[Samba] Samba 4 and squid ntlm auth

[Julian Pilfold-Bagwell]

Hi List,

Looking for assistance with a squid authentication problem against Samba 4.

The squid proxy we're using worked fine on our old Samba 3 domain with 
500+ users but keeps freezing on our new Samba 4 domain.  I've joined 
the proxy using net ads join and the samba 4 network is a clean build as 
we wanted to leave any baggage from the old one behind.

What we now have is a situation where Samba 4 authenticates squid using 
NTLM perfectly up until around 120 users are using it. Once we get above 
120, it starts to down and as we approach 140 it dies altogether.  At 
this point, we restart samba and it works perfectly well for a period of 
about 5 minutes with the 140+ users connected at which point it will 
either slow to a crawl then fall over or sometimes will just fall over.

The network has three Samba 4 Domain controllers.  replication works 
across the three and at any given time, they are running at around 25% 
CPU load and consuming around 500MB of RAM.  All three are 3GHz, quad 
core Xeons with between 4 and 12GB of RAM.

The odd thing is that at no point when Samba seems to be hanging, do we 
lose access to shares on our fileserver and I also have Owncloud 
authenticating via a read only LDAP proxy which is caching.  The really 
odd thing is that I'm not seeing any obvious messages on either squid, 
the samba 3 install or the DCs that points towards any major problem.  
Given the numbers issue, I thought maybe I was hitting a ulimit wall but 
the hard and soft limits are both unlimited.

Does anyone have a similar setup and any info on where to go from here, 
i.e. which logs to check, etc.?

The OS details are as follows:

DC1 and DC1 - centos 6.4 Samba 4.0.10 (compiled from source) with 
internal DNS
DC3 - Debian Squeeze with Samba 4.0.10 (compiled from source) with Bind 
9.8 with dlz
Squid proxy - Debian squeeze with Squid 2.7 Stable 9.2 from .deb package

Clients Windows 7 & XP SP3

Cheers,

Julian

-- 
Borden Grammar School,
Avenue of Remembrance,
Sittingbourne,
Kent,
ME10 4DB.

Tel: 01795 424192

****************************************************************************
This e-mail is from Borden Grammar School Trust.

This e-mail, together with any files transmitted with it, are confidential, and are intended solely for the use of the individual or entity to whom they are addressed. Any unauthorised dissemination or
copying of this e-mail or its attachments, and any use or disclosure of any information contained in them, is strictly prohibited, and may also be illegal. If you are not the intended recipient you must not use, disclose,
distribute, copy, print or relay this e-mail.

Please note that any views expressed by an individual within this e-mail, do not necessarily reflect the views of the Borden Grammar School Trust. Borden Grammar School Trust has taken reasonable precautions to ensure no
viruses are present in this e-mail, the Academy cannot accept responsibility for any loss or damage arising from the use of this e-mail and/or files attached.

Registered office: Borden Grammar School, Avenue of Remembrance, Sittingbourne, Kent, ME10 4DB

Registered in England: 07827591