[Samba] issues with printing

[Jeremy Allison]

On Fri, Jan 06, 2012 at 02:06:26PM -0600, Dale Schroeder wrote:
> On 01/05/2012 9:23 AM, Tom Ryan wrote:
> >On 1/5/12 9:31 AM, "Tom Ryan"<tomryan at camlaw.rutgers.edu>  wrote:
> >
> >>[2012/01/05 09:18:54.928729,  3] auth/auth_util.c:1028(check_account)
> >>  Failed to find authenticated user DOMAIN\machinename$ via getpwnam(),
> >>denying access.
> >>[2012/01/05 09:18:54.929709,  2] auth/auth.c:319(check_ntlm_password)
> >>  check_ntlm_password:  Authentication for user [machinename$] ->
> >>[machinename$] FAILED with error NT_STATUS_NO_SUCH_USER
> >>[2012/01/05 09:18:54.929807,  3] smbd/error.c:81(error_packet_set)
> >>  error packet at smbd/sesssetup.c(124) cmd=115 (SMBsesssetupX)
> >>NT_STATUS_LOGON_FAILURE
> >>
> >>You might recall that we don't use winbind so I'm at a loss as to why this
> >>happens sporadically and what I can do (short of editing the code) to work
> >>around it.
> >>
> >>
> >>Thoughts?
> >Ok, so I have found out if I put
> >
> >DOMAIN\machinename$
> >And
> >machinename$
> >
> >In /etc/passwd
> >
> >Then everything works.. However, that really isn't acceptable.
> >
> >Does anyone have a solution??
> 
> Tom,
> 
> As you've probably noticed, printing problems don't get a lot of
> responses.  I'm uncertain as to why.
> I don't know what you've already checked, so I'll give a few generalities.
> 
> Samba 3.6 had a rewrite of the printing code.  If you haven't
> already, you can read about it here:
> http://www.samba.org/samba/history/samba-3.6.0.html
> 
> There is at least 1 known printing bug, and I've experienced it.  It
> is found here:
> https://bugzilla.samba.org/show_bug.cgi?id=8384

Yeah, that one got fixed for the next release.

> Would guest access to the printing shares fix your problem?
> guest ok = Yes
> 
> If these suggestions are all strikeouts, perhaps post the global and
> printing sections of your smb.conf.
> Someone else may see something there.

The problem I can see from the pastebin is an authentication
issue. The client is trying to connect via a machine account.

If you don't allow the machine account access to the print
share then it'll get access denied.

The error above is the machine account not being present
on the box, so we can't allow such a user to connect. You
could set "map to guest = bad user", and allow guest
access to the print shares, or use a username map to
map the incoming machine account to another (known)
user, but the underlying problem here isn't in the print
subsystem.

Jeremy.