[Samba] winbindd GETGRENT results in trusted domains environment

[Sergey Tashkinov]

 Good day.
   1. We have configured two domain controllers on Windows 2003 R2. We
   named them TEST.LOCAL and CHILD.TEST.LOCAL respectively and made a
   trust relationships between them. 2. We have installed Samba 3.5.3 on
   Ubuntu 9.10, kernel 2.6.31-14 and configured it for using winbindd.
     We have encountered a problem with results that winbind returns
     upon a command GETGRENT. We have obtained those results with the
     command "getent group".
   In a case if both domain controllers are turned on everything works
   well and we can get groups of users from both domains, for example:
   root at ubuntu:/home/user# getent group root:x:0: daemon:x:1: bin:x:2:
   sys:x:3: adm:x:4:user tty:x:5: disk:x:6: lp:x:7: mail:x:8: news:x:9:
   uucp:x:10: man:x:12: proxy:x:13: kmem:x:15: dialout:x:20:user
   fax:x:21: voice:x:22: cdrom:x:24:user floppy:x:25: tape:x:26:
   sudo:x:27: audio:x:29:pulse dip:x:30: www-data:x:33: backup:x:34:
   operator:x:37: list:x:38: irc:x:39: src:x:40: gnats:x:41: shadow:x:42:
   utmp:x:43: video:x:44: sasl:x:45: plugdev:x:46:user staff:x:50:
   games:x:60: users:x:100: nogroup:x:65534: libuuid:x:101: syslog:x:102:
   fuse:x:103: lpadmin:x:104:user ssl-cert:x:105: messagebus:x:106:
   crontab:x:107: mlocate:x:108: ssh:x:109: avahi-autoipd:x:110:
   avahi:x:111: netdev:x:112: couchdb:x:113: haldaemon:x:114:
   admin:x:115:user saned:x:116: pulse:x:117: pulse-access:x:118:
   gdm:x:119: user:x:1000: sambashare:x:120:user winbindd_priv:x:121:
   TEST\helpservicesgroup:x:100003:TEST\support_388945a0
   TEST\telnetclients:x:100004: TEST\domain computers:x:100005:
   TEST\domain controllers:x:100006: TEST\schema
   admins:x:100007:TEST\administrator TEST\enterprise
   admins:x:100008:TEST\administrator TEST\cert publishers:x:100009:
   TEST\domain admins:x:100010:TEST\administrator TEST\domain
   users:x:100011: TEST\domain guests:x:100012: TEST\group policy creator
   owners:x:100013:TEST\administrator TEST\ras and ias servers:x:100014:
   TEST\dnsadmins:x:100015: TEST\dnsupdateproxy:x:100016:
   TEST\group1:x:100017: TEST\group2:x:100018: TEST\group3:x:100019:
   TEST\group4:x:100020: TEST\group5:x:100021: TEST\group6:x:100022:
   TEST\group7:x:100023: TEST\group8:x:100024: TEST\group9:x:100025:
   TEST\group10:x:100026: TEST\group11:x:100027: CHILD\domain
   computers:x:100030: CHILD\domain controllers:x:100031: CHILD\domain
   admins:x:100032:CHILD\administrator CHILD\domain users:x:100033:
   CHILD\domain guests:x:100034: CHILD\group policy creator
   owners:x:100035:CHILD\administrator
   If we turn off the domain CHILD.TEST.LOCAL then "getent group" doesn't
   return any groups from neither domains, even from TEST.LOCAL.
   root at ubuntu:/home/user# getent group root:x:0: daemon:x:1: bin:x:2:
   sys:x:3: adm:x:4:user tty:x:5: disk:x:6: lp:x:7: mail:x:8: news:x:9:
   uucp:x:10: man:x:12: proxy:x:13: kmem:x:15: dialout:x:20:user
   fax:x:21: voice:x:22: cdrom:x:24:user floppy:x:25: tape:x:26:
   sudo:x:27: audio:x:29:pulse dip:x:30: www-data:x:33: backup:x:34:
   operator:x:37: list:x:38: irc:x:39: src:x:40: gnats:x:41: shadow:x:42:
   utmp:x:43: video:x:44: sasl:x:45: plugdev:x:46:user staff:x:50:
   games:x:60: users:x:100: nogroup:x:65534: libuuid:x:101: syslog:x:102:
   fuse:x:103: lpadmin:x:104:user ssl-cert:x:105: messagebus:x:106:
   crontab:x:107: mlocate:x:108: ssh:x:109: avahi-autoipd:x:110:
   avahi:x:111: netdev:x:112: couchdb:x:113: haldaemon:x:114:
   admin:x:115:user saned:x:116: pulse:x:117: pulse-access:x:118:
   gdm:x:119: user:x:1000: sambashare:x:120:user winbindd_priv:x:121:
   But Samba 3.2.15 returned groups from TEST domain in both cases.
   The configuration files we used in a test environment for Samba,
   Nsswitch and PAM are listed below.
   #/etc/smb.conf [global] security = ads encrypt passwords = yes
   password server = ws2003.test.local workgroup = test realm =
   CHILD.LOCAL netbios name = ubuntu allow trusted domains = yes
   passwd program = /usr/bin/passwd %u passwd chat =
   *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n
   .
   winbind separator = + winbind uid = 100000-2000000 winbind gid =
   100000-2000000 winbind enum users = yes winbind enum groups = yes
   template homedir = /home/winnt/%D/%U template shell = /bin/bash
   server string = %h server log file = /var/log/samba/log.%m max log
   size = 1000 syslog = 0
   debug level = 11
   [public] comment = Public path=/home/public browsable=yes writable=yes
   admin users=user
   # /etc/nsswitch.conf passwd: files winbind group:  files winbind
   shadow: compat
   hosts:  files mdns4_minimal [NOTFOUND=return] dns mdns4 networks:
   files
   protocols:  db files services: db files ethers: db files rpc:  db
   files
   netgroup: nis
   # /etc/pam.d/samba auth sufficient pam_winbind.so account sufficient
    pam_winbind.so session sufficient pam_winbind.so
   @include common-auth @include common-account @include common-session

   It is important for us to get group list namely with the command
   "getent group", without using "wbinfo -g".
   We have analized the source code of winbindd daemon and revealed that
   the problem was in a value that function
   "rpccli_wbint_QueryGroupList_recv" returns. If one of domains is
   turned off it returns NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND. We have
   prepared the patch that overcomes the problem by just ignoring that
   code.
   Could you comment the way we fixed the problem? Will not it cause any
   problems to winbindd?
   Best regards, Sergey Tashkinov.