[Samba] SambaSID

Sandra sandra-nascimento at prodesan.com.br
Thu Jun 14 13:22:10 GMT 2007


I have a samba server configured that is member of a samba domain called 
PRODESAN.COM.BR. After we had to reinstall the domain controller some samba 
shares stopped working on the member server. I get this when I try to use 
the share: 

[2007/05/29 17:26:28, 3] auth/auth.c:check_ntlm_password(219) 
  check_ntlm_password:  Checking password for unmapped user 
[WORKGROUP]\[USER1]@[HOST6] with the new password interface 
[2007/05/29 17:26:28, 3] auth/auth.c:check_ntlm_password(222) 
  check_ntlm_password:  mapped user is: [PRODESAN.COM.BR]\[USER1]@[HOST6] 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:push_sec_ctx(256) 
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 
[2007/05/29 17:26:28, 3] smbd/uid.c:push_conn_ctx(365) 
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:set_sec_ctx(288) 
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:pop_sec_ctx(386) 
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:push_sec_ctx(256) 
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 
[2007/05/29 17:26:28, 3] smbd/uid.c:push_conn_ctx(365) 
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:set_sec_ctx(288) 
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 
[2007/05/29 17:26:28, 3] smbd/sec_ctx.c:pop_sec_ctx(386) 
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 
[2007/05/29 17:26:28, 2] auth/auth.c:check_ntlm_password(312) 
  check_ntlm_password:  Authentication for user [USER1] -> [USER1] FAILED 
with error NT_STATUS_NO_SUCH_USER 

However when I try to use the same user on the domain controller things work 
perfectly: 

[2007/05/29 17:32:39, 2] lib/smbldap.c:smbldap_open_connection(788) 
  smbldap_open_connection: connection opened 
[2007/05/29 17:32:39, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) 
  init_sam_from_ldap: Entry found for user: pr907899 
[2007/05/29 17:32:39, 2] passdb/pdb_ldap.c:init_group_from_ldap(2140) 
  init_group_from_ldap: Entry found for group: 513 
[2007/05/29 17:32:39, 2] auth/auth.c:check_ntlm_password(309) 
  check_ntlm_password:  authentication for user [USER1] -> [USER1] -> 
[pr907899] succeeded 

I can see the domain users using wbinfo -u on the member server and
we have kept the domain SID setting from the original Samba PDC (using net 
rpc getsid at the old server) and we still can't authenticate the users. 

We have tried to delete the old machine account from our server in order to 
try to rejoin it, but now we can't. Here is what happens at the server: 

# net join -U root 
root's password: 
[2007/05/30 14:58:44, 0] utils/net_ads.c:ads_startup(191) 
  ads_connect: No results returned 
Creation of workstation account failed 
Unable to join domain PRODESAN.COM.BR. 

And here are the logs for that machine on the PDC: 

[2007/05/30 14:58:55, 2] lib/smbldap.c:smbldap_open_connection(788) 
  smbldap_open_connection: connection opened 
[2007/05/30 14:58:55, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) 
  init_sam_from_ldap: Entry found for user: root 
[2007/05/30 14:58:55, 2] passdb/pdb_ldap.c:init_group_from_ldap(2140) 
  init_group_from_ldap: Entry found for group: 513 
[2007/05/30 14:58:55, 2] auth/auth.c:check_ntlm_password(309) 
  check_ntlm_password:  authentication for user [root] -> [root] -> [root] 
succeeded 
[2007/05/30 14:58:55, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) 
  init_sam_from_ldap: Entry found for user: root 
[2007/05/30 14:58:55, 2] smbd/reply.c:reply_tcon_and_X(711) 
  Serving IPC$ as a Dfs root 

There doesn't seem to be any visible errors, so I went to check the LDAP 
logs and I only thought this looked a bit strange: 

May 30 15:02:42 servsso slapd[22129]: conn=79 op=6 SRCH 
base="ou=grupos,dc=prodesan,dc=com,dc=br" scope=2 deref=0 filter="(&(| 
(objectClass=sambaGroupMapping)(sambaGroupType=4))(| 
(sambaSIDList=s-1-5-21-3756370324-611414431-635963119-501) 
(sambaSIDList=s-1-1-0)(sambaSIDList=s-1-5-2)(sambaSIDList=s-1-5-32-546)))" 
May 30 15:02:42 servsso slapd[22129]: conn=79 op=6 SRCH attr=sambaSID 
May 30 15:02:42 servsso slapd[22129]: <= bdb_equality_candidates: 
(sambaGroupType) index_param failed (18) 
May 30 15:02:42 servsso slapd[22129]: <= bdb_equality_candidates: 
(sambaSIDList) index_param failed (18) 
May 30 15:02:42 servsso last message repeated 3 times 
May 30 15:02:42 servsso slapd[22129]: conn=79 op=6 SEARCH RESULT tag=101 
err=0 
nentries=0 text= 
May 30 15:02:42 servsso slapd[22129]: conn=79 op=7 SRCH 
base="ou=grupos,dc=prodesan,dc=com,dc=br" scope=2 deref=0 filter="(&(| 
(objectClass=sambaGroupMapping)(sambaGroupType=4))(| 
(sambaSIDList=s-1-5-21-3756370324-611414431-635963119-501) 
(sambaSIDList=s-1-1-0)(sambaSIDList=s-1-5-2)(sambaSIDList=s-1-5-32-546)))" 
May 30 15:02:42 servsso slapd[22129]: conn=79 op=7 SRCH attr=sambaSID 
May 30 15:02:42 servsso slapd[22129]: <= bdb_equality_candidates: 
(sambaGroupType) index_param failed (18) 
May 30 15:02:42 servsso slapd[22129]: <= bdb_equality_candidates: 
(sambaSIDList) index_param failed (18) 
May 30 15:02:42 servsso last message repeated 3 times 

When I check the LDAP I can see that the 
entry "uid=servproducao$,ou=computadores,dc=prodesan,dc=com,dc=br" was 
created but it doesn't have the sambaSamAccount objectclass attribute, and 
therefore no samba attributes set. 

Simply importing the old account from the old PDC doesn't seem to work, as I 
get some access denied when the server tries to connect to LDAP. 
============================================================= 

Just adding some more information: 

I am currently unable to join any new machines to the domain. Whenever I try 
to join the domain I get this message on the clients: 

$ sudo net join -U root 
Password: 
Creation of workstation account failed 
Unable to join domain PRODESAN.COM.BR. 

On the PDC side I get this: 

[2007/05/30 17:11:15, 2] lib/smbldap.c:smbldap_open_connection(788) 
  smbldap_open_connection: connection opened 
[2007/05/30 17:11:15, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) 
  init_sam_from_ldap: Entry found for user: root 
[2007/05/30 17:11:15, 2] passdb/pdb_ldap.c:init_group_from_ldap(2140) 
  init_group_from_ldap: Entry found for group: 513 
[2007/05/30 17:11:15, 2] auth/auth.c:check_ntlm_password(309) 
  check_ntlm_password:  authentication for user [root] -> [root] -> [root] 
succeeded 
[2007/05/30 17:11:15, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) 
  init_sam_from_ldap: Entry found for user: root 
[2007/05/30 17:11:15, 2] smbd/reply.c:reply_tcon_and_X(711) 
  Serving IPC$ as a Dfs root 

On my LDAP backend I have this entry: 

dn: sambaDomainName=PRODESAN.COM.BR,dc=prodesan,dc=com,dc=br 
sambaAlgorithmicRidBase: 1000 
sambaNextUserRid: 41000 
sambaNextGroupRid: 41001 
objectClass: sambaDomain 
objectClass: sambaUnixIdPool 
sambaSID: S-1-5-21-3756370324-611414431-635963119 
sambaDomainName: prodesan.com.br 
gidNumber: 1055 
uidNumber: 1454 

The sambaSID is the same that was before the migration. Do I need to set 
this 
SID somewhere else? 




-- 
Esta mensagem foi verificada pelo sistema de antivírus e
 acredita-se estar livre de perigo.



More information about the samba mailing list