[Samba] Fw: Print Server not staying working

[Rowland Penny]

On Wed, 15 Nov 2023 18:00:31 +0000
Umesh Thakur via samba <samba at lists.samba.org> wrote:

> Hi there,
> 
> I am still waiting your response on this. Please bring your attention
> to below forwarded email. Thank you

I take it that your English isn't great and that you really meant:

Hello, sorry to bother you again, but I really need help with this, can
anyone spare their time to help me ?


> 
> Kind regards,
> 
> Umesh Thakur​
> Technical Analyst
> School District No.57
> 
> Note: Please use ticketing system for technical support
> ________________________________
> From: samba <samba-bounces at lists.samba.org> on behalf of Umesh Thakur
> via samba <samba at lists.samba.org> Sent: October 27, 2023 9:32 AM
> To: samba at lists.samba.org <samba at lists.samba.org>
> Subject: [Samba] Print Server not staying working
> 
> CAUTION: External Email. This email originated from outside of the
> SD57 district email system. Do Not click on links or open
> attachments, unless you are confident about the source.
> 
> 
> Hi there,
> 
> Samba Version 4.17.12-Debian
> 
> I am having to constantly restart winbind and smbd in order for my
> client machines to print.
> 
> Every 5 or so minutes, the printers from this print server appear as
> "Server offline" in Windows. If I restart smbd and winbind at the
> same time, they come back for a bit, and everyone can print as per
> normal.
> 
> I have seen the bug report to delete printer_list.tdb, and done that
> yesterday. In the log.rpcd_spoolss file, I see entries such as this
> below:
> 
> [2023/10/26 09:27:21,  0]
> ../../librpc/rpc/dcesrv_handles.c:130(dcesrv_handle_lookup)
> dcesrv_handle_lookup: Attempt to use invalid sid
> S-1-5-21-3018909051-3044254431-1064828747-1113 -
> S-1-5-21-3018909051-3044254431-1064828747-1291 

Samba expected the SIDs to match, but they don't, so who or what are the
two SIDs ?

what do these two commands produce:

wbinfo -s S-1-5-21-3018909051-3044254431-1064828747-1113

wbinfo -s S-1-5-21-3018909051-3044254431-1064828747-1291

Does that give you any idea ?

>[2023/10/26 09:27:21,
> 0] ../../librpc/rpc/dcesrv_handles.c:130(dcesrv_handle_lookup)
> dcesrv_handle_lookup: Attempt to use invalid sid
> S-1-5-21-3018909051-3044254431-1064828747-1113 -
> S-1-5-21-3018909051-3044254431-1064828747-1291
> 
> The SIDs are valid, and point to a logged on user and their
> workstation.

Could it be that the workstation is starting the printing and then the
user takes over (bit lost here, I do not print anything).

> 
> The winbindd.log file has thousands of entries like these:
> 
> [2023/10/26 09:28:58.028357,  1]
> ../../source3/winbindd/wb_lookupsids.c:667(wb_lookupsids_recv) Failed
> with NT_STATUS_INVALID_SID. [2023/10/26 09:28:58.028372,  1]
> ../../source3/winbindd/wb_sids2xids.c:765(wb_sids2xids_recv) Failed
> with NT_STATUS_INVALID_SID. [2023/10/26 09:28:58.028385,  1]
> ../../source3/winbindd/winbindd_sids_to_xids.c:113(winbindd_sids_to_xids_recv)
> Could not convert sids: NT_STATUS_INVALID_SID [2023/10/26
> 09:28:58.028413,  1]
> ../../source3/winbindd/wb_sids2xids.c:368(wb_sids2xids_lookupsids_done)
> Failed with NT_STATUS_INVALID_SID.
> 
> Below is the sanitized smb.conf file:
> 
> [global]
>    bind interfaces only = Yes
>    client signing = required
>    disable netbios = Yes
>    interfaces = lo enp1s0
>    log file = /var/log/samba/%m.log
>    log level = 1
>    realm = DUCH.AD.EXAMPLE.CA
>    security = ADS
>    server role = member server
>    server signing = required
>    template homedir = /home/duch/%U
>    template shell = /bin/false
>    winbind nss info = template
>    winbind separator = /
>    workgroup = DUCH
>    idmap config * : backend = tdb
>    idmap config * : range = 70000-99999
>    idmap config duch : backend = rid
>    idmap config duch : range = 100000-1999999
> 
>    spoolss: architecture = Windows x64
>    rcpd_spoolss:idle_seconds=30
>    rpcd_spoolss:num_workers = 10
>    username map = /etc/samba/user.map

Is there anything in the user.map other than Administrator to root
mapping ?

>    min domain uid = 0
> 
>    map acl inherit = Yes
>    printing = CUPS
>    store dos attributes = Yes
>    vfs objects = acl_xattr
>    printcap name = /var/run/cups/printcap
>    printcap cache time = 60
> 
> [printers]
>    browseable = No
>    path = /var/spool/samba/
>    printable = Yes
> 
> [print$]
>    path = /usr/local/share/printer_drivers/

If this Samba on Debian, why is the 'path' not
'/var/lib/samba/printers' ?

Rowland