samba - Oct 2005 - Samba + LDAP + TLS

Hi!

I'm a bit new to Samba+LDAP integration, and most likely because of that 
I experienced this morning something I can't fully understand. I would 
appreciate if someone could explain to me what was really wrong.

So, our name server was unavailable this morning due to OS update. 
Division's Samba and LDAP services are running on same server, and Samba 
is using TLS in connecting to LDAP service. Because some of the network 
names were not resolvable, I changed "passdb backend = 
ldapsam:ldap://ldap.server.name/" to "passdb backend = 
ldapsam:ldap://127.0.0.1/" in smb.conf, although I have ldap.server.name 
also in /etc/hosts, just in case. In file /etc/nsswitch.conf  I have 
line "hosts:      files dns". After I restarted Samba, I just
couldn't
login to domain anymore either with any machine or domain user accounts. 
Samba gave me errors like

smbd[1956]: [2005/10/24 11:03:17, 0] 
lib/smbldap.c:smbldap_open_connection(677)
smbd[1956]:   Failed to issue the StartTLS instruction: Connect error
smbd[1956]: [2005/10/24 11:03:17, 1] lib/smbldap.c:another_ldap_try(1011)
smbd[1956]:   Connection to LDAP server failed for the 1 try!
smbd[1956]: [2005/10/24 11:03:18, 2] 
passdb/pdb_ldap.c:init_sam_from_ldap(499)
smbd[1956]:   init_sam_from_ldap: Entry found for user: myusr
smbd[1956]: [2005/10/24 11:03:18, 1] 
passdb/pdb_ldap.c:init_sam_from_ldap(553)
smbd[1956]:   init_sam_from_ldap: no sambaSID or sambaSID attribute 
found for this user myusr
smbd[1956]: [2005/10/24 11:03:18, 1] 
passdb/pdb_ldap.c:ldapsam_getsampwnam(1346)
smbd[1956]:   ldapsam_getsampwnam: init_sam_from_ldap failed for user 
'myusr'!
smbd[1956]: [2005/10/24 11:03:18, 2] auth/auth.c:check_ntlm_password(312)
smbd[1956]:   check_ntlm_password:  Authentication for user [myusr] -> 
[myusr] FAILED with error NT_STATUS_NO_SUCH_USER

so I assume that this issue was somehow related to changes I made in 
smb.conf file. At the same time I could login to server using ssh, and 
also e,g, command "smbclient -L ldap.server.name -U myusr" gave me
list
of all available services. Also I could authenticate myself through 
Apache, which also uses TLS to connect to LDAP server.

My question is, how changing "passdb backend" from ldap.server,name to
127.0.0.1 can have this effect, since the server name should have been 
resolvable with /etc/hosts file? Does it has something to do with my 
certificate files, which are generated using ldap.server.name? However, 
I was able to login with TLS and Apache, so I don't think that's the
case.

Thanks in advance,
Jukka Hienola

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jukka Hienola wrote:

| So, our name server was unavailable this morning due
| to OS update. Division's Samba and LDAP services are
| running on same server, and Samba  is using TLS in
| connecting to LDAP service. Because some of the network
| names were not resolvable, I changed "passdb backend |
ldapsam:ldap://ldap.server.name/" to "passdb backend |
ldapsam:ldap://127.0.0.1/" in smb.conf, although I have
| ldap.server.name  also in /etc/hosts, just in case. In
| file /etc/nsswitch.conf  I have line "hosts:      files dns".
| After I restarted Samba, I just couldn't login to
| domain anymore either with any machine or domain user accounts.
| Samba gave me errors like
|
| smbd[1956]: [2005/10/24 11:03:17, 0]
| lib/smbldap.c:smbldap_open_connection(677)
| smbd[1956]:   Failed to issue the StartTLS instruction: Connect error

My immediate guess would be that the conect failed due to
a mismatch in the server name's cert.  Make sure you can
run 'ldapsearch -ZZ -h 127.0.0.1 ...'









cheers, jerry
====================================================================Alleviating
the pain of Windows(tm)      ------- http://www.samba.org
GnuPG Key                ----- http://www.plainjoe.org/gpg_public.asc
"There's an anonymous coward in all of us."              
--anonymous
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDXNlMIR7qMdg1EfYRAoiOAKDRMkCzkiI6/0m+rkGSd67q+e65pACg5Lre
V6QHbrkidy2wUxlBuou3+OE=6G47
-----END PGP SIGNATURE-----

On 10/24/05, Jukka Hienola <jukka.hienola@helsinki.fi>
wrote:
> My question is, how changing "passdb backend" from
ldap.server,name to
> 127.0.0.1 can have this effect, since the server name should have been
> resolvable with /etc/hosts file? Does it has something to do with my
> certificate files, which are generated using ldap.server.name? However,
> I was able to login with TLS and Apache, so I don't think that's
the case.
Some LDAP clients are more or less forgiving of certificate name
mismatches.  OpenLDAP 2.0.27 will work if the name mismatches;
OpenLDAP 2.2.23 won't; IIRC, pam_ldap won't, even if linked against
OpenLDAP 2.0.27 libraries.  So that may explain why some software
works and some doesn't.

Josh Kelley