[Samba] Winbind core dump issue

[Paul Digby]

Greetings

We've moved from using NIS/SFU to using Samba/Winbind connecting to our
Windows 2003 AD domain with an Openldap idmap backend on our Redhat 4/5
servers. We managed to get this mostly working in that users can
authenticate using their domain accounts (thank you Samba team!!!). We do
however keep getting the same error in the log.winbindd-idmap log:

winbindd: ../../../libraries/libldap/getentry.c:48: ldap_next_entry:
Assertion `entry != ((void *)0)' failed.
[2009/08/11 12:00:12,  0] lib/fault.c:fault_report(40)
  ===============================================================
[2009/08/11 12:00:12,  0] lib/fault.c:fault_report(41)
  INTERNAL ERROR: Signal 6 in pid 25614 (3.2.13)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2009/08/11 12:00:12,  0] lib/fault.c:fault_report(43)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2009/08/11 12:00:12,  0] lib/fault.c:fault_report(44)
  ===============================================================
[2009/08/11 12:00:12,  0] lib/util.c:smb_panic(1670)
  PANIC (pid 25614): internal error
[2009/08/11 12:00:12,  0] lib/util.c:log_stack_trace(1774)
  BACKTRACE: 28 stack frames:
   #0 winbindd(log_stack_trace+0x2d) [0x891b0c]
   #1 winbindd(smb_panic+0x8e) [0x89195e]
   #2 winbindd [0x87b660]
   #3 winbindd [0x87b671]
   #4 /lib/tls/libc.so.6 [0x377918]
   #5 /lib/tls/libc.so.6(abort+0xe9) [0x379289]
   #6 /lib/tls/libc.so.6(__assert_fail+0x101) [0x370da1]
   #7 /usr/lib/libldap-2.2.so.7(ldap_next_entry+0x6b) [0x227c3b]
   #8 /usr/lib/samba/idmap/ldap.so [0x2a36e3]
   #9 winbindd [0xb2cec0]
   #10 winbindd(idmap_unixids_to_sids+0x41a) [0xb2dbd3]
   #11 winbindd(idmap_uid_to_sid+0xb9) [0xb30059]
   #12 winbindd(winbindd_dual_uid2sid+0xb0) [0x8031c6]
   #13 winbindd [0x7f842f]
   #14 winbindd [0x7faacf]
   #15 winbindd [0x7f7ff7]
   #16 winbindd(async_request+0x20f) [0x7f79c1]
   #17 winbindd(do_async+0x13c) [0x7fad81]
   #18 winbindd(winbindd_uid2sid_async+0x77) [0x80310c]
   #19 winbindd(winbindd_getpwuid+0xb1) [0x7c9a91]
   #20 winbindd [0x7c60d9]
   #21 winbindd [0x7c6c89]
   #22 winbindd [0x7c6ad4]
   #23 winbindd [0x7c6407]
   #24 winbindd [0x7c7383]
   #25 winbindd(main+0xc7e) [0x7c82e2]
   #26 /lib/tls/libc.so.6(__libc_start_main+0xd3) [0x364df3]
   #27 winbindd [0x7c56b1]
[2009/08/11 12:00:12,  0] lib/fault.c:dump_core(201)
  dumping core in /var/log/samba/cores/winbindd

Winbind seems to continue running but users get ID errors like 'cannot find
name for user ID #' and the machine is basically unusable for a minute or so
before it goes away. With the error referring to ldap, I'm not sure if this
is a problem with our ldap database or if it's a problem with winbind.
Initially we just used the latest versions of samba (Version
3.0.9-1.3E.13.2) from the RedHat repos but we found we were having problems
with trusted domains that we didn't have access to nor wanted to
authenticate with. We tried the 'allow trusted domains = no' and 'winbind:
ignore domains = trustdom1 trustdom2' options in smb.conf but I think these
options were not supported in this version. We then installed the 3.2.12
rpms from ftp.sernet.de which fixed that issue and got us to this stage.

Here is some information about our setup:

smbd & winbindd: Version 3.2.13

smb.conf:
[global]
        workgroup = domain
        realm = krb realm
        server string = %h Samba Server Version %v
        security = ADS
        password server = server1 server2
        local master = no
        domain master = no
        winbind cache time = 7200
        max log size = 50
        ldap admin dn = cn=manager,dc=example,dc=test,dc=com
        ldap idmap suffix = ou=idmap
        ldap suffix = dc=example,dc=test,dc=com
        idmap backend = ldap:ldap://10.0.1.16
        idmap uid = 500-10000
        idmap gid = 100-1000
        template homedir = /home/domain/%U
        template shell = /bin/bash
        winbind separator = +
        winbind use default domain = Yes
        winbind enum users = yes
        winbind enum groups = yes
        allow trusted domains = no
#        winbind nested groups = yes
        winbind: ignore domains = trustdom1 trustdom2
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        cups options = raw

nsswitch.conf:
passwd:     files winbind
shadow:     files
group:      files winbind

/etc/pam.d/system-auth:
auth       sufficient   pam_env.so
auth       sufficient   pam_unix.so
auth       sufficient   pam_winbind.so try_first_pass

account    sufficient   pam_unix.so
account    sufficient   pam_winbind.so

session    sufficient   pam_unix.so
session    sufficient   pam_winbind.so

password   sufficient   pam_unix.so
password   sufficient   pam_winbind.so try_first_pass

I really have no idea where to even start with this error so would really
appreciate any help you can give.

regards

Paul