samba - May 1998 - netlogon error?

Greetings all,

I'm running a RedHat 5.0 (kernel 2.0.32) Linux box with samba 1.9.18p7 and
I'm having a problem with my netlogon share.  NT domain logons are working
just fine, but I keep getting the following message in /var/log/messages,
repeated every day for every user logging in:

May 26 09:08:09 gromit PAM_pwdb[23002]: 1 authentication failure; (uid=0)
-> [username] for samba service

I'm pretty sure it has to be the netlogon share, because without a .bat
file in /home/netlogon, I still get the same error message.  It doesn't
seem to affect the actual functionality of samba, but with 70+ PC's logging
into samba at least once a day it makes wading through /var/log/messages a
little tedious.

My netlogon share is pretty much the default and looks like this:

[netlogon]
   comment = Network Logon Service
   path = /home/netlogon
   browseable = no
   guest ok = no
   writable = no
   share modes = no

the /home/netlogon directory owner/group/permissions look like this:

drwxr-xr-x   4 root     root         2048 May 26 09:03 /home/netlogon/

Have I missed something or is this a problem?

Any help would be most apprecitated.

-Eric Sisler
esisler@ares.csd.net

On Wed, 27 May 1998, Eric Sisler wrote:
> I'm running a RedHat 5.0 (kernel 2.0.32) Linux box with samba 1.9.18p7
and
> I'm having a problem with my netlogon share.  NT domain logons are
working
> just fine, but I keep getting the following message in /var/log/messages,
> repeated every day for every user logging in:
> 
> May 26 09:08:09 gromit PAM_pwdb[23002]: 1 authentication failure; (uid=0)
> -> [username] for samba service
I think this is a side effect of the way various clients mangle the case
of passwords. In order to deal with this, samba needs to try with the
password as received, then forced lower case, then try other combinations
depending on the "password level" option in smb.conf.

It's a feature of the PAM library that these get logged, when on other
systems and previously on Linux they weren't. I think that you would need
to get PAM to understand the "password level" parameter and to do the
permutations and retries to avoid the excessive loging problem. Maybe
somebody is already working on this??

OTOH, based on the information in the smb.conf manpage, you wouldn't get
this behaviour if WfWg was using COREPLUS protocol rather than LANMAN1, so
you could try to force WfWg to use COREPLUS. I don't know how you do this,
or what other affects you would see.

Charlie Brady - Telstra  |internet: cbrady@ind.tansu.com.au
Network Products         |Snail    : Locked Bag 6581, GPO Sydney 2001 Australia
Platform Technologies    |Physical : Lvl 2, 175 Liverpool St, Sydney 2000
 IN-Sub Unit - Sydney    | Phone: +61 2 9206 3470 Fax: +61 2 9281 1301