[Samba] Domain admin privileges: a strange bug in Samba?

[Miguel Medalha]

  I was in the process of setting up a new Samba 3.5.4 PDC with LDAP 
backend, over CentOS 5.5, when I came across a very strange behavior.

After executing the smbladp-populate script, I was trying to grant the 
needed privileges to the group "Domain Admins" in order no to use "root" 
to manage the Windows domain. After successfully granting rights to the 
"Admin" user, there was no way to make this user benefit from them. Even 
the command "net rpc rights list", if executed by -U Admin, always 
failed with the following result:

net rpc rights list Admin -U Admin

Enter Admin's password:
(I enter "Admin's password here")
Receiving SMB: Server stopped responding
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_END_OF_FILE

This was followed by a smb core dump.

The log then presents the following:

[2010/08/24 11:27:00.143535,  0] lib/fault.c:46(fault_report)
   ===============================================================
[2010/08/24 11:27:00.143824,  0] lib/fault.c:47(fault_report)
   INTERNAL ERROR: Signal 11 in pid 19667 (3.5.4)
   Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/08/24 11:27:00.143927,  0] lib/fault.c:49(fault_report)

   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/08/24 11:27:00.144021,  0] lib/fault.c:50(fault_report)
   ===============================================================
[2010/08/24 11:27:00.144100,  0] lib/util.c:1465(smb_panic)
   PANIC (pid 19667): internal error
[2010/08/24 11:27:00.151658,  0] lib/util.c:1569(log_stack_trace)
   BACKTRACE: 26 stack frames:
    #0 smbd(log_stack_trace+0x1a) [0x2ae9fd7622c5]
    #1 smbd(smb_panic+0x55) [0x2ae9fd7623c9]
    #2 smbd [0x2ae9fd753101]
    #3 /lib64/libc.so.6 [0x2aea005cf2d0]
    #4 smbd(sid_compare+0x22) [0x2ae9fd75db54]
    #5 smbd(add_sid_to_array_unique+0x39) [0x2ae9fd75e189]
    #6 smbd(create_token_from_username+0xd37) [0x2ae9fd7b1eeb]
    #7 smbd(create_local_token+0x4e) [0x2ae9fd7b231e]
    #8 smbd [0x2ae9fd7b550d]
    #9 smbd [0x2ae9fd5b8097]
    #10 smbd(ntlmssp_update+0x270) [0x2ae9fd5b7c86]
    #11 smbd(auth_ntlmssp_update+0x17) [0x2ae9fd7b5215]
    #12 smbd [0x2ae9fd52be5e]
    #13 smbd(reply_sesssetup_and_X+0x191) [0x2ae9fd52c18f]
    #14 smbd [0x2ae9fd560eb1]
    #15 smbd [0x2ae9fd563b4e]
    #16 smbd [0x2ae9fd564341]
    #17 smbd(run_events+0x1d6) [0x2ae9fd7711f8]
    #18 smbd(smbd_process+0x97c) [0x2ae9fd56337d]
    #19 smbd [0x2ae9fda6f4ca]
    #20 smbd(run_events+0x1d6) [0x2ae9fd7711f8]
    #21 smbd [0x2ae9fd771467]
    #22 smbd(_tevent_loop_once+0x84) [0x2ae9fd7717e9]
    #23 smbd(main+0xf83) [0x2ae9fda6f1ff]
    #24 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2aea005bc994]
    #25 smbd [0x2ae9fd4ea5a9]
[2010/08/24 11:27:00.159996,  0] lib/fault.c:326(dump_core)
   dumping core in /var/log/samba/cores/smbd


Only "root" could obtain a successful answer, even if I gave "Admin" the 
same password that "root" has.

After many efforts I was stuck. I even downgraded to Samba 3.4.8 with 
the same result.

I then raised the log level to 2.

Suddenly, the results came:

SeMachineAccountPrivilege
SeTakeOwnershipPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege

I consulted the Samba logs and noticed the following:

[2010/08/24 11:00:23.397276,  2] auth/auth.c:304(check_ntlm_password)
   check_ntlm_password:  authentication for user [Admin] -> [root] -> 
[root] succeeded
[2010/08/24 11:00:23.397973,  2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
   init_sam_from_ldap: Entry found for user: root

So, user Admin was being mapped to root, and this only worked if Admin 
had the same password as "root", as expected.

Since "username map = /etc/samba/smbusers" is the Samba default, I 
commented all the lines in /etc/samba/smbusers.

Now, the correct behavior was restored.

What is most strange here is that *the success of the connection depends 
on the log level being 2 or higher*. Everything less causes the 
connection to fail with the result:

Receiving SMB: Server stopped responding
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_END_OF_FILE


With all the lines commented out in /etc/samba/smbusers, privileges work 
as expected.

Thank you.