thr3ads.net - samba - [Samba] A problem On the integrate Samba and AD 2k3 .. [Feb 2007]

If this information is useful, please help other people find it:
Share via:

Eric.chen

2007-Feb-20 01:34 UTC

[Samba] Fw: A problem On the integrate Samba and AD 2k3 ..

the page is my reference 
http://www.infosecwriters.com/text_resources/pdf/AD_and_Linux_TMunn.pdf

i wnat to get users group for squid' wbinfo_group.pl use auth...

now i can join the samba server to AD domain
but i can't read user's group..

can any one tell me what is happend..
======================================================[root@wxyz-dns1 samba]#
wbinfo -u
Administrator
Guest
SUPPORT_wqwddqw
krbtgt
HLwdqdw
evdwieh
...
...
[root@wxyz-dns1 samba]# wbinfo -g
BUILTIN/System Operators
BUILTIN/Replicators
BUILTIN/Guests
....
HelpServicesGroup
TelnetClients
IIS_WPG
Domain Computers
Domain Controllers
Schema Admins
..
[root@wxyz-dns1 samba]# wbinfo -t
checking the trust secret via RPC calls succeeded

BUT i can't get user'group

[root@wxyz-dns1 samba]# wbinfo -n USBEnabled
S-1-5-21-4121681757-1283273484-4023308939-1859 Domain Group (2)
[root@wxyz-dns1 samba]# wbinfo -Y USBEnabled
Could not convert sid USBEnabled to gid
[root@wxyz-dns1 samba]#

[root@wxyz-dns1 samba]# tail -n100 winbindd.log
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          001c num_ref_doms_1: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0020 ptr_ref_dom   : 00020004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0024 max_entries   : 00000020
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0028 num_ref_doms_2: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              002c uni_str_len: 0008
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              002e uni_max_len: 000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0030 buffer     : 00020008
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0034 sid_ptr[0] : 0002000c
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0038 uni_max_len: 00000005
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              003c offset     : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0040 uni_str_len: 00000004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
              0044 buffer     : C.M.E.L.
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              004c num_auths: 00000004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0050 sid_rev_num: 01
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0051 num_auths  : 04
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0052 id_auth[0] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0053 id_auth[1] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0054 id_auth[2] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0055 id_auth[3] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0056 id_auth[4] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0057 id_auth[5] : 05
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32s(869)
                  0058 sub_auths : 00000015 f5abdf5d 4c7d330c efced28b
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0068 num_entries    : 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          006c ptr_trans_names: 00020010
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0070 num_entries2   : 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              0074 sid_name_use: 0002
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
                  0078 uni_str_len: 0014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
                  007a uni_max_len: 0014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
                  007c buffer     : 00020014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0080 domain_idx  : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0084 uni_max_len: 0000000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0088 offset     : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              008c uni_str_len: 0000000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
              0090 buffer     : U.S.B.E.n.a.b.l.e.d.
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
      00a4 mapped_count: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
      00a8 status      : NT_STATUS_OK
[2007/02/20 09:19:29, 5] nsswitch/winbindd_rpc.c:msrpc_sid_to_name(354)
  Mapped sid to [WXYZ]\[USBEnabled]
[2007/02/20 09:19:29, 0] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(288)
  winbindd_sid_to_uid: 'winbind trusted domains only' is set but this
group
[USBEnabled] doesn't exist!
[2007/02/20 09:19:29, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6473: EOF
[2007/02/20 09:19:47, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(261)
  [ 6477]: request interface version
[2007/02/20 09:19:47, 3] nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(297)
  [ 6477]: request location of privileged pipe
[2007/02/20 09:19:47, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 22, pid 6477: EOF
[2007/02/20 09:19:47, 3] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(238)
  [ 6477]: sid to gid S-1-5-21-4121681757-1283273484-4023308939-1859
[2007/02/20 09:19:47, 0] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(288)
  winbindd_sid_to_uid: 'winbind trusted domains only' is set but this
group
[USBEnabled] doesn't exist!
[2007/02/20 09:19:47, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6477: EOF
[2007/02/20 09:20:01, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(261)
  [ 6480]: request interface version
[2007/02/20 09:20:01, 3] nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(297)
  [ 6480]: request location of privileged pipe
[2007/02/20 09:20:01, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 22, pid 6480: EOF
[2007/02/20 09:20:01, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1003)
  [ 6480]: getgroups root
[2007/02/20 09:20:01, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6480: EOF

in my lab environment:

samba server:
OS: Cent OS 4.4
install packge:
	samba-common-3.0.10-1.4E.9
	system-config-samba-1.2.21-1
	samba-client-3.0.10-1.4E.9
	samba-3.0.10-1.4E.9
	krb5-devel-1.3.4-33
	krb5-server-1.3.4-33
	pam_krb5-2.1.8-1
	krb5-libs-1.3.4-33
	krb5-workstation-1.3.4-33

smb.conf
[global]
        workgroup = WXYZ
        realm = WXYZ.COM.CN
        netbios name = WXYZ-dns1
        server string = Squid_AD_auth_server
        encrypt passwords = yes
        password server = WXYZdc01.WXYZ.COM.CN
        security = ADS
        wins server = 10.111.9.2
        allow trusted domains = yes
        domain master = no
        local master = no
        preferred master = no

        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        log file = /var/log/samba/%m.log
        max log size = 15000
        load printers = no
        # Debug logging information
        log level = 5
        debug timestamp = yes

        dns proxy = no
        printcap name = /etc/printcap
        cups options = raw

        template shell = /bin/false
        template homedir = /home/%U
        winbind trusted domains only = yes
        winbind use default domain = yes
        idmap gid = 10000-20000
        idmap uid = 10000-20000
;
;       idmap gid = 16777216-33554431
;       idmap uid = 16777216-33554431
;
        winbind separator = /
        winbind enum groups = yes
        winbind enum users = yes

.......
.....

krb5.conf:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = WXYZ.COM.CN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 WXYZ.COM.CN = {
  kdc = WXYZDC01.WXYZ.COM.CN:88
  kdc = WXYZDC02.WXYZ.COM.CN:88
  admin_server = WXYZDC01.WXYZ.COM.CN:749
  default_domain = WXYZ.COM.CN
 }

[domain_realm]
 .WXYZ.com.CN = WXYZ.COM.CN
 WXYZ.com.CN = WXYZ.COM.CN

[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }
------- End of Forwarded Message -------

Eric.chen

2007-Feb-20 01:51 UTC

head link

[Samba] A problem On the integrate Samba and AD 2k3 ..

A problem On the integrate Samba and AD 2k3 ..


the page is my reference 
http://www.infosecwriters.com/text_resources/pdf/AD_and_Linux_TMunn.pdf
i wnat to use users group for squid' wbinfo_group.pl use auth...

now i can join the samba server to AD domain
but i can't read user's group..

can any one tell me what is happend..



like this

[root@wxyz-dns1 samba]# wbinfo -u
Administrator
Guest
SUPPORT_wqwddqw
krbtgt
HLwdqdw
evdwieh
...
...
[root@wxyz-dns1 samba]# wbinfo -g
BUILTIN/System Operators
BUILTIN/Replicators
BUILTIN/Guests
....
HelpServicesGroup
TelnetClients
IIS_WPG
Domain Computers
Domain Controllers
Schema Admins
..
[root@wxyz-dns1 samba]# wbinfo -t
checking the trust secret via RPC calls succeeded

BUT i can't get user'group 

[root@wxyz-dns1 samba]# wbinfo -n USBEnabled
S-1-5-21-4121681757-1283273484-4023308939-1859 Domain Group (2)
[root@wxyz-dns1 samba]# wbinfo -Y USBEnabled
Could not convert sid USBEnabled to gid
[root@wxyz-dns1 samba]#




[root@wxyz-dns1 samba]# tail -n100 winbindd.log
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          001c num_ref_doms_1: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0020 ptr_ref_dom   : 00020004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0024 max_entries   : 00000020
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0028 num_ref_doms_2: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              002c uni_str_len: 0008
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              002e uni_max_len: 000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0030 buffer     : 00020008
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0034 sid_ptr[0] : 0002000c
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0038 uni_max_len: 00000005
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              003c offset     : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0040 uni_str_len: 00000004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
              0044 buffer     : C.M.E.L.
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              004c num_auths: 00000004
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0050 sid_rev_num: 01
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0051 num_auths  : 04
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0052 id_auth[0] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0053 id_auth[1] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0054 id_auth[2] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0055 id_auth[3] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0056 id_auth[4] : 00
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint8(584)
                  0057 id_auth[5] : 05
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32s(869)
                  0058 sub_auths : 00000015 f5abdf5d 4c7d330c efced28b
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0068 num_entries    : 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          006c ptr_trans_names: 00020010
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
          0070 num_entries2   : 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
              0074 sid_name_use: 0002
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
                  0078 uni_str_len: 0014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint16(613)
                  007a uni_max_len: 0014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
                  007c buffer     : 00020014
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0080 domain_idx  : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0084 uni_max_len: 0000000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              0088 offset     : 00000000
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
              008c uni_str_len: 0000000a
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
              0090 buffer     : U.S.B.E.n.a.b.l.e.d.
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_uint32(642)
      00a4 mapped_count: 00000001
[2007/02/20 09:19:29, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
      00a8 status      : NT_STATUS_OK
[2007/02/20 09:19:29, 5] nsswitch/winbindd_rpc.c:msrpc_sid_to_name(354)
  Mapped sid to [WXYZ]\[USBEnabled]
[2007/02/20 09:19:29, 0] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(288)
  winbindd_sid_to_uid: 'winbind trusted domains only' is set but this
group
[USBEnabled] doesn't exist!
[2007/02/20 09:19:29, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6473: EOF
[2007/02/20 09:19:47, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(261)
  [ 6477]: request interface version
[2007/02/20 09:19:47, 3] nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(297)
  [ 6477]: request location of privileged pipe
[2007/02/20 09:19:47, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 22, pid 6477: EOF
[2007/02/20 09:19:47, 3] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(238)
  [ 6477]: sid to gid S-1-5-21-4121681757-1283273484-4023308939-1859
[2007/02/20 09:19:47, 0] nsswitch/winbindd_sid.c:winbindd_sid_to_gid(288)
  winbindd_sid_to_uid: 'winbind trusted domains only' is set but this
group
[USBEnabled] doesn't exist!
[2007/02/20 09:19:47, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6477: EOF
[2007/02/20 09:20:01, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(261)
  [ 6480]: request interface version
[2007/02/20 09:20:01, 3] nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(297)
  [ 6480]: request location of privileged pipe
[2007/02/20 09:20:01, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 22, pid 6480: EOF
[2007/02/20 09:20:01, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1003)
  [ 6480]: getgroups root
[2007/02/20 09:20:01, 5] nsswitch/winbindd.c:winbind_client_read(477)
  read failed on sock 23, pid 6480: EOF




in my lab environment:

samba server:
OS: Cent OS 4.4
install packge:
	samba-common-3.0.10-1.4E.9
	system-config-samba-1.2.21-1
	samba-client-3.0.10-1.4E.9
	samba-3.0.10-1.4E.9
	krb5-devel-1.3.4-33
	krb5-server-1.3.4-33
	pam_krb5-2.1.8-1
	krb5-libs-1.3.4-33
	krb5-workstation-1.3.4-33

smb.conf
[global]
        workgroup = WXYZ
        realm = WXYZ.COM.CN
        netbios name = WXYZ-dns1
        server string = Squid_AD_auth_server
        encrypt passwords = yes
        password server = WXYZdc01.WXYZ.COM.CN
        security = ADS
        wins server = 10.111.9.2
        allow trusted domains = yes
        domain master = no
        local master = no
        preferred master = no

        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        log file = /var/log/samba/%m.log
        max log size = 15000
        load printers = no
        # Debug logging information
        log level = 5
        debug timestamp = yes

        dns proxy = no
        printcap name = /etc/printcap
        cups options = raw

        template shell = /bin/false
        template homedir = /home/%U
        winbind trusted domains only = yes
        winbind use default domain = yes
        idmap gid = 10000-20000
        idmap uid = 10000-20000
;
;       idmap gid = 16777216-33554431
;       idmap uid = 16777216-33554431
;
        winbind separator = /
        winbind enum groups = yes
        winbind enum users = yes

.......
.....

krb5.conf:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = WXYZ.COM.CN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 WXYZ.COM.CN = {
  kdc = WXYZDC01.WXYZ.COM.CN:88
  kdc = WXYZDC02.WXYZ.COM.CN:88
  admin_server = WXYZDC01.WXYZ.COM.CN:749
  default_domain = WXYZ.COM.CN
 }

[domain_realm]
 .WXYZ.com.CN = WXYZ.COM.CN
 WXYZ.com.CN = WXYZ.COM.CN

[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

Eric.chen

2007-Feb-27 07:36 UTC

head link

[Samba] How long the winbind gid & uid can to synchronize From AD account

Dear all 
	 
	how to immediately to synchronize Account on AD server and sambe 

	when i creat a new AD account & group.
	my samba server may be wait 1 hours  after  it can get new account&group

Possibly Parallel Threads

Search for more possibly parallel threads

samba - Feb 2007 - A problem On the integrate Samba and AD 2k3 ..

[Samba] Fw: A problem On the integrate Samba and AD 2k3 ..

[Samba] A problem On the integrate Samba and AD 2k3 ..

[Samba] How long the winbind gid & uid can to synchronize From AD account

Possibly Parallel Threads