindd_cm.c:cm_prepare_connection(272)

  connecting to IDCSRV916 from IDCSRV922 with kerberos principal
[IDCSRV922$@EU.INFLAB.COM]

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(710)

  Doing spnego session setup (blob length=113)

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 48018 1 2 2

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 113554 1 2 2

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 2 840 113554 1 2 2 3

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(735)

  got OID=1 3 6 1 4 1 311 2 2 10

[2007/01/31 17:15:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(744)

  got principal=idcsrv916$@RES.INFLAB.COM

[2007/01/31 17:15:06, 2] libsmb/cliconnect.c:cli_session_setup_kerberos(533)

  Doing kerberos session setup

[2007/01/31 17:15:06, 0] lib/fault.c:fault_report(36)

  ===============================================================

[2007/01/31 17:15:06, 0] lib/fault.c:fault_report(37)

  INTERNAL ERROR: Signal 11 in pid 18293 (3.0.22-13.16-SUSE-SLES10)

  Please read the Trouble-Shooting section of the Samba3-HOWTO

[2007/01/31 17:15:06, 0] lib/fault.c:fault_report(39)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf

[2007/01/31 17:15:06, 0] lib/fault.c:fault_report(40)

  ===============================================================

[2007/01/31 17:15:06, 0] lib/util.c:smb_panic2(1554)

  PANIC: internal error

[2007/01/31 17:15:06, 0] lib/util.c:smb_panic2(1562)

  BACKTRACE: 22 stack frames:

   #0 /usr/sbin/winbindd(smb_panic2+0x8a) [0x800b79ea]

   #1 /usr/sbin/winbindd(smb_panic+0x19) [0x800b7c49]

   #2 /usr/sbin/winbindd [0x800a1fa2]

   #3 [0xffffe420]

   #4 /usr/lib/libkrb5.so.3(krb5_free_principal+0x63) [0xb7ed0e33]

   #5 /usr/lib/libkrb5.so.3(krb5_free_cred_contents+0x2d) [0xb7ed215d]

   #6 /usr/lib/libkrb5.so.3(krb5_free_creds+0x29) [0xb7ed2249]

   #7 /usr/lib/libkrb5.so.3(krb5_free_tgt_creds+0x2e) [0xb7ed228e]

   #8 /usr/lib/libkrb5.so.3(krb5_get_credentials+0x1dc) [0xb7eccc9c]

   #9 /usr/sbin/winbindd(cli_krb5_get_ticket+0x4b9) [0x800df4a9]

   #10 /usr/sbin/winbindd(spnego_gen_negTokenTarg+0x62) [0x800e09b2]

   #11 /usr/sbin/winbindd(cli_session_setup_spnego+0x6a6) [0x800d85f6]

   #12 /usr/sbin/winbindd [0x8004eb98]

   #13 /usr/sbin/winbindd(set_dc_type_and_flags+0x81) [0x8004ff51]

   #14 /usr/sbin/winbindd(find_domain_from_name+0x48) [0x8003c038]

   #15 /usr/sbin/winbindd [0x80037293]

   #16 /usr/sbin/winbindd(winbindd_list_groups+0x10e) [0x8003790e]

   #17 /usr/sbin/winbindd [0x80032777]

   #18 /usr/sbin/winbindd [0x80033f08]

   #19 /usr/sbin/winbindd(main+0x830) [0x80033210]

   #20 /lib/libc.so.6(__libc_start_main+0xdc) [0xb7d1587c]

   #21 /usr/sbin/winbindd [0x80031991]

============================================================================
=====

IDCSRV922:/var/log/samba # winbindd -V

Version 3.0.22-13.16-SUSE-SLES10

As you may see, the Kerberos alone is working well alone (kinit/kdestroy),
but mixed with somewhat seems to

be a "bigger" request made by winbind, it just stop to get answer and just
crash?!

I know that Kerberos use UDP for little request and then switch to TCP when
he needs bigger

Answer. But I couldn't find how to restrict TCP only on client side. (Not on
KDC.)

Anyway, the switch between UDP and TCP should IIRC be automatic and do not
need any human intervention,

Although, the TCP port of the Kerberos server (Active Directory DC.) seems
to be working well.

Please take into account that I've tried either with 3.0.22-13 version of
samba

which is included in my distro, but also from latest stable source archive
from samba.org.

The Kerberos flavour is MIT.

Any help would be widely appreciated,

Please do not hesitate to ask for more details, as this is my first post, I
do not really

Know what to provide.

TIA,

--

Thomas Gouverneur

UNIX Assistant

TI Automotive

The information contained in this transmission may contain privileged and confidential information.  It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.