Stef Bezuidenhout
2005-Oct-03 06:18 UTC
[Samba] Authentication stops working after approx 5 mins -getent passwd fixes it for 5-10 mins
Hi,
I'm running Redhat Enterprise WS 4. with kernel 2.6.9-11. Also I have the
following:
[root@itbsjb1 samba]# rpm -qa |grep samba
system-config-samba-1.2.21-1
samba-common-3.0.10-1.4E
samba-swat-3.0.10-1.4E
samba-3.0.10-1.4E
samba-client-3.0.10-1.4E
smb.conf:
[root@itbsjb1 samba]# cat smb.conf
# Samba config file created using SWAT
# from 127.0.0.1 (127.0.0.1)
# Date: 2005/09/30 15:27:17
# Global parameters
[global]
workgroup = PCM
realm = PCM.PUK.AC.ZA
server string = ITBSJB se SAMBA
security = ADS
password server = dc1-nt.pcm.puk.ac.za db-win1.pcm.puk.ac.za
log file = /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
dns proxy = No
ldap ssl = no
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
winbind separator = +
cups options = raw
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
browseable = No
[Cabinet]
path = /mnt/usb/Cabinet
valid users = PCM+itbsjb, PCM+admin
#valid users = @PCM+Domain Admins
write list = PCM+admin, PCM+itbsjb
#write list = @PCM+Domain Admins
read only = No
nsswitch.conf looks like this:
[root@itbsjb1 etc]# cat nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# nisplus or nis+ Use NIS+ (NIS version 3)
# nis or yp Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the db in front of files for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files winbind
shadow: files
group: files winbind
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: nisplus
automount: files
aliases: files nisplus
My problem is that I can log in from my Active Directory to the Cabinet share
using the itbsjb and admin account. This works for a while (appros 5-10 mins)
and then stops working. Any login from any remote machine just fails
authentication.
In the winbind.log I find:
[2005/09/30 15:32:50, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(161)
user 'admin' does not exist
[2005/09/30 15:32:50, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(161)
user 'ADMIN' does not exist
In the remotehost's log I get:
[2005/09/30 15:29:17, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
[2005/09/30 15:32:48, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
[2005/09/30 15:32:50, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
However, If I run the getent passwd command it lists local and domain users like
this:
[root@itbsjb1 samba]# getent passwd |grep admin
PCM+it3admin:*:16777220:16777216:it3admin:/home/PCM/it3admin:/bin/false
PCM+avadmin:*:16777232:16777216:avadmin:/home/PCM/avadmin:/bin/false
PCM+admin:*:16777370:16777216:Admin:/home/PCM/admin:/bin/false
Once I run the getent authentication starts working again and I can login for 5
or 10 mins before it stops working again. Rerunning the getent passwd command
fixes it time and time again, but only temporarely.
The Active directory is very big with thousends of users. My thoughts are that
the query works as long as its in the cache. Upon expiry it tries to auth from
ad but times out causing a logon failure. The getent command places the account
in the cache which causes it to work again till it expires once again.
Anybody ideas to a permanent fix someone?
Regards
Stef Bezuidenhout
Stef Bezuidenhout
2005-Oct-03 07:19 UTC
[Samba] Authentication stops working after approx 5 mins -getent passwd fixes it for 5-10 mins
Hi,
I'm running Redhat Enterprise WS 4. with kernel 2.6.9-11. Also I have the
following:
[root@itbsjb1 samba]# rpm -qa |grep samba
system-config-samba-1.2.21-1
samba-common-3.0.10-1.4E
samba-swat-3.0.10-1.4E
samba-3.0.10-1.4E
samba-client-3.0.10-1.4E
smb.conf:
[root@itbsjb1 samba]# cat smb.conf
# Samba config file created using SWAT
# from 127.0.0.1 (127.0.0.1)
# Date: 2005/09/30 15:27:17
# Global parameters
[global]
workgroup = PCM
realm = PCM.PUK.AC.ZA
server string = ITBSJB se SAMBA
security = ADS
password server = dc1-nt.pcm.puk.ac.za db-win1.pcm.puk.ac.za
log file = /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
dns proxy = No
ldap ssl = no
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
winbind separator = +
cups options = raw
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
browseable = No
[Cabinet]
path = /mnt/usb/Cabinet
valid users = PCM+itbsjb, PCM+admin
#valid users = @PCM+Domain Admins
write list = PCM+admin, PCM+itbsjb
#write list = @PCM+Domain Admins
read only = No
nsswitch.conf looks like this:
[root@itbsjb1 etc]# cat nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# nisplus or nis+ Use NIS+ (NIS version 3)
# nis or yp Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the db in front of files for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files winbind
shadow: files
group: files winbind
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: nisplus
automount: files
aliases: files nisplus
My problem is that I can log in from my Active Directory to the Cabinet
share using the itbsjb and admin account. This works for a while (appros
5-10 mins) and then stops working. Any login from any remote machine just
fails authentication.
In the winbind.log I find:
[2005/09/30 15:32:50, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(161)
user 'admin' does not exist
[2005/09/30 15:32:50, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(161)
user 'ADMIN' does not exist
In the remotehost's log I get:
[2005/09/30 15:29:17, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
[2005/09/30 15:32:48, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
[2005/09/30 15:32:50, 0] auth/auth_util.c:make_server_info_info3(1134)
make_server_info_info3: pdb_init_sam failed!
However, If I run the getent passwd command it lists local and domain users
like this:
[root@itbsjb1 samba]# getent passwd |grep admin
PCM+it3admin:*:16777220:16777216:it3admin:/home/PCM/it3admin:/bin/false
PCM+avadmin:*:16777232:16777216:avadmin:/home/PCM/avadmin:/bin/false
PCM+admin:*:16777370:16777216:Admin:/home/PCM/admin:/bin/false
Once I run the getent authentication starts working again and I can login
for 5 or 10 mins before it stops working again. Rerunning the getent passwd
command fixes it time and time again, but only temporarely.
The Active directory is very big with thousends of users. My thoughts are
that the query works as long as its in the cache. Upon expiry it tries to
auth from ad but times out causing a logon failure. The getent command
places the account in the cache which causes it to work again till it
expires once again.
Anybody ideas to a permanent fix someone?
Regards
Stef Bezuidenhout