samba - Nov 2017 - Trouble during classicupgrade

Hello,

I need to do a classic migration on a machine which has until now been
running samba as an old NT4-style PDC. I made a copy of that machine in
a VM to test the process. Until now, things don't work quite right. I
was following the classic upgrade howto from wiki.samba.org. I was using
the method with internal DNS. Classicupgrade itself ran without errors,
I followed the steps after provisioning in the setup guide until the
connection test with smbclient:

smbclient -L localhost -U%
session setup failed: NT_STATUS_INTERNAL_ERROR

With log level raised to 5, I can find in log.smbd:

[2017/11/25 16:41:48.248479,  1]
../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego)
  Failed to generate session_info (user and group token) for session
setup: NT_STATUS_INTERNAL_ERROR

Turning log level to 10 I get an awful lot of info, including several
messages:

Duplicate base-DN matches found for <SID=1-5-11>

These errors also occur during the classicupgrade when run with log
level 10. But I can't find anything useful in all these log messages.

I can post full logs if you want, but I'm not going to attach them here
due to the size.

I am running Debian 9 with samba 4.5.12. Before you ask, no I cannot
upgrade. This is what comes with debian and I will have to stick with it.

Thanks,

Andreas

-------------- next part --------------
[global]
        local master = yes
        domain master = yes
        preferred master = yes
        unix charset = iso8859-15
        workgroup = WG
        interfaces = lo, eth1
        bind interfaces only = yes
        obey pam restrictions = Yes
        passdb backend = tdbsam
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\sUNIX\spassword:* %n\n
*Retype\snew\sUNIX\spassword:* %n\n
        unix password sync = Yes
        logging = syslog file
        log file = /var/log/samba/log.smbd
        max log size = 4000
        log level = 1
        printcap name = /dev/null
        add user script = /usr/sbin/adduser --quiet --disabled-password
--force-badname %u
        delete user script = /usr/sbin/deluser --quiet --remove-home %u
        add group script = /usr/sbin/adduser --group --quiet %g
        delete group script = /usr/sbin/deluser --group --quiet %g
        add user to group script = /usr/sbin/adduser --quiet %u %g
        delete user from group script = /usr/sbin/deluser --quiet %u %g
        add machine script = /usr/sbin/adduser --quiet --ingroup machines
--shell /bin/false --home /dev/null --no-create-home --disabled-password
--force-badname %u
        logon script = netlogon.cmd
        domain logons = Yes
        os level = 65
        dns proxy = No
        wins support = Yes
        ldap ssl = no
        panic action = /usr/share/samba/panic-action %d
        create mask = 0770
        directory mask = 0770
        load printers = no
        printing = bsd
        show add printer wizard = no
        disable spoolss = yes
        usershare max shares = 0

Am 25.11.2017 um 16:49 schrieb Andreas Heinlein via
samba:
> Hello,
>
> I need to do a classic migration on a machine which has until now been
> running samba as an old NT4-style PDC. I made a copy of that machine in
> a VM to test the process. Until now, things don't work quite right. I
> was following the classic upgrade howto from wiki.samba.org. I was using
> the method with internal DNS. Classicupgrade itself ran without errors,
> I followed the steps after provisioning in the setup guide until the
> connection test with smbclient:
>
> smbclient -L localhost -U%
> session setup failed: NT_STATUS_INTERNAL_ERROR
>
> With log level raised to 5, I can find in log.smbd:
>
> [2017/11/25 16:41:48.248479,  1]
> ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego)
>    Failed to generate session_info (user and group token) for session
> setup: NT_STATUS_INTERNAL_ERROR
>
> Turning log level to 10 I get an awful lot of info, including several
> messages:
>
> Duplicate base-DN matches found for <SID=1-5-11>
>
> These errors also occur during the classicupgrade when run with log
> level 10. But I can't find anything useful in all these log messages.
>
> I can post full logs if you want, but I'm not going to attach them here
> due to the size.
>
> I am running Debian 9 with samba 4.5.12. Before you ask, no I cannot
> upgrade. This is what comes with debian and I will have to stick with it.
>
> Thanks,
>
> Andreas
>
>
>
I'd inspect the ldap dump file you use for the classic upgrade and 
remove the duplicate objects with SID=1-5-11 in that file before running 
classic upgrade.

On Sat, 25 Nov 2017 16:49:24 +0100
Andreas Heinlein via samba <samba at lists.samba.org> wrote:
> Hello,
> 
> I need to do a classic migration on a machine which has until now been
> running samba as an old NT4-style PDC. I made a copy of that machine
> in a VM to test the process. Until now, things don't work quite
> right. I was following the classic upgrade howto from wiki.samba.org.
> I was using the method with internal DNS. Classicupgrade itself ran
> without errors, I followed the steps after provisioning in the setup
> guide until the connection test with smbclient:
> 
> smbclient -L localhost -U%
> session setup failed: NT_STATUS_INTERNAL_ERROR
I have just discovered there was a link error on the 'classic upgrade'
page (now fixed), it took you to the entire page instead of the
relevant section, so how much of the page did you follow ?
> 
> With log level raised to 5, I can find in log.smbd:
> 
> [2017/11/25 16:41:48.248479,  1]
> ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego)
>   Failed to generate session_info (user and group token) for session
> setup: NT_STATUS_INTERNAL_ERROR
> 
> Turning log level to 10 I get an awful lot of info, including several
> messages:
> 
> Duplicate base-DN matches found for <SID=1-5-11>
This is 'Authenticated Users' and is stored in AD as
'CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=samdom,DC=example,DC=com'
and should only be found once.

Rowland

Hello,

I just wanted to say that after some hours of digging, I found the
problem. It turned out to be quite trivial...

The winbind package was missing on that machine. This is a separate
package in Debian; after installing it everything seems to work.

There were two factors that led me to remove winbind at first:
1. The wiki says "Configuring Winbindd on a Samba AD DC - Only required
if using the DC as a file server". That is misleading, obviously
winbindd itself is actually required.
2. The Debian winbind package has a weird bug that causes it to
unconditionally try to start winbindd as a standalone service even on a
samba AD DC (https://bugs.debian.org/863285), which obviously fails. I
came across that error, tried to start winbindd manually and got a
message explaining "server role = 'active directory domain
controller'
not compatible with running the winbindd binary. You should start
'samba' instead, and it will control starting the internal AD DC
winbindd implementation, which is not the same as this one." That too
led me to the assumption that a separate winbind package is now no
longer needed and I could remove it.

Only after looking through the logs again, I found the message that
samba failed to start /usr/sbin/winbindd, which is in the winbind package.

So the actual problem is now gone, but maybe someone wants to look into
these potentially misleading messages.

Thank you for your help!

Andreas

On Wed, 29 Nov 2017 18:57:53 +0100
Andreas Heinlein via samba <samba at lists.samba.org> wrote:
> Hello,
> 
> I just wanted to say that after some hours of digging, I found the
> problem. It turned out to be quite trivial...
> 
> The winbind package was missing on that machine. This is a separate
> package in Debian; after installing it everything seems to work.
Debian used to install the winbind package when you installed the
'samba' package, you now need to install it separately.
 
> 
> There were two factors that led me to remove winbind at first:
> 1. The wiki says "Configuring Winbindd on a Samba AD DC - Only
> required if using the DC as a file server". That is misleading,
> obviously winbindd itself is actually required.
You are confusing setting up 'winbindd' with installing the winbind
package.
> 2. The Debian winbind package has a weird bug that causes it to
> unconditionally try to start winbindd as a standalone service even on
> a samba AD DC (https://bugs.debian.org/863285), which obviously
> fails. I came across that error, tried to start winbindd manually and
> got a message explaining "server role = 'active directory domain
> controller' not compatible with running the winbindd binary. You
> should start 'samba' instead, and it will control starting the
> internal AD DC winbindd implementation, which is not the same as this
> one." That too led me to the assumption that a separate winbind
> package is now no longer needed and I could remove it.
Debian needs to deal with its bug, it also needs to update that
message, samba no longer starts its internal winbind (I think it has
been removed), it starts the separate 'winbindd' deamon, this is why
you need the winbind package.
  
> 
> Only after looking through the logs again, I found the message that
> samba failed to start /usr/sbin/winbindd, which is in the winbind
> package.
> 
> So the actual problem is now gone, but maybe someone wants to look
> into these potentially misleading messages.
> 
The Samba wiki is mainly written around using a self compiled Samba and
not on a package install, but you have made a few valid points, so I
will look into updating the wiki.

Rowland