samba - Jan 2016 - troubleshoot samba - Could not convert sid - problem

Environment: try to join and setup simple file-share in a sub-domain off
from an AD forest which operates under 2008R2 forest, and domain functional
level; while keeping primary domain for SSH remote logins

Samba is running Version 3.6.23-24.el6_7 running on CentOS6.7. RPM based

'net ads join -k' , 'net ads keytab list', 'net testjoin
-k' reflected
positive results. I can successfully join to the forest without any issues.
i also ran 'net ads status -k' to verify if a machine account can be
queried from the member server.

 For example, When i ran 'wbinfo -n DOMAIN2\\user1`, i can get a SID back
without issues. And, based on my privileges in AD, i can verify the SID is
equal as what i can see from ADUC. But, when i ran 'wbinfo -i
DOMAIN\\user1', i always get "Could not convert sid [the-long-SID]
NT_STATUS_NO_SUCH_USER" error in my samba.log (which i specify in my
smb.conf). I ran a series of Google search, most of the searches tell me
pointed out that this is mostly related to the "idmap"
mis-configuration.
Each time i changed the range for idmap, i would 'net cache flush', and
'/bin/rm /var/lib/samba/*.tdb', and restarted nmb, smb, and winbind.
But,
obviously, changing different ranges does not really help with our
environment.

Below is my smb.conf (with fake domain-names), can i ask where i should
look at for my troubleshooting: Any pointers and opinions will be
appreciated.

###

# Global Setting

###

[global]

realm = DOMAIN2.REGION2.MS.LOCAL

workgroup = DOMAIN2

netbios name = FS02

security = ADS

kerberos method = secrets and keytab

encrypt passwords = yes

#

idmap config * : backend = tdb

idmap config * : range  = 1000000-9999999


idmap config DOMAIN2 : base_rid = 1000

idmap config DOMAIN2 : backend = rid

idmap config DOMAIN2 : range = 10000-999999

invalid users = root

#

winbind nss info = rfc2307

winbind trusted domains only = no

winbind refresh tickets = yes

winbind enum users = no

winbind enum groups = no

winbind nested groups = yes

#

load printers = no

printcap name = /dev/null

#

# Logging

#

log file = /var/log/samba/samba.log

log level  = 9

max log size = 1048576

###

# Share Definitions

###

[testshare]

comment = samba cifs share test only

path = /opt/software

force group = "@DOMAIN2\sysadmins"

browsable = no

writable = yes

read only = no

force create mode = 0660

create mask = 0770

directory mask = 0770

force directory mode = 0770

access based share enum = yes

valid users = "@DOMAIN2\sysadmins"

admin users = "@DOMAIN2\sysadmins"

guest ok = no

hide unreadable = yes

On 25/01/16 17:30, ML Wong wrote:
> Environment: try to join and setup simple file-share in a sub-domain off
> from an AD forest which operates under 2008R2 forest, and domain functional
> level; while keeping primary domain for SSH remote logins
>
> Samba is running Version 3.6.23-24.el6_7 running on CentOS6.7. RPM based
>
> 'net ads join -k' , 'net ads keytab list', 'net
testjoin -k' reflected
> positive results. I can successfully join to the forest without any issues.
> i also ran 'net ads status -k' to verify if a machine account can
be
> queried from the member server.
>
>   For example, When i ran 'wbinfo -n DOMAIN2\\user1`, i can get a SID
back
> without issues. And, based on my privileges in AD, i can verify the SID is
> equal as what i can see from ADUC. But, when i ran 'wbinfo -i
> DOMAIN\\user1', i always get "Could not convert sid [the-long-SID]
> NT_STATUS_NO_SUCH_USER" error in my samba.log (which i specify in my
> smb.conf). I ran a series of Google search, most of the searches tell me
> pointed out that this is mostly related to the "idmap"
mis-configuration.
> Each time i changed the range for idmap, i would 'net cache flush',
and
> '/bin/rm /var/lib/samba/*.tdb', and restarted nmb, smb, and
winbind. But,
> obviously, changing different ranges does not really help with our
> environment.
>
> Below is my smb.conf (with fake domain-names), can i ask where i should
> look at for my troubleshooting: Any pointers and opinions will be
> appreciated.
>
> ###
>
> # Global Setting
>
> ###
>
> [global]
>
> realm = DOMAIN2.REGION2.MS.LOCAL
>
> workgroup = DOMAIN2
>
> netbios name = FS02
>
> security = ADS
>
> kerberos method = secrets and keytab
>
> encrypt passwords = yes
>
> #
>
> idmap config * : backend = tdb
>
> idmap config * : range  = 1000000-9999999
>
>
> idmap config DOMAIN2 : base_rid = 1000
>
> idmap config DOMAIN2 : backend = rid
>
> idmap config DOMAIN2 : range = 10000-999999
>
> invalid users = root
>
> #
>
> winbind nss info = rfc2307
>
> winbind trusted domains only = no
>
> winbind refresh tickets = yes
>
> winbind enum users = no
>
> winbind enum groups = no
>
> winbind nested groups = yes
>
> #
>
> load printers = no
>
> printcap name = /dev/null
>
> #
>
> # Logging
>
> #
>
> log file = /var/log/samba/samba.log
>
> log level  = 9
>
> max log size = 1048576
>
> ###
>
> # Share Definitions
>
> ###
>
> [testshare]
>
> comment = samba cifs share test only
>
> path = /opt/software
>
> force group = "@DOMAIN2\sysadmins"
>
> browsable = no
>
> writable = yes
>
> read only = no
>
> force create mode = 0660
>
> create mask = 0770
>
> directory mask = 0770
>
> force directory mode = 0770
>
> access based share enum = yes
>
> valid users = "@DOMAIN2\sysadmins"
>
> admin users = "@DOMAIN2\sysadmins"
>
> guest ok = no
>
> hide unreadable = yes
OK, you have this in your smb.conf:

workgroup = DOMAIN2

You also say <i ran 'wbinfo -n DOMAIN2\\user1`, i can get a SID back>,
you also say < i ran 'wbinfo -i DOMAIN\\user1'>
Is this a typo ? if not, I think this is your problem. smb.conf is setup 
to obtain the info for DOMAIN2 and will ignore DOMAIN as it is not its 
workgroup.

Rowland

On 26/01/16 00:32, ML Wong wrote:
> Thanks for the pointer, Rowland. But i don't think i have avahi-daemon 
> running.
> $ sudo chkconfig --list | grep -i avahi
> $
> Any other thoughts?
>
> thanks,
> Melvin
>
>
The only other possible problem I can see is 'invalid users = root', 
this is meant to be used in a share and you have it in [global].

You could also check what you have in /etc/krb5.conf and if 
/etc/resolv.conf points to your AD DC. You could also check if the 
firewall is running and if so, is it blocking a required port, you could 
also check selinux.

Rowland

Kerberos - i can see the entries once i typed 'net ads keytab list' .
Both
in the format 'host/*', and the 'hostname$' with different
encryption
algorithm.  DNS is a good pointer. i did use 'dig' to check all the SRV
records, (_ldap, _kpasswd, _kerberos, _gc) they all come back with good
answers. SELinux is disabled, and iptables is disabled for my
troubleshooting.

Rowland, to your knowledge, as i have debug level 10 turned on, below log
excerpt shows the member-server can find the SID from the AD, but could not
convert the SID to UID. Am i right? When i did the google search, it
usually means idmap configuration is out of range. But, i really doubt that
with the range of 10000-9999999 would be a problem. And, the thing which
puzzles me the most is when doing: "wbinfo -S
S-1-5-21-2122386970-1603999544-1328175400-27912" can convert the SID fine
to 36912 without an error. So, why does winbind still complain coverting ??

[2016/01/27 16:08:53.952847,  1]
../librpc/ndr/ndr.c:284(ndr_print_function_debug)

       wbint_QueryUser: struct wbint_QueryUser

          in: struct wbint_QueryUser

              sid                      : *

                  sid                      :
S-1-5-21-2122386970-1603999544-1328175400-27912

[2016/01/27 16:08:53.952932, 10]
winbindd/winbindd_cache.c:4950(wcache_fetch_ndr)

  Entry has wrong sequence number: 121679380

[2016/01/27 16:08:53.955010,  1]
../librpc/ndr/ndr.c:284(ndr_print_function_debug)

       wbint_QueryUser: struct wbint_QueryUser

          out: struct wbint_QueryUser

              info                     : *

                  info: struct wbint_userinfo

                      acct_name                : NULL

                      full_name                : NULL

                      homedir                  : NULL

                      shell                    : NULL

                      primary_gid              : 0x0000000000000000 (0)

                      user_sid                 : S-0-0

                      group_sid                : S-0-0

              result                   : NT_STATUS_NO_SUCH_USER

[2016/01/27 16:08:53.955221,  5]
winbindd/winbindd_getpwnam.c:137(winbindd_getpwnam_recv)

  Could not convert sid S-1-5-21-2122386970-1603999544-1328175400-27912:
NT_STATUS_NO_SUCH_USER

[2016/01/27 16:08:53.955264, 10] winbindd/winbindd.c:707(wb_request_done)

  wb_request_done[15036:GETPWNAM]: NT_STATUS_NO_SUCH_USER

[2016/01/27 16:08:53.955311, 10]
winbindd/winbindd.c:768(winbind_client_response_written)

  winbind_client_response_written[15036:GETPWNAM]: delivered response to
client

[2016/01/27 16:08:53.955876,  6]
winbindd/winbindd.c:870(winbind_client_request_read)

  closing socket 32, client exited

On Tue, Jan 26, 2016 at 2:10 AM, Rowland penny <rpenny at samba.org>
wrote:
> On 26/01/16 00:32, ML Wong wrote:
>
>> Thanks for the pointer, Rowland. But i don't think i have
avahi-daemon
>> running.
>> $ sudo chkconfig --list | grep -i avahi
>> $
>> Any other thoughts?
>>
>> thanks,
>> Melvin
>>
>>
>>
> The only other possible problem I can see is 'invalid users =
root', this
> is meant to be used in a share and you have it in [global].
>
> You could also check what you have in /etc/krb5.conf and if
> /etc/resolv.conf points to your AD DC. You could also check if the firewall
> is running and if so, is it blocking a required port, you could also check
> selinux.
>
>
> Rowland
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>