[Samba] Corrupted ntprinters.tdb

[Frank Melger]

Hi,



we are experiencing periodic problems with our samba/cups setup:



It seems like workstations which are locked but where users with the
SePrintOperatorPrivilege are logged on destroy the ntprinters.tdb.

This always takes place when the logrotate on the sambaserver runs the
postrotatescript and restarts cups while the client is doing whatever it
has to do.



/var/log/messages says:



> tail -n 5000 /var/log/messages.1 | grep -i cups
>
> Mar  1 04:06:09 XSVA001 cups: cupsd shutdown succeeded
>
> Mar  1 04:06:11 XSVA001 smbd[21965]: [2009/03/01 04:06:11, 0]
printing/print_cups.c:cups_connect(69)
>
> Mar  1 04:06:11 XSVA001 smbd[21965]:   Unable to connect to CUPS
server localhost:631 - Connection refused
>
> Mar  1 04:06:11 XSVA001 smbd[21965]: [2009/03/01 04:06:11, 0]
printing/print_cups.c:cups_connect(69)
>
> Mar  1 04:06:11 XSVA001 smbd[21965]:   Unable to connect to CUPS
server localhost:631 - Connection refused
>
> Mar  1 04:06:11 XSVA001 smbd[21965]: [2009/03/01 04:06:11, 0]
printing/print_cups.c:cups_connect(69)
>
> Mar  1 04:06:11 XSVA001 smbd[21965]:   Unable to connect to CUPS
server localhost:631 - Connection refused
>
> Mar  1 04:06:11 XSVA001 smbd[21965]: [2009/03/01 04:06:11, 0]
printing/print_cups.c:cups_connect(69)
>
> Mar  1 04:06:11 XSVA001 smbd[21965]:   Unable to connect to CUPS
server localhost:631 - Connection refused
>
> Mar  1 04:06:11 XSVA001 smbd[21965]: [2009/03/01 04:06:11, 0]
printing/print_cups.c:cups_connect(69)
>
> Mar  1 04:06:11 XSVA001 smbd[21965]:   Unable to connect to CUPS
server localhost:631 - Connection refused
>
> Mar  1 04:06:15 XSVA001 cups: cupsd startup succeeded





Because I activated client specific logging I was able to determine the
host which made that connection:




> grep -B1 'Unable to connect to CUPS server localhost:631'
/var/log/samba/suspicious_client.log
>
> 	[2009/03/01 04:06:11, 0] printing/print_cups.c:cups_connect(69)
>
> 	  Unable to connect to CUPS server localhost:631 - Connection refused
>
> 	[2009/03/01 04:06:11, 0] printing/print_cups.c:cups_connect(69)
>
> 	  Unable to connect to CUPS server localhost:631 - Connection refused
>
> 	[2009/03/01 04:06:11, 0] printing/print_cups.c:cups_connect(69)
>
> 	  Unable to connect to CUPS server localhost:631 - Connection refused
>
> 	[2009/03/01 04:06:11, 0] printing/print_cups.c:cups_connect(69)
>
> 	  Unable to connect to CUPS server localhost:631 - Connection refused
>
> 	[2009/03/01 04:06:11, 0] printing/print_cups.c:cups_connect(69)
>
> 	  Unable to connect to CUPS server localhost:631 - Connection refused




Additionally I'm running a script which diffs the ntprinters.tdb every 5
minutes against the version seen in the previous run and, in case it has
changed, copys the ntprinters.tdb to a backup directory keeping the
timestamp.

This timestamp perfectly matches the time seen in /var/log/messages:



> ls --full-time ntprinters.tdb.2009.03.01_04:10:01
>
> -rw-------  1 root root 573440 2009-03-01 04:06:11.000000000 +0100
ntprinters.tdb.2009.03.01_04:10:01
>
>

Due to these facts my suspicion is the following:



Cups is stopped and restarted while the client is triggering changes to
the ntprinters.tdb.

The active connection is then broken and this results in a corrupted
ntprinters.tdb.



Unfortunately it's not an option to shutdown/log off the client(s).



Is anybody experiencing the same behaviour?

Is anybody able to explain to me why and under which circumstances
Windows tries to make those changes?

Any other ideas?





Cheers,



- Frank -