[Samba] Windows machine has to join two times
toonverdonck at dommel.be
toonverdonck at dommel.be
Tue Mar 9 00:57:24 MST 2010
Hi,
I'm running a debian lenny machine with samba (3.5.0) and OpenLDAP installed
(2.4.11). When i add a machine to the domain, windows reports the following
error: "The specified computer account could not be found". The computer
account is added to the LDAP database but without the samba attributes. The
weird thing is that if i try it a second the, the samba attributes are added to
the computer account and the machine successfully joins the domain. This
happens with XP, Vista and Windows 7 cliënts. I have no idea why it doesn't
work the first time.
On the internet and in this mailing list i found other people where the samba
attributes aren't added but i didn't find anyone where it does work on a second
attempt.
Log after the first try (fail):
[2010/03/08 11:35:35.135255, 2] smbd/sesssetup.c:1390(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2010/03/08 11:35:35.158356, 2] smbd/sesssetup.c:1390(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2010/03/08 11:35:35.159037, 2] lib/smbldap.c:950(smbldap_open_connection)
smbldap_open_connection: connection opened
[2010/03/08 11:35:35.184862, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: root
[2010/03/08 11:35:35.242603, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 513
[2010/03/08 11:35:35.246777, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 512
[2010/03/08 11:35:35.246893, 2] auth/auth.c:304(check_ntlm_password)
check_ntlm_password: authentication for user [root] -> [root] -> [root]
succeeded
[2010/03/08 11:35:35.353990, 2] auth/auth.c:314(check_ntlm_password)
check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with
error NT_STATUS_NO_SUCH_USER
[2010/03/08 11:35:35.503246, 0]
rpc_server/srv_netlog_nt.c:669(_netr_ServerAuthenticate3)
_netr_ServerAuthenticate3: no challenge sent to client QSDF-PC
[2010/03/08 11:35:35.664174, 2] auth/auth.c:314(check_ntlm_password)
check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with
error NT_STATUS_NO_SUCH_USER
[2010/03/08 11:35:35.811769, 2]
rpc_server/srv_samr_nt.c:4115(_samr_LookupDomain)
Returning domain sid for domain SAMBADOM ->
S-1-5-21-2536920342-1981552595-828935944
Log after the second time:
[2010/03/08 12:05:27.002217, 2] smbd/sesssetup.c:1390(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2010/03/08 12:05:27.005300, 2] smbd/sesssetup.c:1390(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2010/03/08 12:05:27.005945, 2] lib/smbldap.c:950(smbldap_open_connection)
smbldap_open_connection: connection opened
[2010/03/08 12:05:27.021907, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: root
[2010/03/08 12:05:27.087024, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 513
[2010/03/08 12:05:27.093436, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 512
[2010/03/08 12:05:27.093545, 2] auth/auth.c:304(check_ntlm_password)
check_ntlm_password: authentication for user [root] -> [root] -> [root]
succeeded
[2010/03/08 12:05:27.144319, 2] auth/auth.c:314(check_ntlm_password)
check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with
error NT_STATUS_NO_SUCH_USER
[2010/03/08 12:05:27.261506, 0]
rpc_server/srv_netlog_nt.c:669(_netr_ServerAuthenticate3)
_netr_ServerAuthenticate3: no challenge sent to client QSDF-PC
[2010/03/08 12:05:27.392859, 2] auth/auth.c:314(check_ntlm_password)
check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with
error NT_STATUS_NO_SUCH_USER
[2010/03/08 12:05:27.488414, 2]
rpc_server/srv_samr_nt.c:4115(_samr_LookupDomain)
Returning domain sid for domain SAMBADOM ->
S-1-5-21-2536920342-1981552595-828935944
[2010/03/08 12:05:27.505219, 2]
lib/smbldap_util.c:277(smbldap_search_domain_info)
smbldap_search_domain_info: Searching
for:[(&(objectClass=sambaDomain)(sambaDomainName=SAMBADOM))]
[2010/03/08 12:05:27.592142, 2] passdb/pdb_ldap.c:1200(init_ldap_from_sam)
init_ldap_from_sam: Setting entry for user: QSDF-PC$
[2010/03/08 12:05:27.633889, 2] passdb/pdb_ldap.c:2384(ldapsam_add_sam_account)
ldapsam_add_sam_account: added: uid == QSDF-PC$ in the LDAP database
[2010/03/08 12:05:27.640585, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: qsdf-pc$
[2010/03/08 12:05:27.647470, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: qsdf-pc$
[2010/03/08 12:05:27.663073, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: qsdf-pc$
[2010/03/08 12:05:27.663625, 2] passdb/pdb_ldap.c:1200(init_ldap_from_sam)
init_ldap_from_sam: Setting entry for user: qsdf-pc$
[2010/03/08 12:05:27.677274, 2]
passdb/pdb_ldap.c:2061(ldapsam_update_sam_account)
ldapsam_update_sam_account: successfully modified uid = qsdf-pc$ in the LDAP
database
[2010/03/08 12:05:31.219790, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
init_sam_from_ldap: Entry found for user: qsdf-pc$
[2010/03/08 12:05:31.224875, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 515
[2010/03/08 12:05:31.232154, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap)
init_group_from_ldap: Entry found for group: 515
I don't think it has anything to do with the "Authentication for user [qsdf] ->
[qsdf] FAILED with error NT_STATUS_NO_SUCH_USER" error because the second time
it does work. Although i have no idea what this error is and if I should fix
it.
My smb.conf:
[global]
workgroup = SAMBADOM
server string = %h server (Samba, Ubuntu)
passdb backend = ldapsam:ldap://127.0.0.1
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n
*Retype\snew\sUNIX\spassword:* %n\n *passwd:*password\supdated\ssuccessfully* .
log level = 2
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
logon path =
domain logons = Yes
dns proxy = No
ldap admin dn = cn=admin,dc=test,dc=com
ldap delete dn = Yes
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Users
ldap machine suffix = ou=Computers
ldap passwd sync = yes
ldap suffix = dc=test, dc=com
ldap ssl = no
ldap user suffix = ou=Users
panic action = /usr/share/samba/panic-action %d
[netlogon]
comment = Network Logon Service
path = /home/samba/netlogon
guest ok = Yes
share modes = No
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
The add machine script should be good. Samba should add the samba attributes,
not ldap (regarding the manual).
My slapd.conf:
# Global Directives:
# Features to permit
#allow bind_v2
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/samba.schema
include /etc/ldap/schema/misc.schema
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args
# Read slapd.conf(5) for possible values
logfile /var/log/slapd.log
loglevel -1
# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_hdb
# The maximum number of entries that is returned for a search operation
sizelimit 500
# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1
#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend hdb
#######################################################################
# Specific Directives for database #1, of type hdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database hdb
# The base of your directory in database #1
suffix "dc=test,dc=com"
# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
# rootdn "cn=admin,dc=test,dc=com"
# Where the database file are physically stored for database #1
directory "/ldap_data"
# The dbconfig settings are used to generate a DB_CONFIG file the first
# time slapd starts. They do NOT override existing an existing DB_CONFIG
# file. You should therefore change these settings in DB_CONFIG directly
# or remove DB_CONFIG and restart slapd for changes to take effect.
# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0
# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057 for more
# information.
# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500
# Indexing options for database #1
index objectClass eq
index uid,memberUid eq
index sambaDomainName,gidNumber eq
index sambaGroupType,sambaSID eq
index sambaSIDList eq
# Save the time that the entry gets modified, for database #1
lastmod on
# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint 512 30
# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog
# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword
by dn="cn=admin,dc=test,dc=com" write
by anonymous auth
by self write
by * none
# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read
# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=admin,dc=test,dc=com" write
by * read
# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
# by dn="cn=admin,dc=test,dc=com" write
# by dnattr=owner write
#######################################################################
# Specific Directives for database #2, of type 'other' (can be hdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database <other>
# The base of your directory for database #2
#suffix "dc=debian,dc=org"
More information about the samba
mailing list