Denis Vlasenko
2004-Sep-23 08:42 UTC
[Samba] 3.0.7 net join to NT4 domain - silently fails?
I've got no responce to my mail with subject
'samba 3.0.7 cannot join NT4 domain', so I dug deeper.
I also read carefully these docs:
swat/help/Samba-HOWTO-Collection/domain-member.html
swat/help/Samba-HOWTO-Collection/winbind.html
This is what I observe:
1.I srtart from clean state:
PDC has no HUNTER machine account (chkd with L0phtcrack)
HUNTER has empty var/{lock,private}
samba daemons are stopped, logs are deleted.
2.I run:
# net join -U domadmin%password
Joined domain PORT.
l0phtcrack and SrvMgr show hunter$ now. (grayed out "WinNT wks or
server")
However, I have a msg in PDC security log (traslation from Russian):
"Session with computer HUNTER is not established, because this
computer has no trust record in SAM database."
AFAIK, this is bad. Joining the domain must store
machine trust record in PDC's SAM. PDC says it is not there.
Let's test winbindd anyway.
3.Starting winbindd. Log:
* Starting
winbindd version 3.0.7 started.
Copyright The Samba Team 2000-2004
Processing section "[pub]"
Processing section "[homes]"
WARNING: The "only user" option is deprecated
adding IPC service
adding IPC service
added interface ip=172.17.30.1 bcast=172.17.255.255 nmask=255.255.0.0
added interface ip=172.17.30.1 bcast=172.17.255.255 nmask=255.255.0.0
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
add_trusted_domain: PORT is an NT4 domain
Added domain PORT S-0-0
resolve_wins: Attempting wins lookup for name PORT<0x1c>
resolve_wins: using WINS server 172.16.42.102 and tag '*'
Got a positive name query response from 172.16.42.102 ( 172.16.42.102
172.16.42.102 )
rpc_dc_name: Returning DC PORT_PDC (172.16.42.102) for domain PORT
IPC$ connections done anonymously
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
bind_rpc_pipe: transfer syntax differs
rpc_pipe_bind: check_bind_response failed.
cli_nt_session_open: rpc bind to \PIPE\lsarpc failed
rpc: trusted_domains
rpc_dc_name: Returning DC PORT_PDC (172.16.42.102) for domain PORT
IPC$ connections done anonymously
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
Bind NACK received on pipe 801!
cli_nt_session_open: rpc bind to \PIPE\lsarpc failed
Could not open a connection to PORT for \PIPE\lsarpc
(NT_STATUS_PIPE_NOT_AVAILABLE)
add_trusted_domain: BUILTIN is an NT4 domain
Added domain BUILTIN S-1-5-32
add_trusted_domain: HUNTER is an NT4 domain
Added domain HUNTER S-1-5-21-1166498158-3287646073-3355909017
rpc: trusted_domains
Could not open a connection to PORT for \PIPE\lsarpc
(NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)
Bad, bad, bad.
SrvMgr still shows hunter$ as grayed out "WinNT wks or server".
# wbinfo -u
Error looking up domain users
winbindd log:
[ 2709]: request interface version
[ 2709]: request location of privileged pipe
[ 2709]: list users
rpc_dc_name: Returning DC PORT_PDC (172.16.42.102) for domain PORT
IPC$ connections done anonymously
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
Bind NACK received on pipe 1001!
cli_nt_session_open: rpc bind to \PIPE\samr failed
Could not open a connection to PORT for \PIPE\samr
(NT_STATUS_PIPE_NOT_AVAILABLE)
Looks like step 2 'net join -U domadmin%password' does
not succeed despite saying 'Joined domain PORT'.
I think so because I have that security alert on PDC,
and winbindd have troubles. It is easily reproducible -
each net join attemtp produce one securily log message.
I cleaned up everything and reran 'net join' again with -d4.
Result:
lp_load: refreshing parameters
Initialising global parameters
params.c:pm_process() - Processing configuration file
"/usr/app/samba-3.0.7/var/etc/smb.conf"
Processing section "[global]"
doing parameter workgroup = PORT
doing parameter encrypt passwords = yes
doing parameter security = domain
doing parameter password server = *
doing parameter domain master = no
doing parameter domain logons = no
doing parameter preferred master = No
doing parameter deadtime = 15
doing parameter create mode = 0644
doing parameter force create mode = 0400
doing parameter security mask = 0777
doing parameter directory mode = 755
doing parameter force directory mode = 0111
doing parameter directory security mask = 0777
doing parameter unix charset = koi8r
doing parameter display charset = koi8r
doing parameter dos charset = cp866
doing parameter name resolve order = wins
doing parameter wins server = 172.16.42.102
doing parameter map to guest = Bad User
doing parameter guest account = guest
doing parameter guest ok = Yes
doing parameter null passwords = Yes
doing parameter template homedir = /home/%D+%U
doing parameter template shell = /bin/bash
doing parameter winbind separator = +
doing parameter idmap uid = 10000-20000
doing parameter idmap gid = 10000-20000
doing parameter winbind enum users = yes
doing parameter winbind enum groups = yes
doing parameter debuglevel = 3
doing parameter log file = /usr/app/samba-3.0.7/var/log/samba.all
doing parameter max log size = 128
doing parameter debug hires timestamp = yes
doing parameter debug pid = yes
doing parameter debug timestamp = yes
doing parameter syslog = 0
doing parameter syslog only = no
pm_process() returned Yes
added interface ip=172.17.30.1 bcast=172.17.255.255 nmask=255.255.0.0
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
Serverzone is -10800
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
18D1F64987D0824F
cred_session_key
cred_create
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
DF3EA14045A0A28B neg: 400701ff
cli_nt_setup_creds: auth2 challenge failed NT_STATUS_NO_TRUST_SAM_ACCOUNT
just_change_the_password: unable to setup creds
(NT_STATUS_NO_TRUST_SAM_ACCOUNT)!
rpc command function failed! (NT_STATUS_NO_TRUST_SAM_ACCOUNT)
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
lsa_io_sec_qos: length c does not match size 8
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
139AF6FA2C505C3D
cred_session_key
cred_create
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
DF3EA14045A0A28B neg: 400701ff
cli_nt_setup_creds: auth2 challenge failed NT_STATUS_NO_TRUST_SAM_ACCOUNT
just_change_the_password: unable to setup creds
(NT_STATUS_NO_TRUST_SAM_ACCOUNT)!
rpc command function failed! (NT_STATUS_NO_TRUST_SAM_ACCOUNT)
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
lsa_io_sec_qos: length c does not match size 8
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
139AF6FA2C505C3D
cred_session_key
cred_create
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
51E00263A83FB7B1 neg: 400701ff
cred_create
cred_assert
Connecting to host=PORT_PDC
Connecting to 172.16.42.102 at port 445
error connecting to 172.16.42.102:445 (Connection refused)
Connecting to 172.16.42.102 at port 139
Using cleartext machine password
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
9F65B7A1600B8A71
cred_session_key
cred_create
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
A8ABF0D3B9ACCF97 neg: 400701ff
cred_create
cred_assert
return code = 0
Joined domain PORT.
What is "just_change_the_password: unable to setup creds
(NT_STATUS_NO_TRUST_SAM_ACCOUNT)!". Does this log ring a bell to anyone?
P.S. I grepped away timestamps. If you want them, unprocessed
output is below the sig. smb.conf is there too.
--
vda
[2004/09/23 10:50:55, 3] ../param/loadparm.c:lp_load(3897)
lp_load: refreshing parameters
[2004/09/23 10:50:55, 3] ../param/loadparm.c:init_globals(1307)
Initialising global parameters
[2004/09/23 10:50:55, 3] ../param/params.c:pm_process(566)
params.c:pm_process() - Processing configuration file
"/usr/app/samba-3.0.7/var/etc/smb.conf"
[2004/09/23 10:50:55, 3] ../param/loadparm.c:do_section(3390)
Processing section "[global]"
doing parameter workgroup = PORT
doing parameter encrypt passwords = yes
doing parameter security = domain
doing parameter password server = *
doing parameter domain master = no
doing parameter domain logons = no
doing parameter preferred master = No
doing parameter deadtime = 15
doing parameter create mode = 0644
doing parameter force create mode = 0400
doing parameter security mask = 0777
doing parameter directory mode = 755
doing parameter force directory mode = 0111
doing parameter directory security mask = 0777
doing parameter unix charset = koi8r
doing parameter display charset = koi8r
doing parameter dos charset = cp866
doing parameter name resolve order = wins
doing parameter wins server = 172.16.42.102
doing parameter map to guest = Bad User
doing parameter guest account = guest
doing parameter guest ok = Yes
doing parameter null passwords = Yes
doing parameter template homedir = /home/%D+%U
doing parameter template shell = /bin/bash
doing parameter winbind separator = +
doing parameter idmap uid = 10000-20000
doing parameter idmap gid = 10000-20000
doing parameter winbind enum users = yes
doing parameter winbind enum groups = yes
doing parameter debuglevel = 3
doing parameter log file = /usr/app/samba-3.0.7/var/log/samba.all
doing parameter max log size = 128
doing parameter debug hires timestamp = yes
doing parameter debug pid = yes
doing parameter debug timestamp = yes
doing parameter syslog = 0
doing parameter syslog only = no
[2004/09/23 10:50:59.870334, 4, pid=4882] ../param/loadparm.c:lp_load(3928)
pm_process() returned Yes
[2004/09/23 10:50:59.873546, 2, pid=4882] ../lib/interface.c:add_interface(79)
added interface ip=172.17.30.1 bcast=172.17.255.255 nmask=255.255.0.0
[2004/09/23 10:50:59.889562, 3, pid=4882]
../libsmb/cliconnect.c:cli_start_connection(1376)
Connecting to host=PORT_PDC
[2004/09/23 10:50:59.890412, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 445
[2004/09/23 10:50:59.904421, 2, pid=4882]
../lib/util_sock.c:open_socket_out(789)
error connecting to 172.16.42.102:445 (Connection refused)
[2004/09/23 10:50:59.905586, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 139
[2004/09/23 10:50:59.930120, 4, pid=4882] ../lib/time.c:get_serverzone(122)
Serverzone is -10800
[2004/09/23 10:50:59.960046, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_req_chal(45)
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
18D1F64987D0824F
[2004/09/23 10:50:59.968025, 4, pid=4882]
../libsmb/credentials.c:cred_session_key(59)
cred_session_key
[2004/09/23 10:50:59.971904, 4, pid=4882]
../libsmb/credentials.c:cred_create(90)
cred_create
[2004/09/23 10:50:59.972588, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_auth2(108)
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
DF3EA14045A0A28B neg: 400701ff
[2004/09/23 10:50:59.979078, 3, pid=4882]
../rpc_client/cli_netlogon.c:cli_nt_setup_creds(290)
cli_nt_setup_creds: auth2 challenge failed NT_STATUS_NO_TRUST_SAM_ACCOUNT
[2004/09/23 10:50:59.981983, 3, pid=4882]
../libsmb/trusts_util.c:just_change_the_password(43)
just_change_the_password: unable to setup creds
(NT_STATUS_NO_TRUST_SAM_ACCOUNT)!
[2004/09/23 10:50:59.983907, 1, pid=4882]
../utils/net_rpc.c:run_rpc_command(141)
rpc command function failed! (NT_STATUS_NO_TRUST_SAM_ACCOUNT)
[2004/09/23 10:51:00.001361, 3, pid=4882]
../libsmb/cliconnect.c:cli_start_connection(1376)
Connecting to host=PORT_PDC
[2004/09/23 10:51:00.002167, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 445
[2004/09/23 10:51:00.017346, 2, pid=4882]
../lib/util_sock.c:open_socket_out(789)
error connecting to 172.16.42.102:445 (Connection refused)
[2004/09/23 10:51:00.018366, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 139
[2004/09/23 10:51:00.066174, 3, pid=4882]
../rpc_parse/parse_lsa.c:lsa_io_sec_qos(181)
lsa_io_sec_qos: length c does not match size 8
[2004/09/23 10:51:00.162712, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_req_chal(45)
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
139AF6FA2C505C3D
[2004/09/23 10:51:00.169870, 4, pid=4882]
../libsmb/credentials.c:cred_session_key(59)
cred_session_key
[2004/09/23 10:51:00.173714, 4, pid=4882]
../libsmb/credentials.c:cred_create(90)
cred_create
[2004/09/23 10:51:00.174491, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_auth2(108)
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
51E00263A83FB7B1 neg: 400701ff
[2004/09/23 10:51:00.183109, 4, pid=4882]
../libsmb/credentials.c:cred_create(90)
cred_create
[2004/09/23 10:51:00.183673, 4, pid=4882]
../libsmb/credentials.c:cred_assert(121)
cred_assert
[2004/09/23 10:51:00.198900, 3, pid=4882]
../libsmb/cliconnect.c:cli_start_connection(1376)
Connecting to host=PORT_PDC
[2004/09/23 10:51:00.199740, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 445
[2004/09/23 10:51:00.214740, 2, pid=4882]
../lib/util_sock.c:open_socket_out(789)
error connecting to 172.16.42.102:445 (Connection refused)
[2004/09/23 10:51:00.215746, 3, pid=4882]
../lib/util_sock.c:open_socket_out(752)
Connecting to 172.16.42.102 at port 139
[2004/09/23 10:51:00.250525, 4, pid=4882]
../passdb/secrets.c:secrets_fetch_trust_account_password
(290)
Using cleartext machine password
[2004/09/23 10:51:00.251841, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_req_chal(45)
cli_net_req_chal: LSA Request Challenge from HUNTER to PORT_PDC:
9F65B7A1600B8A71
[2004/09/23 10:51:00.259052, 4, pid=4882]
../libsmb/credentials.c:cred_session_key(59)
cred_session_key
[2004/09/23 10:51:00.262893, 4, pid=4882]
../libsmb/credentials.c:cred_create(90)
cred_create
[2004/09/23 10:51:00.263567, 4, pid=4882]
../rpc_client/cli_netlogon.c:cli_net_auth2(108)
cli_net_auth2: srv:\\PORT_PDC acct:HUNTER$ sc:2 mc: HUNTER chal
A8ABF0D3B9ACCF97 neg: 400701ff
[2004/09/23 10:51:00.272196, 4, pid=4882]
../libsmb/credentials.c:cred_create(90)
cred_create
[2004/09/23 10:51:00.272756, 4, pid=4882]
../libsmb/credentials.c:cred_assert(121)
cred_assert
[2004/09/23 10:51:00.283991, 2, pid=4882] ../utils/net.c:main(792)
return code = 0
Joined domain PORT.
smb.conf:
========# %U session username (the username that the client
# wanted, not necessarily the same as the one they
# got).
# %G primary group name of %U.
# %h the Internet hostname that Samba is running on.
# %m the NetBIOS name of the client machine (very use-
# ful).
# %L the NetBIOS name of the server. This allows you to
# change your config based on what the client calls
# you. Your server can have a ``dual personality''.
# %M the Internet name of the client machine.
# %R the selected protocol level after protocol negotia-
# tion. It can be one of CORE, COREPLUS, LANMAN1,
# LANMAN2 or NT1.
# %d The process id of the current server process.
# %a the architecture of the remote machine. Only some
# are recognized, and those may not be 100% reliable.
# It currently recognizes Samba, Windows for Work-
# groups, Windows 95, Windows NT and Windows 2000.
# Anything else will be known as ``UNKNOWN''. If it
# gets it wrong sending a level 3 log to
# samba@samba.org should allow it to be fixed.
# %I The IP address of the client machine.
# %T the current date and time.
# %D Name of the domain or workgroup of the current
# user.
# %$(envvar)
# The value of the environment variable envar.
#
# The following substitutes apply only to some configuration
# options (only those that are used when a connection has
# been established):
#
# %S the name of the current service, if any.
# %P the root directory of the current service, if any.
# %u username of the current service, if any.
# %g primary group name of %u.
# %H the home directory of the user given by %u.
# %N the name of your NIS home directory server. This is
# obtained from your NIS auto.map entry. If you have
# not compiled Samba with the --with-automount
# option, this value will be the same as %L.
# %p the path of the service's home directory, obtained
# from your NIS auto.map entry. The NIS auto.map
# entry is split up as ``%N:%p''.
# Global parameters
[global]
;;;;;;; Machine type (standalone/domain member/etc)
;;;;;;; Pick one type of config below
;# Authenticate users using given WinNT box
;# - VDA: ok
; workgroup = PORT
; encrypt passwords = yes
; security = server
; password server = PORT_PDC
; domain master = no
# Authenticate users using given WinNT domain
# - VDA: ok, but you'll need to create UNIX users for each connecting Win
one
# (same username as found on PDC)
# Update: [2001/12/07] can't make it accept domain users
# when winbindd is running even if local user exists in /etc/passwd
workgroup = PORT
encrypt passwords = yes
security = domain
password server = *
domain master = no
# domain logons = yes: provides the NETLOGON service
# which only PDC and BDC shall provide.
# This is a NO-GO for domain member machine. Set to NO.
domain logons = no
;# Authenticate users using local Samba
;# (we are part of a workgroup)
;# - VDA: ok.
;# Set passwords for users via smbpasswd!
; workgroup = LINUX
; os level = 33
; security = share
; domain logons = no
;# We are PDC for our domain (domain name set by 'workgroup')
;# Have to have [netlogon]
;# TODO: check:maybe we need [profiles] too?
; workgroup = PORT2
; os level = 34
; security = user
; domain logons = yes
; domain master = yes # affects browser elections
; ;# To be executed each time user logs in. Stored in [netlogon]
; ;logon script = %u.bat
; # Home dir and drive to map it to
; # (%L: our server netbios name, %u: final user name)
; logon home = \\%L\%u\home\%u
; logon drive = w:
; # Profiles dir for roaming profiles
; logon path = \\%L\%u\home\%u\profiles
;;;;;;; Browsing
# force reelection on nmbd startup
# use with caution, because if there are several such hosts... ouch...
preferred master = No
;;;;;;; Connections
# connection timeout, minutes
deadtime = 15
;;;;;;; File management
# create mode = (((user_specified) AND cr_mode) OR force_mode)
create mode = 0644
force create mode = 0400
# 0's disallow chmodding of corresponding bits
security mask = 0777
# same for dirs
directory mode = 755
force directory mode = 0111
directory security mask = 0777
#
unix charset = koi8r
display charset = koi8r
dos charset = cp866
;;;;;;; Name resolution
name resolve order = wins
wins server = 172.16.42.102
;;;;;;; User management
map to guest = Bad User
guest account = guest
guest ok = Yes
null passwords = Yes
template homedir = /home/%D+%U
template shell = /bin/bash
winbind separator = +
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
;;;;;;; Logging
# Higher numbers = more logging
# Example: debuglevel = 3 passdb:5 auth:10 winbind:2
# (all tdb printdrivers lanman smb rpc_parse rpc_srv rpc_cli passdb sam auth
winbind vfs idmap)
debuglevel = 3
#log file = /usr/app/samba-3.0.7/var/log/samba.%m
log file = /usr/app/samba-3.0.7/var/log/samba.all
# in kb. Will rename to *.old when exceeded
max log size = 128
debug hires timestamp = yes
debug pid = yes
debug timestamp = yes
#debug uid = yes
# Do not log to syslog if message's level is greater than...
syslog = 0
# Do not log into files, syslog only?
syslog only = no
;;;;;;; Shares
;default service = user
;[user]
; path = /
; username = %S
; read only = No
; guest ok = No
; only user = Yes
; browseable = Yes
[pub]
path = /pub
guest only = Yes
;[in]
; path = /pub/in
; read only = No
; guest only = Yes
[homes]
path = /
;*;username = %S
read only = No
guest ok = No
only user = Yes
# we don't actually want users to see //me/homes ;)
browseable = No
;[netlogon]
; path = /usr/app/samba-3.0.7/var/netlogon
; guest ok = No
; browseable = No
;[profiles]
; path = /usr/app/samba-3.0.7/var/profiles
; browseable = No
Possibly Parallel Threads
Wisdom of the Ancients
