Just as a follow up to this - it looks like the winbind_idmap.tdb *was* corrupted by upgrading to the latest CVS... -----Original Message----- From: Noel Kelly Sent: 30 March 2002 08:56 To: 'samba@lists.samba.org' Subject: [Samba] winbind upgrade - idmap corrupt ? I have just upgraded one of our machines to the CVS from two days ago and had a problem with the winbindd_idmap not being accessible. We have two main Samba servers (identical kernel/hardware/domain etc) and one I have been keeping up to date with the CVS whilst the other has a build from Feb 6th. I decided this weekend I should bring the second one up to date as the winbind now in CVS seems very stable, albeit with a continuing small memory leak. I transferred the source from one machine to the other and after reinstalling read (to my horror) in the logs: [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) winbindd: convert_fn : conversion failed - idmap corrupt ? I had a backup from the day before (everyone should have a cron job to gzip this file and store it away somewhere safe...) but it seems that the idmap was not actually corrupt (phew) but there is something in the new libnss_winbind.so library which does not like the 'older' idmap file ? I tried deleting the idmap cache file in case that was keeping something nasty but to no avail. What I find odd about this was that the one I keep up to date with the CVS did not have such a problem ? Is there some leap between winbindd versions which I have inadvertently missed with my Feb 6th machine ? For the moment I am back on the Feb 6th winbindd version. Cheers, Noel [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) Got a positive name query response from 192.168.5.4 ( 192.168.5.4 ) [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) Got a positive name query response from 192.168.5.4 ( 192.168.5.3 ) [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(150) Added domain UK (S-1-5-21-2025429265-764733703-725345543) [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(152) getting trusted domain list [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(166) Added domain NTBROMLEY (S-1-5-21-1016337243-1234517223-313593124) [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(262) winbindd: convert_fn : Unable to find domain NTMIXED [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) winbindd: convert_fn : conversion failed - idmap corrupt ? [2002/03/30 08:06:02, 2] libsmb/namequery.c:name_query(420) Got a positive name query response from 192.168.5.4 ( 192.168.5.4 ) [2002/03/30 08:07:02, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(120) user 'nobody' does not exist [2002/03/30 08:07:05, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(120) user 'nobody' does not exist [2002/03/30 08:07:06, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(120) user 'nobody' does not exist [2002/03/30 08:07:08, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(120) user 'nobody' does not exist [2002/03/30 08:07:09, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(120) user 'nobody' does not exist [2002/03/30 08:07:30, 0] lib/util_sid.c:string_to_sid(385) string_to_sid: Sid UK/1147 does not start with 'S-'. [2002/03/30 08:07:30, 1] nsswitch/winbindd_user.c:winbindd_getpwuid(195) could not convert uid 10013 to rid [2002/03/30 08:07:30, 0] lib/util_sid.c:string_to_sid(385) string_to_sid: Sid UK/512 does not start with 'S-'. [2002/03/30 08:07:30, 1] nsswitch/winbindd_group.c:winbindd_getgrgid(283) could not convert gid 10001 to rid [2002/03/30 08:32:13, 0] lib/util_sid.c:string_to_sid(385) string_to_sid: Sid UK/1205 does not start with 'S-'. [2002/03/30 08:32:13, 1] nsswitch/winbindd_user.c:winbindd_getpwuid(195) could not convert uid 10052 to rid -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
On Tue, Apr 02, 2002 at 01:39:03PM +0100, Noel Kelly wrote:> Just as a follow up to this - it looks like the winbind_idmap.tdb *was* > corrupted by upgrading to the latest CVS... > > -----Original Message----- > From: Noel Kelly > Sent: 30 March 2002 08:56 > To: 'samba@lists.samba.org' > Subject: [Samba] winbind upgrade - idmap corrupt ? > > > I have just upgraded one of our machines to the CVS from two days ago and > had a problem with the winbindd_idmap not being accessible. > > We have two main Samba servers (identical kernel/hardware/domain etc) and > one I have been keeping up to date with the CVS whilst the other has a build > from Feb 6th. I decided this weekend I should bring the second one up to > date as the winbind now in CVS seems very stable, albeit with a continuing > small memory leak. I transferred the source from one machine to the other > and after reinstalling read (to my horror) in the logs: > > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) > winbindd: convert_fn : conversion failed - idmap corrupt ? > > I had a backup from the day before (everyone should have a cron job to gzip > this file and store it away somewhere safe...) but it seems that the idmap > was not actually corrupt (phew) but there is something in the new > libnss_winbind.so library which does not like the 'older' idmap file ? > > I tried deleting the idmap cache file in case that was keeping something > nasty but to no avail. > > What I find odd about this was that the one I keep up to date with the CVS > did not have such a problem ? Is there some leap between winbindd versions > which I have inadvertently missed with my Feb 6th machine ? > > For the moment I am back on the Feb 6th winbindd version. > > Cheers, > Noel > > > [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) > added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 > [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) > added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 > [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) > Got a positive name query response from 192.168.5.4 ( 192.168.5.4 ) > [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) > Got a positive name query response from 192.168.5.4 ( 192.168.5.3 ) > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(150) > Added domain UK (S-1-5-21-2025429265-764733703-725345543) > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(152) > getting trusted domain list > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(166) > Added domain NTBROMLEY (S-1-5-21-1016337243-1234517223-313593124) > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(262) > winbindd: convert_fn : Unable to find domain NTMIXED > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) > winbindd: convert_fn : conversion failed - idmap corrupt ?Ok - this "Unable to find domain NTMIXED" message is the key to the problem. The conversion function goes through the old tdb and gets records that must start with "DOMAIN_NAME/". In this case it got a record starting with "NTMIXED/" and looks for it in the domain list created by the function : init_domain_list(), which is called from the winbindd main function, just before the winbindd_idmap_init() function which will do the convert. Was NTMIXED a trusted domain that is now not trusted any more ? Can you use the tdbdump utility to print out all the records in the idmap you're trying to update, or possibly send me the idmap.tdb so I can investigate ? Thanks, Jeremy.
Spot on Jeremy. We had an ntmixed domain before and it has now departed. It was simply a migration thing and there were only the usual handful of standard users (administrator, guest) and a couple of others. I guess I need to remove the records from the idmap then before upgrading ? I'll have to send you the corrupted idmap and the one we are currently running which is from a restore job. I tried to make the tdb tools but seem to get this error on all the versions I have: [root@belly tdb]# make gcc -DSTANDALONE -DTDB_DEBUG -O2 -g -DHAVE_MMAP=1 -c -o tdbtest.o tdbtest.c gcc -DSTANDALONE -DTDB_DEBUG -O2 -g -DHAVE_MMAP=1 -o tdbtest tdbtest.o tdb.o spinlock.o -lgdbm tdbtest.o: In function `compare_db': /opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:74: undefined reference to `SAFE_FREE' /opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:75: undefined reference to `SAFE_FREE' /opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:76: undefined reference to `SAFE_FREE' /opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:95: undefined reference to `SAFE_FREE' /opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:96: undefined reference to `SAFE_FREE' tdbtest.o:/opt/sambastuff/samba-2.2.3a/samba/source/tdb/tdbtest.c:97: more undefined references to `SAFE_FREE' follow collect2: ld returned 1 exit status make: *** [tdbtest] Error 1 Thanks for your help (again!), Cheers, Noel -----Original Message----- From: jra@samba.org [mailto:jra@samba.org] Sent: 03 April 2002 03:25 To: Noel Kelly Cc: 'samba@lists.samba.org' Subject: Re: FW: [Samba] winbind upgrade - idmap corrupt ? On Tue, Apr 02, 2002 at 01:39:03PM +0100, Noel Kelly wrote:> Just as a follow up to this - it looks like the winbind_idmap.tdb *was* > corrupted by upgrading to the latest CVS... > > -----Original Message----- > From: Noel Kelly > Sent: 30 March 2002 08:56 > To: 'samba@lists.samba.org' > Subject: [Samba] winbind upgrade - idmap corrupt ? > > > I have just upgraded one of our machines to the CVS from two days ago and > had a problem with the winbindd_idmap not being accessible. > > We have two main Samba servers (identical kernel/hardware/domain etc) and > one I have been keeping up to date with the CVS whilst the other has abuild> from Feb 6th. I decided this weekend I should bring the second one up to > date as the winbind now in CVS seems very stable, albeit with a continuing > small memory leak. I transferred the source from one machine to the other > and after reinstalling read (to my horror) in the logs: > > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) > winbindd: convert_fn : conversion failed - idmap corrupt ? > > I had a backup from the day before (everyone should have a cron job togzip> this file and store it away somewhere safe...) but it seems that the idmap > was not actually corrupt (phew) but there is something in the new > libnss_winbind.so library which does not like the 'older' idmap file ? > > I tried deleting the idmap cache file in case that was keeping something > nasty but to no avail. > > What I find odd about this was that the one I keep up to date with the CVS > did not have such a problem ? Is there some leap between winbinddversions> which I have inadvertently missed with my Feb 6th machine ? > > For the moment I am back on the Feb 6th winbindd version. > > Cheers, > Noel > > > [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) > added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 > [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81) > added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0 > [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) > Got a positive name query response from 192.168.5.4 ( 192.168.5.4 ) > [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420) > Got a positive name query response from 192.168.5.4 ( 192.168.5.3 ) > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(150) > Added domain UK (S-1-5-21-2025429265-764733703-725345543) > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(152) > getting trusted domain list > [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(166) > Added domain NTBROMLEY (S-1-5-21-1016337243-1234517223-313593124) > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(262) > winbindd: convert_fn : Unable to find domain NTMIXED > [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263) > winbindd: convert_fn : conversion failed - idmap corrupt ?Ok - this "Unable to find domain NTMIXED" message is the key to the problem. The conversion function goes through the old tdb and gets records that must start with "DOMAIN_NAME/". In this case it got a record starting with "NTMIXED/" and looks for it in the domain list created by the function : init_domain_list(), which is called from the winbindd main function, just before the winbindd_idmap_init() function which will do the convert. Was NTMIXED a trusted domain that is now not trusted any more ? Can you use the tdbdump utility to print out all the records in the idmap you're trying to update, or possibly send me the idmap.tdb so I can investigate ? Thanks, Jeremy.