[Samba] Samba 4.3.13 logon oddity on Solaris 10

[Rowland Penny]

On Fri, 22 Jun 2018 13:38:14 +0200
Bernd Markgraf <bernd.markgraf at med.ovgu.de> wrote:

> On Wed, 2018-06-20 at 14:20 +0100, Rowland Penny via samba wrote:
> > On Wed, 20 Jun 2018 15:01:12 +0200
> > Bernd Markgraf <bernd.markgraf at med.ovgu.de> wrote:
> > > I would like to see that behaviour on my machine too ;-)
> > 
> > Then just do what I do, use only winbind.
> That's what I have now.
> pre-winbind (ldap in nsswitch.conf)
> 
> root.niihau ~ # wbinfo --uid-info=10058
> failed to call wbcGetpwuid: WBC_ERR_DOMAIN_NOT_FOUND
> Could not get info for uid 10058
> root.niihau ~ # wbinfo -i markgrafb
> markgrafb:*:4294967295:4294967295::/home/markgrafb:/usr/bin/tcsh
> root.niihau ~ # getent passwd markgrafb
> markgrafb:x:10058:10001:Bernd Markgraf:/home/markgrafb:/usr/bin/tcsh
> root.niihau ~ # getent group pakan
> pakan::10066:
> 
> I copied nss_winbind.so.1 and the pam module into the appropriate
> places and set nsswitch.conf to
> 
> passwd:     files winbind
> group:      files winbind
> 
> Now I get:
> root.niihau ~ # getent group pakan
> pakan:x:-1:
> root.niihau ~ # getent passwd markgrafb
> markgrafb:*:-1:-1::/home/markgrafb:/usr/bin/tcsh
> root.niihau ~ # wbinfo -i markgrafb
> markgrafb:*:4294967295:4294967295::/home/markgrafb:/usr/bin/tcsh
> root.niihau ~ # wbinfo --uid-info 10058
> failed to call wbcGetpwuid: WBC_ERR_DOMAIN_NOT_FOUND
> Could not get info for uid 10058
> 
> So for now back to using LDAP so at least OS logins work and Samba
> shares can be used at the second connection attempt.

You would need to run (as root) 'net cache flush' after changing to
winbind.

> > Do you store your users & groups in several places ? if not, why
> > would you need to use different name services ?
> Again more of the theoretical/academic question. But I already had the
> need to use different services at once in the past. Mostly in the
> transition times NIS->NIS+->LDAP. Again I wouldn't say it never
> happens and rule out the possibility to do so one day.

Er, you raised the possibility of using different name services, not I.

> 
> > > I should have a correctly setup smb.conf now too. I just don't use
> > > winbindd to provide users on the OS level... 
> > 
> > Why not ? using it means you have only place to set up and maintain.
> LDAP+Kerberos on the OS level is a lot easier to maintain. Regular OS
> patches and things are sorted. Updating Samba to anything halfway
> recent involves building things from source unfortunately.

This is indeed a problem, Samba is a rapidly moving target, but the
fileserver components are really fairly stable.

> 
> > > Where do I dig next?
> > You could try reading this:
> > 
> > https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member
> > 
> Apart from skipping the * lines in smb.conf that's what I used. 

And you need those lines, without them, there is nowhere to store and
allocate IDs for the 'Well known SIDs'

All I can tell you is, With a correctly set up smb.conf on a Unix
domain member, you do not need ldap for authentication, yes there may
be times when you need to carry out an ldapsearch, but most of the time
you can use kerberos instead.

Rowland