Simon Kelly
2006-Aug-22 05:53 UTC
[Samba] 3.0.23 PDC with ldapsam:trusted backend - failed to setup guest info.
Hi everybody.
This is my first post here - Im hoping that someone out there can
shed some light on my little problem, it's starting to drive me
nuts! :)
Ive had a look through the archives as well as other methods for
finding a solution to my problem but to no avail, so I decided to
post here - hope you dont mind!
Im migrating an old samba 2.2 PDC to a new system running 3.0.23, we
have a requirement not to have local users on this new machine - no
problems says I , this will give me a chance to try out an ldapsam
backend with ldapsam:trusted.
I have populated the nobody and root user accounts (as well as some
test users) into LDAP but when I try to start samba, it fails with a
"ERROR: failed to setup guest info." error in log.smbd.
From what I have seen from a debug level 3 log (attached) of this
sequence, it binds to the LDAP directory, finds the root user, hits a
permission error (WERR_ACCESS_DENIED) along the way, starts to find
my nobody user (I see references to nobody's uid - 60001 - in the
log) and then bombs out. nmdb starts up but smbd doesnt come up (for
more than a second anyway, if at all)
Our directory already has the samba schemas installed and this
directory serves PDC requests for another of our domains (that has
local unix users defined) - so I am assuming that this is not a
schema issue. I am thinking that I have missed something rather
obvious along the way, as it is my first time attempting this, or i
have done something completely wrong fundamentally and digging myself
a deeper and deeper hole as I continue?!
Any help would be GREATLY appreciated :)
I have included copies of my log.smbd (debug level 3) , my smb.conf
and a dump of my root,nobody and nobody group ldap entries. If you
need any more information - just ask.
Thanks
Simon
(log.smbd)
[2006/08/22 11:44:58, 0] smbd/server.c:main(847)
smbd version 3.0.23 started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
Processing section "[homes]"
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
Processing section "[netlogon]"
[2006/08/22 11:44:58, 2] param/loadparm.c:do_section(3704)
Processing section "[Profiles]"
[2006/08/22 11:44:58, 3] param/loadparm.c:lp_add_ipc(2629)
adding IPC service
[2006/08/22 11:44:58, 3] printing/pcap.c:pcap_cache_reload(117)
reloading printcap cache
[2006/08/22 11:44:59, 3] printing/print_svid.c:sysv_cache_reload(72)
No Printers found!!!
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(223)
reload status: error
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(117)
reloading printcap cache
[2006/08/22 11:44:59, 3] printing/print_svid.c:sysv_cache_reload(72)
No Printers found!!!
[2006/08/22 11:44:59, 3] printing/pcap.c:pcap_cache_reload(223)
reload status: error
[2006/08/22 11:44:59, 2] lib/interface.c:add_interface(81)
added interface ip=130.95.72.10 bcast=130.95.72.255
nmask=255.255.255.0
[2006/08/22 11:44:59, 2] lib/interface.c:add_interface(81)
added interface ip=130.95.136.10 bcast=130.95.136.255
nmask=255.255.255.0
[2006/08/22 11:44:59, 3] smbd/server.c:main(877)
loaded services
[2006/08/22 11:44:59, 3] smbd/server.c:main(892)
Becoming a daemon.
[2006/08/22 11:44:59, 2] lib/tallocmsg.c:register_msg_pool_usage(61)
Registered MSG_REQ_POOL_USAGE
[2006/08/22 11:44:59, 2] lib/dmallocmsg.c:register_dmalloc_msgs(71)
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
[2006/08/22 11:44:59, 2] lib/smbldap_util.c:smbldap_search_domain_info
(219)
smbldap_search_domain_info: Searching for:[(&
(objectClass=sambaDomain)(sambaDomainName=EE-CIIPS2))]
[2006/08/22 11:44:59, 2] lib/smbldap.c:smbldap_open_connection(788)
smbldap_open_connection: connection opened
[2006/08/22 11:44:59, 3] lib/smbldap.c:smbldap_connect_system(992)
ldap_connect_system: succesful connection to the LDAP server
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:push_sec_ctx(208)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] smbd/uid.c:push_conn_ctx(345)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:set_sec_ctx(241)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541)
init_sam_from_ldap: Entry found for user: root
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:pop_sec_ctx(339)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:store_gid_sid_cache(1038)
store_gid_sid_cache: gid 0 in cache -> S-1-22-2-0
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_sid_from_uid_cache
(907)
fetch sid from uid cache 0 ->
S-1-5-21-2285122461-3938449209-3485319758-1000
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache
(979)
fetch sid from gid cache 0 -> S-1-22-2-0
[2006/08/22 11:44:59, 3] lib/util_seaccess.c:se_access_check(250)
[2006/08/22 11:44:59, 3] lib/util_seaccess.c:se_access_check(251)
se_access_check: user sid is S-1-1-0
se_access_check: also S-1-5-2
se_access_check: also S-1-5-7
[2006/08/22 11:44:59, 0] services/services_db.c:svcctl_init_keys(420)
init_services_keys: key lookup failed! (WERR_ACCESS_DENIED)
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:push_sec_ctx(208)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] smbd/uid.c:push_conn_ctx(345)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:set_sec_ctx(241)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:store_gid_sid_cache(1038)
store_gid_sid_cache: gid 60001 in cache -> S-1-22-2-60001
[2006/08/22 11:44:59, 3] passdb/lookup_sid.c:fetch_gid_from_cache(999)
fetch gid from cache 60001 -> S-1-22-2-60001
[2006/08/22 11:44:59, 3] smbd/sec_ctx.c:pop_sec_ctx(339)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/08/22 11:44:59, 0] smbd/server.c:main(960)
ERROR: failed to setup guest info.
(smb.conf)
[global]
log level = 3
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
workgroup = EE-CIIPS2
netbios name = ee-ciips2
# server string is the equivalent of the NT Description field
server string = CIIPS Access Server
# Security mode. Defines in which mode Samba will operate. Possible
# values are share, user, server, domain and ads. Most people will want
# user level security. See the Samba-HOWTO-Collection for details.
security = user
# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
hosts allow = 130.95.72. 130.95.149.
# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
# load printers = no
# printer admin = @eeadmin
# you may wish to override the location of the printcap file
; printcap name = /etc/printcap
# on SystemV system setting printcap name to lpstat should allow
# you to automatically obtain a printer list from the SystemV spool
# system
; printcap name = lpstat
# It should not be necessary to specify the print system type unless
# it is non-standard. Currently supported print systems include:
# bsd, cups, sysv, plp, lprng, aix, hpux, qnx
# printing = lprng
# Uncomment this if you want a guest account, you must add this to /
etc/passwd
# otherwise the user "nobody" is used
; guest account = pcguest
# this tells Samba to use a separate log file for each machine
# that connects
log file = /usr/local/daemon/samba-ciips/var/log.%m
# Put a capping on the size of the log files (in Kb).
max log size = 50
# Use password server option only with security = server
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *
; password server = <NT-Server-Name>
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
; realm = MY_REALM
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
; passdb backend = tdbsam
passdb backend = ldapsam:ldaps://ldap.ee.uwa.edu.au
ldap admin dn = cn=LDAPMgr,dc=ee,dc=uwa,dc=edu,dc=au
ldap ssl = on
ldap suffix = ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
ldap machine suffix ldap user suffix ldap group suffix =
ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
;ldap idmap=suffix = ou=ciips
ldapsam:trusted=yes
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
# this line. The included file is read at that point.
; include = /usr/local/samba/lib/smb.conf.%m
# Most people will find that this option gives better performance.
# See the chapter 'Samba performance issues' in the Samba HOWTO
Collection
# and the manual pages for details.
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
socket options = TCP_NODELAY
# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
interfaces = bge903002 bge907002
# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
local master = yes
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
os level = 33
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
domain master = yes
# Preferred Master causes Samba to force a local browser election on
startup
# and gives it a slightly higher chance of winning the election
preferred master = yes
# Enable this if you want Samba to be a domain logon server for
# Windows95 workstations.
domain logons = yes
# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
; logon script = %m.bat
# run a specific logon batch file per username
; logon script = %U.bat
logon script = login.bat
# Where to store roving profiles (only for Win95 and WinNT)
# %L substitutes for this servers netbios name, %U is username
# You must uncomment the [Profiles] share below
logon path = \\%L\Profiles\%U
logon drive = H:
logon home = \\%L\%U
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's
WINS Server
wins support = yes
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client,
but NOT both
; wins server = w.x.y.z
# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
; wins proxy = yes
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The default is NO.
dns proxy = no
# These scripts are used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
; add user script = /usr/sbin/useradd %u
; add group script = /usr/sbin/groupadd %g
add machine script = /usr/sbin/adduser -n -g machines -c Machine -
d /dev/null -s /bin/false %u
; delete user script = /usr/sbin/userdel %u
; delete user from group script = /usr/sbin/deluser %u %g
; delete group script = /usr/sbin/groupdel %g
#============================ Share Definitions
=============================[homes]
path = /eeqfs1/home/ciips/%H
comment = Home Directories
browseable = no
writable = yes
# Un-comment the following and create the netlogon directory for
Domain Logons
[netlogon]
comment = Network Logon Service
path = /usr/local/daemon/samba-ciips/lib/netlogon
writable = yes
browseable = no
create mode = 444
guest ok = no
volume = "Network"
# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
[Profiles]
path = /eeqfs1/home/ciips/home/profiles
create mode = 0600
directory mode = 0700
writable = yes
browsable = no
profile acls = yes
(Relevant LDAP entries)
dn: sambaDomainName=EE-
CIIPS2,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaRefuseMachinePwdChange:
sambaForceLogoff: -1
sambaLockoutThreshold: 0
sambaLockoutObservationWindow: 30
sambaLockoutDuration: 30
sambaMinPwdAge: 0
sambaMaxPwdAge: -1
sambaLogonToChgPwd: 0
sambaPwdHistoryLength: 0
sambaMinPwdLength: 5
sambaDomainName: EE-CIIPS2
sambaSID: S-1-5-21-2285122461-3938449209-3485319758
sambaAlgorithmicRidBase: 1000
objectClass: sambaDomain
sambaNextUserRid: 1000
dn: uid=root,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaPwdLastSet: 1150944364
sambaPwdCanChange: 1150944364
sambaKickoffTime: 2147483647
sambaAcctFlags: [U ]
userPassword:: eXXXXXXXXXXXXXXXXXXXXXXXXXsdisplayName: Super-User
sambaPwdMustChange: 2147483647
sambaLogoffTime: 2147483647
objectClass: account
objectClass: sambaSamAccount
objectClass: top
objectClass: eeAccount
objectClass: posixAccount
uid: root
uidNumber: 0
cn: root
loginShell: /bin/sh
gidNumber: 0
gecos: Super User
homeDirectory: /
sambaSID: S-1-5-21-2285122461-3938449209-3485319758-1000
cn: Super-User
sambaNTPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
sambaLogonTime: 0
sambaPrimaryGroupSID: S-1-5-21-2285122461-3938449209-3485319758-1001
sambaLMPassword: XXXXXXXXXXXXXXXXXXXXXXXX
eeType: other
dn: uid=nobody,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
sambaLMPassword: LOCKED
sambaPrimaryGroupSID: S-1-5-21-2285122461-3938449209-3485319758-121003
objectClass: top
objectClass: account
objectClass: eeAccount
objectClass: posixAccount
objectClass: sambaSamAccount
sambaLogonTime: 0
uid: nobody
uidNumber: 60001
cn: uid no body
sambaLogoffTime: 2147483647
loginShell: /noshell
sambaAcctFlags: [UX ]
gidNumber: 60001
sambaPwdMustChange: 2147483647
sambaNTPassword: LOCKED
sambaPwdCanChange: 0
gecos: uid no body
sambaSID: S-1-5-21-2285122461-3938449209-3485319758-121002
homeDirectory: /
sambaKickoffTime: 2147483647
eeType: other
userPassword:: e0NXXXXXfSpMSyo
dn: cn=nobody,ou=ciips,ou=Accounts,dc=ee,dc=uwa,dc=edu,dc=au
gidNumber: 60001
objectClass: posixGroup
objectClass: top
cn: nobody
userPassword:: e0NXXXXXfSpMSyo=
Possibly Parallel Threads
Wisdom of the Ancients
