-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Good Morning Folks.
I have a reoccurring error here when trying to join a Windows XP SP2
workstation to a Samba domain (accounts stored in LDAP) The error is
"The user name cannot be found"
Our LDAP directory looks like this
dc=na
~ o=ourdomain
~ ou=Groups
~ ou=Staff
~ ou=Computers
My problem at the moment is all the windows clients are using pGina to
login to the windows workstations,
and modifying the LDAP directories is really less than desirable as we
have several fail over servers (replication etc..)
Mail and all user SSH logins depend on that structure. It would be a
VERY large task on my part to change the structure,
however I need a solution as pGina is no longer something we can
continue to use. pam_ldap along with nsswitch is in place and working
just fine for ldap
The user accounts are all stored in ou=Staff, and during the joining
process the machine account is created in ou=Computers via the IDEALX
smbldap scripts.
According to the trace I am sending with this email the root user is
round and authorized so what gives ? This Winblows machine was patched
to current yesterday.
Samba versions:
[root@vnpdc01 root]# rpm -qa |grep samba
samba-common-3.0.10-1.fc2
samba-3.0.10-1.fc2
samba-client-3.0.10-1.fc2
Any advice or thoughts would be much appreciated.
- --
John Zakhar <jzakhar@ventusnetworks.com>
Systems Administrator.
Ventus Networks
800 Connecticut Ave
Norwalk, CT. 06854
Work 1-(203)-642-2800
Home 1-(860)-318-0276
Cell 1-(203)-257-4165
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
iD8DBQFCNZ5FY1bWd3KJkG4RAiW2AJ9l2nP7ZNZFhheq5XLYXvGCoB/LZQCbBxX+
rhyePWCJoGCeBLDwEvNM6NY=nZRk
-----END PGP SIGNATURE-----
-------------- next part --------------
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 00 00 00 00 64 00 00 C0 .....d.. .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,116)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,116) wrote 116
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 33 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2048
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29396 (0x72D4)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 06 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 01 00 00 00 00 00 05 00 00 ........ ........
[030] 00 00 00 00 00 5F BA 31 42 8F 78 00 00 ....._.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "samr" (pnum 72d4)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x84709e8 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d4 name: samr open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0,
incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16,
receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0,
incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000006
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28,
incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0xcd2770
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000005
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5f ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 05 00 00 00 00 00 00 00 5F BA 31 42
........ ...._.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(365)
samr_reply_close_hnd: 365
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d4 name: samr len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0,
prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000006
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2048
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 34 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2112
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29396 (0x72D4)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 07 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 01 00 00 00 00 00 04 00 00 ........ ........
[030] 00 00 00 00 00 5F BA 31 42 8F 78 00 00 ....._.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "samr" (pnum 72d4)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x84709e8 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d4 name: samr open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0,
incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16,
receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0,
incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000007
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28,
incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0xcd2770
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000004
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5f ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 5F BA 31 42
........ ...._.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(365)
samr_reply_close_hnd: 365
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d4 name: samr len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0,
prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000007
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2112
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 35 of length 45
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2176
smt_wct=3
smb_vwv[ 0]=29396 (0x72D4)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d4
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=72d4 (pipes_open=2)
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=2)
[2005/03/11 10:33:52, 5] smbd/pipes.c:reply_pipe_close(258)
reply_pipe_close: pnum:72d4
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=72d4 (pipes_open=1)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2176
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 128
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x80
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 36 of length 132
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2240
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 1024 (0x400)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 84 (0x54)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 84 (0x54)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29393 (0x72D1)
smb_bcc=61
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\....
[010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 ........ .,......
[020] 00 14 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........
[030] 00 00 00 00 00 5E BA 31 42 8F 78 00 00 .....^.1 B.x..
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 3] smbd/ipc.c:reply_trans(538)
trans <\PIPE\> data=44 params=0 setup=2
[2005/03/11 10:33:52, 5] smbd/ipc.c:reply_trans(557)
calling named_pipe
[2005/03/11 10:33:52, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2005/03/11 10:33:52, 5] smbd/ipc.c:api_fd_reply(267)
api_fd_reply
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d1
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=1)
[2005/03/11 10:33:52, 3] smbd/ipc.c:api_fd_reply(296)
Got API command 0x26 on pipe "lsarpc" (pnum 72d1)
[2005/03/11 10:33:52, 10] smbd/ipc.c:api_fd_reply(301)
api_fd_reply: p:0x8470b88 max_trans_reply: 1024
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 72d1 name: lsarpc open: Yes len: 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0,
incoming data = 44
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16,
receive_len = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0,
incoming data = 28
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000004
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28,
incoming data = 28
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0000
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\lsarpc
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[4].fn == 0xca1fb0
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 lsa_io_q_close
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000001
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 5e ba 31 42 8f 78 00 00
[2005/03/11 10:33:52, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5E BA 31 42
........ ....^.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5E BA 31 42
........ ....^.1B
[010] 8F 78 00 00 .x..
[2005/03/11 10:33:52, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 lsa_io_r_close
[2005/03/11 10:33:52, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OK
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called lsarpc successfully
[2005/03/11 10:33:52, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2005/03/11 10:33:52, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 72d1 name: lsarpc len: 1024
[2005/03/11 10:33:52, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0,
prs_offset(&p->out_data.rdata) = 24.
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0030
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000004
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000018
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2005/03/11 10:33:52, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2005/03/11 10:33:52, 5] smbd/ipc.c:copy_trans_params_and_data(62)
copy_trans_params_and_data: params[0..0] data[0..48]
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=916
smb_uid=100
smb_mid=2240
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 48 (0x30)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 48 (0x30)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=49
[2005/03/11 10:33:52, 10] lib/util.c:dump_data(1999)
[000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 .
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,108)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,108) wrote 108
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 37 of length 45
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2304
smt_wct=3
smb_vwv[ 0]=29393 (0x72D1)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=72d1
[2005/03/11 10:33:52, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name lsarpc pnum=72d1 (pipes_open=1)
[2005/03/11 10:33:52, 5] smbd/pipes.c:reply_pipe_close(258)
reply_pipe_close: pnum:72d1
[2005/03/11 10:33:52, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe lsarpc
[2005/03/11 10:33:52, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name lsarpc pnum=72d1 (pipes_open=0)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2304
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 39
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x27
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 38 of length 43
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=39
smb_com=0x74
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=2368
smt_wct=2
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBulogoffX (pid 30863) conn 0x0
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 5] auth/auth_util.c:free_server_info(1344)
attempting to free (and zero) a server_info structure
[2005/03/11 10:33:52, 3] smbd/reply.c:reply_ulogoffX(1249)
ulogoffX vuid=100
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=39
smb_com=0x74
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=2368
smt_wct=2
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,43)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,43) wrote 43
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 35
[2005/03/11 10:33:52, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x23
[2005/03/11 10:33:52, 3] smbd/process.c:process_smb(1091)
Transaction 39 of length 39
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2432
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 3] smbd/process.c:switch_message(886)
switch message SMBtdis (pid 30863) conn 0x8473898
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 3] smbd/service.c:close_cnum(836)
ibm-zus90725eca (172.28.0.64) closed connection to service IPC$
[2005/03/11 10:33:52, 3] smbd/connection.c:yield_connection(69)
Yielding connection to IPC$
[2005/03/11 10:33:52, 4] smbd/vfs.c:vfs_ChDir(654)
vfs_ChDir to /
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(486)
[2005/03/11 10:33:52, 5] lib/util.c:show_msg(496)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=2432
smt_wct=0
smb_bcc=0
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(449)
write_socket(5,39)
[2005/03/11 10:33:52, 6] lib/util_sock.c:write_socket(452)
write_socket(5,39) wrote 39
[2005/03/11 10:33:52, 10] lib/util_sock.c:read_socket_data(378)
read_socket_data: recv of 4 returned 0. Error = Success
[2005/03/11 10:33:52, 10] lib/util_sock.c:receive_smb_raw(556)
receive_smb_raw: length < 0!
[2005/03/11 10:33:52, 3] smbd/process.c:timeout_processing(1336)
timeout_processing: End of file from client (client has disconnected).
[2005/03/11 10:33:52, 5] lib/gencache.c:gencache_shutdown(88)
Closing cache file
[2005/03/11 10:33:52, 5] libsmb/namecache.c:namecache_shutdown(79)
namecache_shutdown: netbios namecache closed successfully.
[2005/03/11 10:33:52, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/03/11 10:33:52, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/03/11 10:33:52, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/03/11 10:33:52, 2] smbd/server.c:exit_server(571)
Closing connections
[2005/03/11 10:33:52, 3] smbd/connection.c:yield_connection(69)
Yielding connection to
[2005/03/11 10:33:52, 5] smbd/oplock.c:receive_local_message(107)
receive_local_message: doing select with timeout of 1 ms
[2005/03/11 10:33:52, 3] smbd/server.c:exit_server(614)
Server exit (normal exit)
On Monday 14 March 2005 07:23, John Zakhar wrote:> Good Morning Folks. > > I have a reoccurring error here when trying to join a Windows XP SP2 > workstation to a Samba domain (accounts stored in LDAP) The error is > "The user name cannot be found" > > Our LDAP directory looks like this > > dc=na > ~ o=ourdomain > ~ ou=Groups > ~ ou=Staff > ~ ou=ComputersWith this directory configuration the /etc/ldap.conf file needs to have: nss_base_passwd: o=ourdomain,dc=na?sub - John T.> > My problem at the moment is all the windows clients are using pGina to > login to the windows workstations, > and modifying the LDAP directories is really less than desirable as we > have several fail over servers (replication etc..) > Mail and all user SSH logins depend on that structure. It would be a > VERY large task on my part to change the structure, > however I need a solution as pGina is no longer something we can > continue to use. pam_ldap along with nsswitch is in place and working > just fine for ldap > > The user accounts are all stored in ou=Staff, and during the joining > process the machine account is created in ou=Computers via the IDEALX > smbldap scripts. > According to the trace I am sending with this email the root user is > round and authorized so what gives ? This Winblows machine was patched > to current yesterday. > > Samba versions: > > [root@vnpdc01 root]# rpm -qa |grep samba > samba-common-3.0.10-1.fc2 > samba-3.0.10-1.fc2 > samba-client-3.0.10-1.fc2 > > Any advice or thoughts would be much appreciated.-- John H Terpstra Samba-Team Member Phone: +1 (650) 580-8668 Author: The Official Samba-3 HOWTO & Reference Guide, ISBN: 0131453556 Samba-3 by Example, ISBN: 0131472216 Hardening Linux, ISBN: 0072254971 Other books in production.
On Mon, 2005-03-14 at 08:48 -0700, John H Terpstra wrote:> On Monday 14 March 2005 07:23, John Zakhar wrote: > > Good Morning Folks. > > > > I have a reoccurring error here when trying to join a Windows XP SP2 > > workstation to a Samba domain (accounts stored in LDAP) The error is > > "The user name cannot be found" > > > > Our LDAP directory looks like this > > > > dc=na > > ~ o=ourdomain > > ~ ou=Groups > > ~ ou=Staff > > ~ ou=Computers > > With this directory configuration the /etc/ldap.conf file needs to have: > > nss_base_passwd: o=ourdomain,dc=na?sub---- of course with this setup, samba would query the entire DSA for everything which might not be the most effective use of LDAP. Suggest that you consider... dc=na o=ourdomain ou=Accounts ou=Staff ou=Computer ou=Groups ou=Hosts ou=etc... and thus, padl stuff would be like... nss_base_passwd: ou=Accounts,o=ourdomain,dc=na?sub nss_base_shadow ou=Accounts,o=ourdomain,dc=na?sub nss_base_group ou=Groups,o=ourdomain,dc=na?one nss_base_hosts ou=Hosts,o=ourdomain,dc=na?one etc... This way, you can set the search base for your MTA/IMAP/etc. to only search the actual posix users... ou=Staff,ou=Accounts,o=ourdomain,dc=na and lastly - perhaps this was unintentional... dc = domain component...typical usage would be dc=domain_name,dc=tld o = organization & c = country...typical usage would be o=organization,c=US Craig
John Zakhar wrote:> Craig White wrote: > >> On Mon, 2005-03-14 at 08:48 -0700, John H Terpstra wrote: >> >> >>> On Monday 14 March 2005 07:23, John Zakhar wrote: >>> >>> >>>> Good Morning Folks. >>>> >>>> I have a reoccurring error here when trying to join a Windows XP SP2 >>>> workstation to a Samba domain (accounts stored in LDAP) The error is >>>> "The user name cannot be found" >>>> >>>> Our LDAP directory looks like this >>>> >>>> dc=na >>>> ~ o=ourdomain >>>> ~ ou=Groups >>>> ~ ou=Staff >>>> ~ ou=Computers >>>> >>> >>> With this directory configuration the /etc/ldap.conf file needs to >>> have: >>> >>> nss_base_passwd: o=ourdomain,dc=na?sub >>> >> >> ---- >> of course with this setup, samba would query the entire DSA for >> everything which might not be the most effective use of LDAP. >> >> Suggest that you consider... >> >> dc=na >> o=ourdomain >> ou=Accounts >> ou=Staff >> ou=Computer >> ou=Groups >> ou=Hosts >> ou=etc... >> >> and thus, padl stuff would be like... >> nss_base_passwd: ou=Accounts,o=ourdomain,dc=na?sub >> nss_base_shadow ou=Accounts,o=ourdomain,dc=na?sub >> nss_base_group ou=Groups,o=ourdomain,dc=na?one >> nss_base_hosts ou=Hosts,o=ourdomain,dc=na?one >> >> etc... >> >> This way, you can set the search base for your MTA/IMAP/etc. to only >> search the actual posix users... >> ou=Staff,ou=Accounts,o=ourdomain,dc=na >> >> and lastly - perhaps this was unintentional... >> >> dc = domain component...typical usage would be dc=domain_name,dc=tld >> o = organization & c = country...typical usage would be >> o=organization,c=US >> >> Craig >> >> >> > Craig, > > I fully agree that with your suggestions on the LDAP directory > structure, however I came to this company after it was already created > and in use for quite some time. We have servers using this structure > that I do not control via dedicated WAN links into us. It would be > quite the project on my end as well as theirs to change these things.. > > I am very familiar with LDAP naming standards (oh which the former > admin decided to not follow) but again it is just not with in my power > at the present time to change the structure. > > I did make the changes to /etc/ldap.conf as well as upgraded our > nss_ldap library and samba to 3.0.11-1, I longer get the user cannot > be found error, I am now stuck at permission denied when trying to > join up a fully patched XP machine to the samba DC with the root > account (which exista in LDAP). > > This is actually sad as I use this same setup at home and it works > great (minus the ridiculous LDAP directory structure). I have attached > another trace from the machine trying to join up, I have about had it > here, I have never had so much trouble before with samba and LDAP, it > must be my luck I suppose =) > If anyone has any suggestions I am all ears (well eyes) and would much > appreciated.. > >------------------------------------------------------------------------ > > 000000 smb_io_rpc_hdr hdr >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000007 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/03/15 13:16:53, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=904 > smb_uid=100 > smb_mid=2112 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,108) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,108) wrote 108 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) > Transaction 35 of length 45 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2176 > smt_wct=3 > smb_vwv[ 0]=29525 (0x7355) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 7644) conn 0xa1bd770 >[2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7355 >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name samr pnum=7355 (pipes_open=2) >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name lsarpc pnum=7352 (pipes_open=2) >[2005/03/15 13:16:53, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7355 >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name samr pnum=7355 (pipes_open=1) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2176 > smt_wct=0 > smb_bcc=0 >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,39) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,39) wrote 39 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 128 >[2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x80 >[2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) > Transaction 36 of length 132 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=904 > smb_uid=100 > smb_mid=2240 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29522 (0x7352) > smb_bcc=61 >[2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ > [030] 00 00 00 00 00 8E 26 37 42 DC 1D 00 00 ......&7 B.... >[2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 7644) conn 0xa1bd770 >[2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/03/15 13:16:53, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=44 params=0 setup=2 >[2005/03/15 13:16:53, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/03/15 13:16:53, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/03/15 13:16:53, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7352 >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name lsarpc pnum=7352 (pipes_open=1) >[2005/03/15 13:16:53, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "lsarpc" (pnum 7352) >[2005/03/15 13:16:53, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:0xa1b9a88 max_trans_reply: 1024 >[2005/03/15 13:16:53, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7352 name: lsarpc open: Yes len: 44 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 28 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 002c >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000004 >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 28 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000014 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/03/15 13:16:53, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\lsarpc >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE >[2005/03/15 13:16:53, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[4].fn == 0x8111a60 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 lsa_io_q_close >[2005/03/15 13:16:53, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000001 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 8e 26 37 42 dc 1d 00 00 >[2005/03/15 13:16:53, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 8E 26 37 42 ........ .....&7B > [010] DC 1D 00 00 .... >[2005/03/15 13:16:53, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 8E 26 37 42 ........ .....&7B > [010] DC 1D 00 00 .... >[2005/03/15 13:16:53, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 lsa_io_r_close >[2005/03/15 13:16:53, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0014 status: NT_STATUS_OK >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called lsarpc successfully >[2005/03/15 13:16:53, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 28 >[2005/03/15 13:16:53, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7352 name: lsarpc len: 1024 >[2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000004 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/03/15 13:16:53, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=904 > smb_uid=100 > smb_mid=2240 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,108) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,108) wrote 108 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) > Transaction 37 of length 45 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2304 > smt_wct=3 > smb_vwv[ 0]=29522 (0x7352) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 7644) conn 0xa1bd770 >[2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7352 >[2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name lsarpc pnum=7352 (pipes_open=1) >[2005/03/15 13:16:53, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7352 >[2005/03/15 13:16:53, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe lsarpc >[2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name lsarpc pnum=7352 (pipes_open=0) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2304 > smt_wct=0 > smb_bcc=0 >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,39) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,39) wrote 39 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 39 >[2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x27 >[2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) > Transaction 38 of length 43 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=100 > smb_mid=2368 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) > switch message SMBulogoffX (pid 7644) conn 0x0 >[2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/03/15 13:16:53, 5] auth/auth_util.c:free_server_info(1374) > attempting to free (and zero) a server_info structure >[2005/03/15 13:16:53, 3] smbd/reply.c:reply_ulogoffX(1248) > ulogoffX vuid=100 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=100 > smb_mid=2368 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,43) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,43) wrote 43 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 35 >[2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x23 >[2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) > Transaction 39 of length 39 >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2432 > smt_wct=0 > smb_bcc=0 >[2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) > switch message SMBtdis (pid 7644) conn 0xa1bd770 >[2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/03/15 13:16:53, 3] smbd/service.c:close_cnum(833) > ibm-zus90725eca (172.28.0.64) closed connection to service IPC$ >[2005/03/15 13:16:53, 3] smbd/connection.c:yield_connection(69) > Yielding connection to IPC$ >[2005/03/15 13:16:53, 4] smbd/vfs.c:vfs_ChDir(657) > vfs_ChDir to / >[2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >[2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=2432 > smt_wct=0 > smb_bcc=0 >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) > write_socket(5,39) >[2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) > write_socket(5,39) wrote 39 >[2005/03/15 13:16:53, 10] lib/util_sock.c:read_socket_data(378) > read_socket_data: recv of 4 returned 0. Error = Success >[2005/03/15 13:16:53, 10] lib/util_sock.c:receive_smb_raw(556) > receive_smb_raw: length < 0! >[2005/03/15 13:16:53, 3] smbd/process.c:timeout_processing(1334) > timeout_processing: End of file from client (client has disconnected). >[2005/03/15 13:16:53, 5] lib/gencache.c:gencache_shutdown(88) > Closing cache file >[2005/03/15 13:16:53, 5] libsmb/namecache.c:namecache_shutdown(79) > namecache_shutdown: netbios namecache closed successfully. >[2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/03/15 13:16:53, 2] smbd/server.c:exit_server(609) > Closing connections >[2005/03/15 13:16:53, 3] smbd/connection.c:yield_connection(69) > Yielding connection to >[2005/03/15 13:16:53, 5] smbd/oplock.c:receive_local_message(107) > receive_local_message: doing select with timeout of 1 ms >[2005/03/15 13:16:53, 3] smbd/server.c:exit_server(652) > Server exit (normal exit) > >-- John Zakhar <jzakhar@ventusnetworks.com> Systems Administrator. Ventus Networks 800 Connecticut Ave Norwalk, CT. 06854 Work 1-(203)-642-2800 Home 1-(860)-318-0276 Cell 1-(203)-257-4165
John Zakhar wrote:> John Zakhar wrote: > >> Craig White wrote: >> >>> On Mon, 2005-03-14 at 08:48 -0700, John H Terpstra wrote: >>> >>> >>>> On Monday 14 March 2005 07:23, John Zakhar wrote: >>>> >>>> >>>>> Good Morning Folks. >>>>> >>>>> I have a reoccurring error here when trying to join a Windows XP SP2 >>>>> workstation to a Samba domain (accounts stored in LDAP) The error is >>>>> "The user name cannot be found" >>>>> >>>>> Our LDAP directory looks like this >>>>> >>>>> dc=na >>>>> ~ o=ourdomain >>>>> ~ ou=Groups >>>>> ~ ou=Staff >>>>> ~ ou=Computers >>>>> >>>> >>>> >>>> With this directory configuration the /etc/ldap.conf file needs to >>>> have: >>>> >>>> nss_base_passwd: o=ourdomain,dc=na?sub >>>> >>> >>> >>> ---- >>> of course with this setup, samba would query the entire DSA for >>> everything which might not be the most effective use of LDAP. >>> >>> Suggest that you consider... >>> >>> dc=na >>> o=ourdomain >>> ou=Accounts >>> ou=Staff >>> ou=Computer >>> ou=Groups >>> ou=Hosts >>> ou=etc... >>> >>> and thus, padl stuff would be like... >>> nss_base_passwd: ou=Accounts,o=ourdomain,dc=na?sub >>> nss_base_shadow ou=Accounts,o=ourdomain,dc=na?sub >>> nss_base_group ou=Groups,o=ourdomain,dc=na?one >>> nss_base_hosts ou=Hosts,o=ourdomain,dc=na?one >>> >>> etc... >>> >>> This way, you can set the search base for your MTA/IMAP/etc. to only >>> search the actual posix users... >>> ou=Staff,ou=Accounts,o=ourdomain,dc=na >>> >>> and lastly - perhaps this was unintentional... >>> >>> dc = domain component...typical usage would be dc=domain_name,dc=tld >>> o = organization & c = country...typical usage would be >>> o=organization,c=US >>> >>> Craig >>> >>> >>> >> Craig, >> >> I fully agree that with your suggestions on the LDAP directory >> structure, however I came to this company after it was already >> created and in use for quite some time. We have servers using this >> structure that I do not control via dedicated WAN links into us. It >> would be quite the project on my end as well as theirs to change >> these things.. >> >> I am very familiar with LDAP naming standards (oh which the former >> admin decided to not follow) but again it is just not with in my >> power at the present time to change the structure. >> >> I did make the changes to /etc/ldap.conf as well as upgraded our >> nss_ldap library and samba to 3.0.11-1, I longer get the user cannot >> be found error, I am now stuck at permission denied when trying to >> join up a fully patched XP machine to the samba DC with the root >> account (which exista in LDAP). >> >> This is actually sad as I use this same setup at home and it works >> great (minus the ridiculous LDAP directory structure). I have >> attached another trace from the machine trying to join up, I have >> about had it here, I have never had so much trouble before with samba >> and LDAP, it must be my luck I suppose =) >> If anyone has any suggestions I am all ears (well eyes) and would >> much appreciated.. >> >> ------------------------------------------------------------------------ >> >> 000000 smb_io_rpc_hdr hdr >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0000 major : 05 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0001 minor : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0002 pkt_type : 02 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0003 flags : 03 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0004 pack_type0: 10 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0005 pack_type1: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0006 pack_type2: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0007 pack_type3: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0008 frag_len : 0030 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 000a auth_len : 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 000c call_id : 00000007 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000010 smb_io_rpc_hdr_resp resp >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 0010 alloc_hint: 00000018 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0014 context_id: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0016 cancel_ct : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0017 reserved : 00 >> [2005/03/15 13:16:53, 5] smbd/ipc.c:copy_trans_params_and_data(60) >> copy_trans_params_and_data: params[0..0] data[0..48] >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=104 >> smb_com=0x25 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=1 >> smb_pid=904 >> smb_uid=100 >> smb_mid=2112 >> smt_wct=10 >> smb_vwv[ 0]= 0 (0x0) >> smb_vwv[ 1]= 48 (0x30) >> smb_vwv[ 2]= 0 (0x0) >> smb_vwv[ 3]= 0 (0x0) >> smb_vwv[ 4]= 56 (0x38) >> smb_vwv[ 5]= 0 (0x0) >> smb_vwv[ 6]= 48 (0x30) >> smb_vwv[ 7]= 56 (0x38) >> smb_vwv[ 8]= 0 (0x0) >> smb_vwv[ 9]= 0 (0x0) >> smb_bcc=49 >> [2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) >> [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 ........ >> .0...... >> [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ >> ........ >> [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ >> ........ >> [030] 00 . >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,108) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,108) wrote 108 >> [2005/03/15 13:16:53, 10] >> lib/util_sock.c:read_smb_length_return_keepalive(505) >> got smb length of 41 >> [2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) >> got message type 0x0 of len 0x29 >> [2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) >> Transaction 35 of length 45 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=41 >> smb_com=0x4 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=24 >> smb_flg2=51207 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2176 >> smt_wct=3 >> smb_vwv[ 0]=29525 (0x7355) >> smb_vwv[ 1]=65535 (0xFFFF) >> smb_vwv[ 2]=65535 (0xFFFF) >> smb_bcc=0 >> [2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) >> switch message SMBclose (pid 7644) conn 0xa1bd770 >> [2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) >> change_to_user: Skipping user change - already user >> [2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) >> search for pipe pnum=7355 >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) >> pipe name samr pnum=7355 (pipes_open=2) >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) >> pipe name lsarpc pnum=7352 (pipes_open=2) >> [2005/03/15 13:16:53, 5] smbd/pipes.c:reply_pipe_close(260) >> reply_pipe_close: pnum:7355 >> [2005/03/15 13:16:53, 4] >> rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) >> closed pipe name samr pnum=7355 (pipes_open=1) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=35 >> smb_com=0x4 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2176 >> smt_wct=0 >> smb_bcc=0 >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,39) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,39) wrote 39 >> [2005/03/15 13:16:53, 10] >> lib/util_sock.c:read_smb_length_return_keepalive(505) >> got smb length of 128 >> [2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) >> got message type 0x0 of len 0x80 >> [2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) >> Transaction 36 of length 132 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=128 >> smb_com=0x25 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=24 >> smb_flg2=51207 >> smb_tid=1 >> smb_pid=904 >> smb_uid=100 >> smb_mid=2240 >> smt_wct=16 >> smb_vwv[ 0]= 0 (0x0) >> smb_vwv[ 1]= 44 (0x2C) >> smb_vwv[ 2]= 0 (0x0) >> smb_vwv[ 3]= 1024 (0x400) >> smb_vwv[ 4]= 0 (0x0) >> smb_vwv[ 5]= 0 (0x0) >> smb_vwv[ 6]= 0 (0x0) >> smb_vwv[ 7]= 0 (0x0) >> smb_vwv[ 8]= 0 (0x0) >> smb_vwv[ 9]= 0 (0x0) >> smb_vwv[10]= 84 (0x54) >> smb_vwv[11]= 44 (0x2C) >> smb_vwv[12]= 84 (0x54) >> smb_vwv[13]= 2 (0x2) >> smb_vwv[14]= 38 (0x26) >> smb_vwv[15]=29522 (0x7352) >> smb_bcc=61 >> [2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) >> [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P >> .E.\.... >> [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 ........ >> .,...... >> [020] 00 14 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ >> ........ >> [030] 00 00 00 00 00 8E 26 37 42 DC 1D 00 00 ......&7 B.... >> [2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) >> switch message SMBtrans (pid 7644) conn 0xa1bd770 >> [2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) >> change_to_user: Skipping user change - already user >> [2005/03/15 13:16:53, 3] smbd/ipc.c:reply_trans(539) >> trans <\PIPE\> data=44 params=0 setup=2 >> [2005/03/15 13:16:53, 5] smbd/ipc.c:reply_trans(560) >> calling named_pipe >> [2005/03/15 13:16:53, 3] smbd/ipc.c:named_pipe(334) >> named pipe command on <> name >> [2005/03/15 13:16:53, 5] smbd/ipc.c:api_fd_reply(265) >> api_fd_reply >> [2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) >> search for pipe pnum=7352 >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) >> pipe name lsarpc pnum=7352 (pipes_open=1) >> [2005/03/15 13:16:53, 3] smbd/ipc.c:api_fd_reply(294) >> Got API command 0x26 on pipe "lsarpc" (pnum 7352) >> [2005/03/15 13:16:53, 10] smbd/ipc.c:api_fd_reply(299) >> api_fd_reply: p:0xa1b9a88 max_trans_reply: 1024 >> [2005/03/15 13:16:53, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) >> write_to_pipe: 7352 name: lsarpc open: Yes len: 44 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) >> write_to_pipe: data_left = 44 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:process_incoming_data(777) >> process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = >> 0, incoming data = 44 >> [2005/03/15 13:16:53, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) >> fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, >> receive_len = 0 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) >> write_to_pipe: data_used = 16 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) >> write_to_pipe: data_left = 28 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:process_incoming_data(777) >> process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len >> = 0, incoming data = 28 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000000 smb_io_rpc_hdr [2005/03/15 13:16:53, 5] >> rpc_parse/parse_prs.c:prs_uint8(584) >> 0000 major : 05 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0001 minor : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0002 pkt_type : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0003 flags : 03 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0004 pack_type0: 10 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0005 pack_type1: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0006 pack_type2: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0007 pack_type3: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0008 frag_len : 002c >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 000a auth_len : 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 000c call_id : 00000004 >> [2005/03/15 13:16:53, 5] >> rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) >> unmarshall_rpc_header: using little-endian RPC >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) >> unmarshall_rpc_header: type = 0, flags = 3 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) >> write_to_pipe: data_used = 0 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) >> write_to_pipe: data_left = 28 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:process_incoming_data(777) >> process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = >> 28, incoming data = 28 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) >> process_complete_pdu: processing packet type 0 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000000 smb_io_rpc_hdr_req req >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 0000 alloc_hint: 00000014 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0004 context_id: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0006 opnum : 0000 >> [2005/03/15 13:16:53, 3] >> rpc_server/srv_pipe_hnd.c:free_pipe_context(542) >> free_pipe_context: destroying talloc pool of size 0 >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) >> Requested \PIPE\lsarpc >> [2005/03/15 13:16:53, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) >> api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE >> [2005/03/15 13:16:53, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) >> api_rpc_cmds[4].fn == 0x8111a60 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000000 lsa_io_q_close [2005/03/15 13:16:53, 6] >> rpc_parse/parse_prs.c:prs_debug(82) >> 000000 smb_io_pol_hnd [2005/03/15 13:16:53, 5] >> rpc_parse/parse_prs.c:prs_uint32(642) >> 0000 data1: 00000000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 0004 data2: 00000001 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0008 data3: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 000a data4: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8s(729) >> 000c data5: 8e 26 37 42 dc 1d 00 00 [2005/03/15 13:16:53, 4] >> rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) >> Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 8E 26 >> 37 42 ........ .....&7B >> [010] DC 1D 00 00 .... >> [2005/03/15 13:16:53, 4] >> rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) >> Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 8E 26 >> 37 42 ........ .....&7B >> [010] DC 1D 00 00 .... >> [2005/03/15 13:16:53, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) >> Closed policy >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000000 lsa_io_r_close [2005/03/15 13:16:53, 6] >> rpc_parse/parse_prs.c:prs_debug(82) >> 000000 smb_io_pol_hnd [2005/03/15 13:16:53, 5] >> rpc_parse/parse_prs.c:prs_uint32(642) >> 0000 data1: 00000000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 0004 data2: 00000000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0008 data3: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 000a data4: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8s(729) >> 000c data5: 00 00 00 00 00 00 00 00 [2005/03/15 13:16:53, 5] >> rpc_parse/parse_prs.c:prs_ntstatus(672) >> 0014 status: NT_STATUS_OK >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) >> api_rpcTNP: called lsarpc successfully >> [2005/03/15 13:16:53, 3] >> rpc_server/srv_pipe_hnd.c:free_pipe_context(542) >> free_pipe_context: destroying talloc pool of size 0 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) >> write_to_pipe: data_used = 28 >> [2005/03/15 13:16:53, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) >> read_from_pipe: 7352 name: lsarpc len: 1024 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) >> read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, >> prs_offset(&p->out_data.rdata) = 24. >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000000 smb_io_rpc_hdr hdr >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0000 major : 05 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0001 minor : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0002 pkt_type : 02 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0003 flags : 03 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0004 pack_type0: 10 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0005 pack_type1: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0006 pack_type2: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0007 pack_type3: 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0008 frag_len : 0030 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 000a auth_len : 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 000c call_id : 00000004 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_debug(82) >> 000010 smb_io_rpc_hdr_resp resp >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint32(642) >> 0010 alloc_hint: 00000018 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint16(613) >> 0014 context_id: 0000 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0016 cancel_ct : 00 >> [2005/03/15 13:16:53, 5] rpc_parse/parse_prs.c:prs_uint8(584) >> 0017 reserved : 00 >> [2005/03/15 13:16:53, 5] smbd/ipc.c:copy_trans_params_and_data(60) >> copy_trans_params_and_data: params[0..0] data[0..48] >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=104 >> smb_com=0x25 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=1 >> smb_pid=904 >> smb_uid=100 >> smb_mid=2240 >> smt_wct=10 >> smb_vwv[ 0]= 0 (0x0) >> smb_vwv[ 1]= 48 (0x30) >> smb_vwv[ 2]= 0 (0x0) >> smb_vwv[ 3]= 0 (0x0) >> smb_vwv[ 4]= 56 (0x38) >> smb_vwv[ 5]= 0 (0x0) >> smb_vwv[ 6]= 48 (0x30) >> smb_vwv[ 7]= 56 (0x38) >> smb_vwv[ 8]= 0 (0x0) >> smb_vwv[ 9]= 0 (0x0) >> smb_bcc=49 >> [2005/03/15 13:16:53, 10] lib/util.c:dump_data(1990) >> [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ >> .0...... >> [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ >> ........ >> [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ >> ........ >> [030] 00 . >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,108) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,108) wrote 108 >> [2005/03/15 13:16:53, 10] >> lib/util_sock.c:read_smb_length_return_keepalive(505) >> got smb length of 41 >> [2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) >> got message type 0x0 of len 0x29 >> [2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) >> Transaction 37 of length 45 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=41 >> smb_com=0x4 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=24 >> smb_flg2=51207 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2304 >> smt_wct=3 >> smb_vwv[ 0]=29522 (0x7352) >> smb_vwv[ 1]=65535 (0xFFFF) >> smb_vwv[ 2]=65535 (0xFFFF) >> smb_bcc=0 >> [2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) >> switch message SMBclose (pid 7644) conn 0xa1bd770 >> [2005/03/15 13:16:53, 4] smbd/uid.c:change_to_user(194) >> change_to_user: Skipping user change - already user >> [2005/03/15 13:16:53, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) >> search for pipe pnum=7352 >> [2005/03/15 13:16:53, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) >> pipe name lsarpc pnum=7352 (pipes_open=1) >> [2005/03/15 13:16:53, 5] smbd/pipes.c:reply_pipe_close(260) >> reply_pipe_close: pnum:7352 >> [2005/03/15 13:16:53, 10] >> rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) >> close_policy_by_pipe: deleted handle list for pipe lsarpc >> [2005/03/15 13:16:53, 4] >> rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) >> closed pipe name lsarpc pnum=7352 (pipes_open=0) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=35 >> smb_com=0x4 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2304 >> smt_wct=0 >> smb_bcc=0 >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,39) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,39) wrote 39 >> [2005/03/15 13:16:53, 10] >> lib/util_sock.c:read_smb_length_return_keepalive(505) >> got smb length of 39 >> [2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) >> got message type 0x0 of len 0x27 >> [2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) >> Transaction 38 of length 43 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=39 >> smb_com=0x74 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=24 >> smb_flg2=51207 >> smb_tid=0 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2368 >> smt_wct=2 >> smb_vwv[ 0]= 255 (0xFF) >> smb_vwv[ 1]= 0 (0x0) >> smb_bcc=0 >> [2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) >> switch message SMBulogoffX (pid 7644) conn 0x0 >> [2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) >> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) >> NT user token: (NULL) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) >> UNIX token of user 0 >> Primary group is 0 and contains 0 supplementary groups >> [2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) >> change_to_root_user: now uid=(0,0) gid=(0,0) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:free_server_info(1374) >> attempting to free (and zero) a server_info structure >> [2005/03/15 13:16:53, 3] smbd/reply.c:reply_ulogoffX(1248) >> ulogoffX vuid=100 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=39 >> smb_com=0x74 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=0 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2368 >> smt_wct=2 >> smb_vwv[ 0]= 255 (0xFF) >> smb_vwv[ 1]= 0 (0x0) >> smb_bcc=0 >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,43) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,43) wrote 43 >> [2005/03/15 13:16:53, 10] >> lib/util_sock.c:read_smb_length_return_keepalive(505) >> got smb length of 35 >> [2005/03/15 13:16:53, 6] smbd/process.c:process_smb(1090) >> got message type 0x0 of len 0x23 >> [2005/03/15 13:16:53, 3] smbd/process.c:process_smb(1091) >> Transaction 39 of length 39 >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=35 >> smb_com=0x71 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=24 >> smb_flg2=51207 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2432 >> smt_wct=0 >> smb_bcc=0 >> [2005/03/15 13:16:53, 3] smbd/process.c:switch_message(886) >> switch message SMBtdis (pid 7644) conn 0xa1bd770 >> [2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) >> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) >> NT user token: (NULL) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) >> UNIX token of user 0 >> Primary group is 0 and contains 0 supplementary groups >> [2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) >> change_to_root_user: now uid=(0,0) gid=(0,0) >> [2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) >> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) >> NT user token: (NULL) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) >> UNIX token of user 0 >> Primary group is 0 and contains 0 supplementary groups >> [2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) >> change_to_root_user: now uid=(0,0) gid=(0,0) >> [2005/03/15 13:16:53, 3] smbd/service.c:close_cnum(833) >> ibm-zus90725eca (172.28.0.64) closed connection to service IPC$ >> [2005/03/15 13:16:53, 3] smbd/connection.c:yield_connection(69) >> Yielding connection to IPC$ >> [2005/03/15 13:16:53, 4] smbd/vfs.c:vfs_ChDir(657) >> vfs_ChDir to / >> [2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) >> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) >> NT user token: (NULL) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) >> UNIX token of user 0 >> Primary group is 0 and contains 0 supplementary groups >> [2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) >> change_to_root_user: now uid=(0,0) gid=(0,0) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(464) >> [2005/03/15 13:16:53, 5] lib/util.c:show_msg(474) >> size=35 >> smb_com=0x71 >> smb_rcls=0 >> smb_reh=0 >> smb_err=0 >> smb_flg=136 >> smb_flg2=51201 >> smb_tid=1 >> smb_pid=65279 >> smb_uid=100 >> smb_mid=2432 >> smt_wct=0 >> smb_bcc=0 >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(449) >> write_socket(5,39) >> [2005/03/15 13:16:53, 6] lib/util_sock.c:write_socket(452) >> write_socket(5,39) wrote 39 >> [2005/03/15 13:16:53, 10] lib/util_sock.c:read_socket_data(378) >> read_socket_data: recv of 4 returned 0. Error = Success >> [2005/03/15 13:16:53, 10] lib/util_sock.c:receive_smb_raw(556) >> receive_smb_raw: length < 0! >> [2005/03/15 13:16:53, 3] smbd/process.c:timeout_processing(1334) >> timeout_processing: End of file from client (client has disconnected). >> [2005/03/15 13:16:53, 5] lib/gencache.c:gencache_shutdown(88) >> Closing cache file >> [2005/03/15 13:16:53, 5] libsmb/namecache.c:namecache_shutdown(79) >> namecache_shutdown: netbios namecache closed successfully. >> [2005/03/15 13:16:53, 3] smbd/sec_ctx.c:set_sec_ctx(288) >> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_nt_user_token(486) >> NT user token: (NULL) >> [2005/03/15 13:16:53, 5] auth/auth_util.c:debug_unix_user_token(507) >> UNIX token of user 0 >> Primary group is 0 and contains 0 supplementary groups >> [2005/03/15 13:16:53, 5] smbd/uid.c:change_to_root_user(296) >> change_to_root_user: now uid=(0,0) gid=(0,0) >> [2005/03/15 13:16:53, 2] smbd/server.c:exit_server(609) >> Closing connections >> [2005/03/15 13:16:53, 3] smbd/connection.c:yield_connection(69) >> Yielding connection to [2005/03/15 13:16:53, 5] >> smbd/oplock.c:receive_local_message(107) >> receive_local_message: doing select with timeout of 1 ms >> [2005/03/15 13:16:53, 3] smbd/server.c:exit_server(652) >> Server exit (normal exit) >> >> > >One more thing I managed to find here was this in my logs when trying to join a machine Mar 15 15:44:28 vnpdc01 net: [2005/03/15 15:44:28, 0] utils/net_ads.c:ads_startup(186) Mar 15 15:44:28 vnpdc01 net: ads_connect: Transport endpoint is not connected Mar 15 15:44:28 vnpdc01 smbd[7930]: [2005/03/15 15:44:28, 0] rpc_server/srv_netlog_nt.c:get_md4pw(261) Mar 15 15:44:28 vnpdc01 smbd[7930]: get_md4pw: Workstation xxxxxx$: no account in domain The machine exists in the LDAP directory, however looking closer the sambaSamAccount objectclass is not getting added during the entry, and with that the SambaAcctFlags and all the other entries are missing, So I think I may have found my problem. I am going to have a look at the IDEALX scripts I am using (not sure if they are the most current or not). I really hope this is the problem, I am tried of screwing with this my todo list gets longer and longer every day =) -- John Zakhar <jzakhar@ventusnetworks.com> Systems Administrator. Ventus Networks 800 Connecticut Ave Norwalk, CT. 06854 Work 1-(203)-642-2800 Home 1-(860)-318-0276 Cell 1-(203)-257-4165