[Samba] Mutex lock contention against Active directory domain controllers causing authentication failures

[Andrew Bartlett]

On Thu, 2012-07-19 at 21:27 +0000, Bell D. wrote:
> Hello,
> 
> (Sorry for top posting - forced to use Outlook).
> 
> Thanks for your suggestion. Sadly, as we're on Solaris, we immediately hit the following problem when testing on our test system:
> 
> http://www.sunmanagers.org/pipermail/sunmanagers/2011-September/049451.html
> 
> With logs such as:
> 
> [2012/07/19 22:04:13.304260,  3] smbd/vfs.c:128(vfs_init_custom)
>   Initialising custom vfs hooks from [/[Default VFS]/]
> [2012/07/19 22:04:13.305462,  0] lib/util.c:1117(smb_panic)
>   PANIC (pid 21463): sys_setgroups failed
> [2012/07/19 22:04:13.305769,  0] lib/util.c:1271(log_stack_trace)
>   unable to produce a stack trace on this platform
> [2012/07/19 22:04:13.306084,  0] lib/fault.c:358(dump_core)
>   Can not dump core: corepath not set up
> 
> Although our systems do have the patched kernel, we're unsure of going down the winbind route as we've had some bad experiences when using winbind in the past, and we'd probably have to reboot the live system after changing /etc/system. We'll keep investigating to see if we can get it to work for us.

It really should just be a matter of starting winbindd, perhaps
configuring idmap_nss (Volker can give you exact details).  In short,
the connection caching part of winbindd need not mean any other part of
the rest of the configuration changes, you just need to start the
daemon. 

In particular, you don't need to configure nss_winbind in nsswitch.conf
to gain this advantage, and it sounds like you would specifically not
want to. 

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org