[Samba] check_account: Failed to find local account with UID" issue / The university of Chicago
Rowland Penny
rpenny at samba.org
Fri Jul 28 18:53:17 UTC 2023
On 28/07/2023 19:18, Himanshi Yadav wrote:
> Hi Rowland,
>
> Thanks for the prompt response. I changed the SSSD authentication from
> NSS db to sssd to check the issue yesterday. reverted again from sssd to
> nss. But still have the same issue. It was working perfectly before
> rebooted the machine with nss. I can’t identify the issue with NSS db too.
I have never understood why anyone would use the nss idmap backend with
AD, it requires local unix users and idmap backends like 'ad', 'rid' and
'autorid' backends make AD users into Unix users without being in
/etc/passwd, but that is your decision.
>
> Pasted output here after reverted to NSS db.
>
> [root at midway3-dm1 samba]# testparm /etc/samba/smb.conf
>
> Load smb config files from /etc/samba/smb.conf
>
> lpcfg_do_global_parameter: WARNING: The "encrypt passwords" option is
> deprecated
>
> Loaded services file OK.
>
> Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)
>
> Server role: ROLE_DOMAIN_MEMBER
>
> Press enter to see a dump of your service definitions
>
> # Global parameters
>
> [global]
> clustering = Yes
> idmap cache time = 1
> idmap negative cache time = 1
> kerberos method = system keytab
> log file = /var/log/samba/log.%m
> max log size = 50
> netbios name = DMCIFS
> realm = AD.UCHICAGO.EDU
> security = ADS
> server min protocol = SMB3_02
> server string = Samba Server Version %v
> winbind cache time = 1
> workgroup = AD
> fruit:delete_empty_adfiles = yes
> fruit:wipe_intentionally_left_blank_rfork = yes
> fruit:veto_appledouble = no
> fruit:posix_rename = yes
> fruit:model = MacSamba
> fruit:metadata = stream
> fileid:algorithm = fsname
> idmap config ad : range = 1401-2147483647
> idmap config ad : backend = nss
> idmap config * : range = 2147483648-3000000000
> idmap config * : backend = tdb2
> hosts allow = 127. 128.135.0.0/255.255.0.0
> 205.208.0.0/255.255.128.0 10.0.0.0/255.0.0.0 192.170.192.0/255.255.224.0
> invalid users = root bin daemon adm lp sync shutdown halt mail
> operator games ftp nobody dbus systemd-coredump systemd-resolve tss
> polkitd geoclue rtkit pulse pipewire libstoragemgmt qemu usbmuxd unbound
> rpc gluster chrony setroubleshoot saslauth dnsmasq radvd clevis
> cockpit-ws cockpit-wsinstance sssd flatpak colord gdm rpcuser
> gnome-initial-setup sshd pesign avahi rngd tcpdump munge
> kernel oplocks = Yes
>
>
>
> [root at midway3-dm1 samba]# systemctl status sssd
> ● sssd.service - System Security Services Daemon
> Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled;
> vendor preset: enabled)
> Active: inactive (dead) since Fri 2023-07-28 13:02:11 CDT; 2min 22s ago
> Process: 1092096 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER}
> (code=exited, status=0/SUCCESS)
>
> Main PID: 1092096 (code=exited, status=0/SUCCESS)
>
> Jul 28 09:37:35 midway3-dm1.rcc.local sssd_be[1092099]: Starting up
> Jul 28 09:37:35 midway3-dm1.rcc.local sssd_nss[1092100]: Starting up
> Jul 28 09:37:35 midway3-dm1.rcc.local sssd_pam[1092101]: Starting up
> Jul 28 09:37:35 midway3-dm1.rcc.local systemd[1]: Started System
> Security Services Daemon.
>
> Jul 28 13:02:11 midway3-dm1.rcc.local systemd[1]: Stopping System
> Security Services Daemon...
>
> Jul 28 13:02:11 midway3-dm1.rcc.local sssd_pam[1092101]: Shutting down
> (status = 0)
>
> Jul 28 13:02:11 midway3-dm1.rcc.local sssd_be[1092099]: Shutting down
> (status = 0)
>
> Jul 28 13:02:11 midway3-dm1.rcc.local sssd_nss[1092100]: Shutting down
> (status = 0)
>
> Jul 28 13:02:11 midway3-dm1.rcc.local systemd[1]: sssd.service: Succeeded.
>
> Jul 28 13:02:11 midway3-dm1.rcc.local systemd[1]: Stopped System
> Security Services Daemon.
>
> [root at midway3-dm1 samba]# id dgmartin
>
> uid=2088466063(dgmartin) gid=2088466063(dgmartin)
> groups=2088466063(dgmartin),10008(rcc),10741(pi-vitelli)
>
> [root at midway3-dm1 samba]# grep -v "#" /etc/nsswitch.conf
>
> passwd: db files systemd
> group: db files systemd
Is winbind installed and running, it should be and you need 'winbind' in
the 'passwd' and 'group' lines
> netgroup: db files
>
> automount: files
>
> services: files
>
> shadow: db files sss
I suggest you remove 'sss' from the 'shadow' line
>
> hosts: files dns myhostname
>
> aliases: files
>
> ethers: files
>
> gshadow: files
>
> networks: files dns
>
> protocols: files
>
> publickey: files
>
> rpc: files
>
>
> still have the same error :--
>
> [root at midway3-dm1 samba]# tail -f log.128.135.186.8
>
> [2023/07/28 13:09:51.101676, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
As I said earlier, '2147483648' is in the default '*' range, your DOMAIN
appears to be 'AD' but the user with the RID '304562' appears to be from
the 'ADLOCAL' domain/workgroup. If this user is in the REALM
'AD.UCHICAGO.EDU', it should have a uidNumber attribute containing a
number in the '1401-2147483647' range.
>
> [2023/07/28 13:09:53.110963, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
>
> [2023/07/28 13:09:53.117397, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
>
> [2023/07/28 13:09:55.127351, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
>
> [2023/07/28 13:09:55.135854, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
>
> [2023/07/28 13:09:57.179610, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
>
> [2023/07/28 13:09:57.186094, 0]
> ../../source3/auth/auth_util.c:1936(check_account)
>
> check_account: Failed to find local account with UID 2147483648 for
> SID S-1-5-21-1644491937-1604221776-725345543-304562
> (dom_user[ADLOCAL\dgmartin])
Rowland
More information about the samba
mailing list