samba - Apr 2016 - Ubuntu 14.04 samba update

When ubuntu 14.04 went from samba 4.1.6 to 4.3.8 it killed my setup. Before
the change I was able to run wbinfo -u and get a list of users. Now when I
run wbinfo -u it returns nothing. I tried dis-joining and rejoining the
domain with no luck,

Here is my complete smb.conf
[global]
security = ads
realm = SUBDOMAIN.DOMAIN.TOP
workgroup = SUBDOMAIN
idmap config * : backend = tdb
idmap config * : range = 2000-7999
idmap config SUBDOMAIN:backend = ad
idmap config SUBDOMAIN:schema_mode = rfc2307
idmap config SUBDOMAIN:range = 8000-9999999
winbind nss info = rfc2307
winbind use default domain = yes

Here is my script to connect to the domain. I call it net_join.sh

echo Enter a Machine Name
read machine
echo $machine > /etc/hostname
hostname `cat /etc/hostname`
echo Enter a Domain Admin Account ex:Administrator
read admin
OSNAME="`lsb_release -a|grep "^Distributor ID:"|cut -d: -f2|awk
'{print
$1}'` joined `date "+%F"`"
OSVERSION="`lsb_release -a|grep "^Release:"|cut -d: -f2|awk
'{print $1}'`"
net ads join -U $admin osName="${OSNAME}"
osVersion="${OSVERSION}"

Here is my script to leave the domain. I call it net_leave.sh

read admin
net ads leave -U $admin

Here is my script to clear the winbind cache with a change from samba to
smb when samba changed. I call it winbind_clear.sh

service winbind stop
service smbd stop
#service samba stop
net cache flush
rm -f /var/lib/samba/*.tdb
rm -f /var/lib/samba/group_mapping.ldb
sleep 1
#service samba start
service smbd start
service winbind start

Can anyone point me to why my setup has stopped working? Or maybe some
steps I can take to learn why it is failing. Do I need to add something for
debugging?
I also tried upgrading to the beta version of Ubuntu 16.04 to see if I
could get it working with it, no luck.

I was looking at https://www.samba.org/samba/latest_news.html#4.4.2

and added

 server signing = mandatory
 ntlm auth = no

to smb.conf but that seems to have made it worse. Before adding that I was
still able to do wbinfo -g and get a group listing

Is there settings to set it back to the untrusted way before the security
updates that happened?
I'd like to set it up properly but I need to be able to get things working
for now.


On Wed, Apr 20, 2016 at 7:51 AM, Jeff Sadowski <jeff.sadowski at
gmail.com>
wrote:
> When ubuntu 14.04 went from samba 4.1.6 to 4.3.8 it killed my setup.
> Before the change I was able to run wbinfo -u and get a list of users. Now
> when I run wbinfo -u it returns nothing. I tried dis-joining and rejoining
> the domain with no luck,
>
> Here is my complete smb.conf
> [global]
> security = ads
> realm = SUBDOMAIN.DOMAIN.TOP
> workgroup = SUBDOMAIN
> idmap config * : backend = tdb
> idmap config * : range = 2000-7999
> idmap config SUBDOMAIN:backend = ad
> idmap config SUBDOMAIN:schema_mode = rfc2307
> idmap config SUBDOMAIN:range = 8000-9999999
> winbind nss info = rfc2307
> winbind use default domain = yes
>
> Here is my script to connect to the domain. I call it net_join.sh
>
> echo Enter a Machine Name
> read machine
> echo $machine > /etc/hostname
> hostname `cat /etc/hostname`
> echo Enter a Domain Admin Account ex:Administrator
> read admin
> OSNAME="`lsb_release -a|grep "^Distributor ID:"|cut -d:
-f2|awk '{print
> $1}'` joined `date "+%F"`"
> OSVERSION="`lsb_release -a|grep "^Release:"|cut -d: -f2|awk
'{print $1}'`"
> net ads join -U $admin osName="${OSNAME}"
osVersion="${OSVERSION}"
>
> Here is my script to leave the domain. I call it net_leave.sh
>
> read admin
> net ads leave -U $admin
>
> Here is my script to clear the winbind cache with a change from samba to
> smb when samba changed. I call it winbind_clear.sh
>
> service winbind stop
> service smbd stop
> #service samba stop
> net cache flush
> rm -f /var/lib/samba/*.tdb
> rm -f /var/lib/samba/group_mapping.ldb
> sleep 1
> #service samba start
> service smbd start
> service winbind start
>
> Can anyone point me to why my setup has stopped working? Or maybe some
> steps I can take to learn why it is failing. Do I need to add something for
> debugging?
> I also tried upgrading to the beta version of Ubuntu 16.04 to see if I
> could get it working with it, no luck.
>

I added

   log level = 10
   log file = /var/log/samba/%m.log

to my smb.conf

in the logs when I run wbinfo -u I get

[2016/04/20 08:24:15.864222,  3, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd_misc.c:237(winbindd_domain_info)
  [19441]: domain_info [SUBDOMAIN]
[2016/04/20 08:24:15.864238, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:861(winbind_client_response_written)
  winbind_client_response_written[19441:DOMAIN_INFO]: delivered response to
client
[2016/04/20 08:24:15.864252, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd.c:731(process_request)
  process_request: Handling async request 19441:LIST_USERS
[2016/04/20 08:24:15.864257,  3, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd_list_users.c:58(winbindd_list_users_send)
  list_users SUBDOMAIN
[2016/04/20 08:24:15.864264,  1, pid=19397, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
       wbint_QueryUserList: struct wbint_QueryUserList
          in: struct wbint_QueryUserList
[2016/04/20 08:24:15.864285,  1, pid=19397, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
       wbint_QueryUserList: struct wbint_QueryUserList
          out: struct wbint_QueryUserList
              users                    : *
                  users: struct wbint_userinfos
                      num_userinfos            : 0x00000000 (0)
                      userinfos: ARRAY(0)
              result                   : NT_STATUS_IO_TIMEOUT
[2016/04/20 08:24:15.864306, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd_list_users.c:128(winbindd_list_users_done)
  Domain SUBDOMAIN returned 0 users
[2016/04/20 08:24:15.864310, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd_list_users.c:134(winbindd_list_users_done)
  List_users for domain SUBDOMAIN failed
[2016/04/20 08:24:15.864315, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done)
  wb_request_done[19441:LIST_USERS]: NT_STATUS_OK
[2016/04/20 08:24:15.864324, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:861(winbind_client_response_written)
  winbind_client_response_written[19441:LIST_USERS]: delivered response to
client
[2016/04/20 08:24:15.864390,  6, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:965(winbind_client_request_read)
  closing socket 28, client exited


If I run wbinfo -g I get

[2016/04/20 08:28:15.575371,  3, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd_misc.c:237(winbindd_domain_info)
  [19483]: domain_info [SUBDOMAIN]
[2016/04/20 08:28:15.575390, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:861(winbind_client_response_written)
  winbind_client_response_written[19483:DOMAIN_INFO]: delivered response to
client
[2016/04/20 08:28:15.575432, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd.c:731(process_request)
  process_request: Handling async request 19483:LIST_GROUPS
[2016/04/20 08:28:15.575440,  3, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd_list_groups.c:58(winbindd_list_groups_send)
  list_groups SUBDOMAIN
[2016/04/20 08:28:15.575448,  1, pid=19397, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
       wbint_QueryGroupList: struct wbint_QueryGroupList
          in: struct wbint_QueryGroupList
[2016/04/20 08:28:15.575537,  1, pid=19397, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
       wbint_QueryGroupList: struct wbint_QueryGroupList
          out: struct wbint_QueryGroupList
              groups                   : *
                  groups: struct wbint_Principals
                      num_principals           : 213
                      principals: ARRAY(213)
                          principals: struct wbint_Principal
                              sid                      : S-X-X-X-X-X-X-X
                              type                     : SID_NAME_DOM_GRP
(2)
                              name                     : *
                                  name                     : 'Domain
Users'
                          principals: struct wbint_Principal
                              sid                      : S-X-X-X-X-X-X-X
                              type                     : SID_NAME_DOM_GRP
(2)
                              name                     : *
                                  name                     : 'Domain
Guests'
                          principals: struct wbint_Principal
                              sid                      : S-X-X-X-X-X-X-X
                              type                     : SID_NAME_DOM_GRP
(2)
                              name                     : *
                                  name                     : 'Cert
Publishers'
...
              result                   : NT_STATUS_OK
[2016/04/20 08:28:15.579824, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd_list_groups.c:128(winbindd_list_groups_done)
  Domain SUBDOMAIN returned 213 groups
[2016/04/20 08:28:15.579923, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done)
  wb_request_done[19483:LIST_GROUPS]: NT_STATUS_OK
[2016/04/20 08:28:15.579942, 10, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:861(winbind_client_response_written)
  winbind_client_response_written[19483:LIST_GROUPS]: delivered response to
client
[2016/04/20 08:28:15.580234,  6, pid=19397, effective(0, 0), real(0, 0),
class=winbind]
../source3/winbindd/winbindd.c:965(winbind_client_request_read)
  closing socket 28, client exited


On Wed, Apr 20, 2016 at 8:05 AM, Jeff Sadowski <jeff.sadowski at
gmail.com>
wrote:
> I was looking at https://www.samba.org/samba/latest_news.html#4.4.2
>
> and added
>
>  server signing = mandatory
>  ntlm auth = no
>
> to smb.conf but that seems to have made it worse. Before adding that I was
> still able to do wbinfo -g and get a group listing
>
> Is there settings to set it back to the untrusted way before the security
> updates that happened?
> I'd like to set it up properly but I need to be able to get things
working
> for now.
>
>
> On Wed, Apr 20, 2016 at 7:51 AM, Jeff Sadowski <jeff.sadowski at
gmail.com>
> wrote:
>
>> When ubuntu 14.04 went from samba 4.1.6 to 4.3.8 it killed my setup.
>> Before the change I was able to run wbinfo -u and get a list of users.
Now
>> when I run wbinfo -u it returns nothing. I tried dis-joining and
rejoining
>> the domain with no luck,
>>
>> Here is my complete smb.conf
>> [global]
>> security = ads
>> realm = SUBDOMAIN.DOMAIN.TOP
>> workgroup = SUBDOMAIN
>> idmap config * : backend = tdb
>> idmap config * : range = 2000-7999
>> idmap config SUBDOMAIN:backend = ad
>> idmap config SUBDOMAIN:schema_mode = rfc2307
>> idmap config SUBDOMAIN:range = 8000-9999999
>> winbind nss info = rfc2307
>> winbind use default domain = yes
>>
>> Here is my script to connect to the domain. I call it net_join.sh
>>
>> echo Enter a Machine Name
>> read machine
>> echo $machine > /etc/hostname
>> hostname `cat /etc/hostname`
>> echo Enter a Domain Admin Account ex:Administrator
>> read admin
>> OSNAME="`lsb_release -a|grep "^Distributor ID:"|cut -d:
-f2|awk '{print
>> $1}'` joined `date "+%F"`"
>> OSVERSION="`lsb_release -a|grep "^Release:"|cut -d:
-f2|awk '{print $1}'`"
>> net ads join -U $admin osName="${OSNAME}"
osVersion="${OSVERSION}"
>>
>> Here is my script to leave the domain. I call it net_leave.sh
>>
>> read admin
>> net ads leave -U $admin
>>
>> Here is my script to clear the winbind cache with a change from samba
to
>> smb when samba changed. I call it winbind_clear.sh
>>
>> service winbind stop
>> service smbd stop
>> #service samba stop
>> net cache flush
>> rm -f /var/lib/samba/*.tdb
>> rm -f /var/lib/samba/group_mapping.ldb
>> sleep 1
>> #service samba start
>> service smbd start
>> service winbind start
>>
>> Can anyone point me to why my setup has stopped working? Or maybe some
>> steps I can take to learn why it is failing. Do I need to add something
for
>> debugging?
>> I also tried upgrading to the beta version of Ubuntu 16.04 to see if I
>> could get it working with it, no luck.
>>
>
>

Jeff Sadowski wrote:
> When ubuntu 14.04 went from samba 4.1.6 to 4.3.8 it killed my setup.

I face the same sort of issue with Ubuntu 12.04.

The Ubuntu security updates this week have killed the ability to log on to the
Samba NT4 style domain from back level Windows clients.

Our configuration does not have any LDAP, we run with the smbpasswd passdb
backend. Just very simple. Anyway, here is our smb.conf... please suggest what
we must change in order to restore logins.

[global]
     workgroup = LDS-SMB
     netbios name = LDSLNX01
     server string = %h server
     log file = /var/log/samba/log.%m
     log level = 1
     max log size = 1000
;   syslog only = no
     syslog = 0
     panic action = /usr/share/samba/panic-action %d
;   obey pam restrictions = yes
;   guest account = nobody
;   invalid users = root
;   unix password sync = no
     passwd program = /usr/bin/passwd %u
     passwd chat = *Enter\snew\sUNIX\spassword:* %n\n
*Retype\snew\sUNIX\spassword:* %n\n .
;   pam password change = no

########## NT Domain Related ##########
;   admin users = @domadmin
     security = user
     encrypt passwords = true
     passdb backend = smbpasswd
     domain logons = true
     time server = true
     enable privileges = true
     add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false %u
     logon script = LOGON.BAT
     logon drive = I:
     logon path 
########## NT Domain Related - Master Browser ##########
     browse list = true
     domain master = true
     local master = true
     os level = 33
     preferred master = true
     wins support = yes
     name resolve order = wins host bcast

########## Printing ##########
     load printers = yes
     printcap name = CUPS
     printcap cache time = 180
     printing = CUPS
     use client driver = no
;   printer admin = @domadmin
;   show add printer wizard = No

######## File Sharing ########
     oplocks = no
     level2 oplocks = no
     socket options = TCP_NODELAY
;   message command = /bin/sh -c '/usr/bin/linpopup "%f"
"%m" %s; rm %s' &
;   idmap uid = 10000-20000
;   idmap gid = 10000-20000
;   template shell = /bin/bash

;New things global to all shares for ACL support...
     map hidden = no
     map system = no
     map archive = no
     store dos attributes = yes

# Added as a test to get correct perms on the Samba server
     unix extensions = no

# Added to test connecting Win98 clients to Samba on Ubuntu 9.04
     lanman auth = true

######## File Shares ########
; <snip here... do not think it the trouble is related to how we set up the
many shares>



I am thankful,

-- 
Michael Lueck
Lueck Data Systems
http://www.lueckdatasystems.com/

Michael Lueck wrote:
> I face the same sort of issue with Ubuntu 12.04.
>
> The Ubuntu security updates this week have killed the ability to log on to
the Samba NT4 style domain from back level Windows clients.
>
> Our configuration does not have any LDAP, we run with the smbpasswd passdb
backend. Just very simple. Anyway, here is our smb.conf... please suggest what
we must change in order to restore logins.

I spotted an issue in the log of the new Samba build, so opened a defect report:

"Changes to Samba packages for April 12 prevent legacy Windows clients from
logging in to NT4 style domain"
https://bugs.launchpad.net/bugs/1574228

I am thankful,

-- 
Michael Lueck
Lueck Data Systems
http://www.lueckdatasystems.com/