I'm trying to migrate to a Samba PDC from an NT PDC. Right now I'm
testing whether a Samba member server can effectively grab user account
info from a Samba PDC.
Both the PDC and the member server are vanilla, no-frills Redhat 9
machines, the PDC is running Samba 3.0.9 and the member is running
3.0.11. I've followed the instructions in the Samba HOWTO for setting
up winbindd, that is, I've moved or created the .so files, I've added
the winbind entries to nsswitch.conf, etc. From the docs, it appears
that winbindd should work at this point without even making changes to
the pam.d/ stuff.
I start Samba on the PDC and it runs fine. I start Samba on the
member server. Then I run the "net rpc join" command on the member
server and it joins the domain with no errors. Then I start winbindd.
At this point "wbinfo -u" returns "Error looking up domain
users"
and "wbinfo -g" returns only the local (member server's) groups.
What I'd expect to see is any users that exist in the PDC's /etc/passwd
file and the Samba tdb file. Is this what I should expect?
This is the Member server's smb.conf:
unix charset = CP1252
workgroup = QUACK
server string = Big bowl of Samba
security = DOMAIN
password server = 192.168.74.71
log level = 100
log file = /var/log/smb.log
name cache timeout = 0
wins server = eth0:192.168.74.65
idmap uid = 200000-600000
idmap gid = 200000-600000
winbind separator = +
winbind cache time = 10
inherit acls = Yes
The PDC's smb.conf is here:
[global]
unix charset = CP1252
workgroup = QUACK
server string = Nina Williams...Wins!
bind interfaces only = Yes
passdb backend = tdbsam:/etc/samba/passdb.tdb
passwd program = /usr/bin/passwd %u
passwd chat = *New*password* %n\n *Re-enter*new*password* %n\n
*Password*changed*
passwd chat debug = Yes
log level = 100
log file = /var/log/smb.log
smb ports = 139 445
name resolve order = hosts wins lmhosts
time server = Yes
add user script = /usr/sbin/useradd -m %u -s /bin/tcsh -c "QC
User"
delete user script = /usr/sbin/userdel -r %u
add group script = /usr/sbin/groupadd %g
delete group script = /usr/sbin/groupdel %g
add user to group script = /usr/sbin/usermod -G %g %u
add machine script = /usr/sbin/useradd -s /sbin/nologin -c "QC
Samba
Machine" -d /dev/null %u
logon script = scripts\%U.bat
logon path = \\%L\profiles\%U
domain logons = Yes
os level = 60
preferred master = Yes
domain master = Yes
wins server = eth0:192.168.74.65
idmap uid = 20000-600000
idmap gid = 20000-600000
winbind separator = +
winbind cache time = 10
admin users = gerry, GerryV, Administrator
[netlogon]
comment = Network Logon Service
path = /usr/local/samba/netlogon
write list = gerry, @wheel
[profiles]
comment = Profile Share
path = /usr/local/samba/profiles
read only = No
create mask = 0600
directory mask = 0700
profile acls = Yes
The 192.168.74.71 address is the Samba PDC. I've tried password
server = "*" but no there's no difference. I've worked on
this
issue on and off for months and have never been able to get winbindd
to work, **EXCEPT** if the PDC is an actual Windows NT PDC; then
winbindd works exactly as advertised. I have pored over the logs
(with log level=100) and the only thing I've found to indicate a
problem is when I run "wbinfo -t". When I do this, the following
entries appear:
[2005/03/08 12:39:39, 3] nsswitch/winbindd_cm.c:new_cm_connection(755)
Could not open a connection to QUACK for \PIPE\NETLOGON
(NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)
[2005/03/08 12:39:39, 3]
nsswitch/winbindd_misc.c:winbindd_check_machine_acct(68)
could not open handle to NETLOGON pipe
[2005/03/08 12:39:39, 2]
nsswitch/winbindd_misc.c:winbindd_check_machine_acct(98)
Checking the trust account password returned
NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
Yet, when I run "net lookup dc QUACK", it returns the domain
controller's
IP, 192.168.74.71. So something still isn't right. What other tests
can I try? I've read so many people that have winbindd working on
similar installations, but I can't even get past the most basic
function. Any suggestions would be greatly appreciated.
Og
--
=====================================================================Gerry Valle
Quantum Consulting, Inc.
System Administrator http://www.qcworld.com
======================================================================
