Cédric Delfosse
2006-Nov-16 16:48 UTC
[Samba] [3.0.23d] winbind: ads_connect for domain X failed: Operations error
SAMBA 3.0.23d (netbios name is PDC01, domain is LINBOXTEST)
Windows 2000 server SP4 in mixed mode (netbios name is MAFIA-L6FFST3UP,
domain is ADTEST / adtest.linbox.com)
Hello,
So I've successfully established a two ways interdomain trust
relationship between a SAMBA PDC and a Windows domain. It was working
fine: for example a windows user was able to connect on a share on the
SAMBA server.
But now that I restarted samba and winbind, windows user can no more
connect to the SAMBA share.
Looking at SAMBA logs, It looks like winbind can't interrogate the
Windows LDAP server. For example, if I try:
# wbinfo --sequence
ADTEST : DISCONNECTED
BUILTIN : 137330168
LINBOXTEST : 137328088
I get this in /var/log/samba/log.wb-ADTEST:
ads_try_connect: sending CLDAP request to 192.168.0.247 (realm:
adtest.linbox.com)
[2006/11/16 17:21:50, 10] libsmb/namequery.c:saf_store(71)
saf_store: domain = [ADTEST], server = [192.168.0.247], expire = [1163695010]
[2006/11/16 17:21:50, 10] lib/gencache.c:gencache_set(140)
Adding cache entry with key = SAF/DOMAIN/ADTEST; value = 192.168.0.247 and
timeout = Thu Nov 16 17:36:50 2006
(900 seconds ahead)
[2006/11/16 17:21:50, 3] libads/ldap.c:ads_connect(287)
Connected to LDAP server 192.168.0.247
[2006/11/16 17:21:50, 1] nsswitch/winbindd_ads.c:ads_cached_connection(114)
ads_connect for domain ADTEST failed: Operations error
[2006/11/16 17:21:50, 10] nsswitch/winbindd_cache.c:refresh_sequence_number(447)
refresh_sequence_number: failed with NT_STATUS_UNSUCCESSFUL
[2006/11/16 17:21:50, 10] nsswitch/winbindd_cache.c:store_cache_seqnum(400)
store_cache_seqnum: success [ADTEST][4294967295 @ 1163694110]
[2006/11/16 17:21:50, 10] nsswitch/winbindd_cache.c:refresh_sequence_number(459)
refresh_sequence_number: ADTEST seq number is now -1
[2006/11/16 17:21:50, 10] nsswitch/winbindd_cache.c:cache_store_response(1966)
Storing response for pid 18303, len 3240
Notice the "Operations error" message !
wbinfo -u/-g no more works too.
Here is the network trace of the CLDAP connection:
17:23:25.901055 IP 172.20.0.221.33128 > 192.168.0.247.389: UDP, length: 100
0x0000: 4500 0080 ebea 4000 4011 dff1 ac14 00dd E.....@.@.......
0x0010: c0a8 00f7 8168 0185 006c fd72 3062 0201 .....h...l.r0b..
0x0020: 0463 5d04 000a 0100 0a01 0002 0100 0201 .c].............
0x0030: 0001 0100 a03e a31e 0409 446e 7344 6f6d .....>....DnsDom
0x0040: 6169 6e04 1161 6474 6573 742e 6c69 6e62 ain..adtest.linb
0x0050: 6f78 2e63 6f6d a30d 0404 486f 7374 0405 ox.com....Host..
0x0060: 5044 4330 31a3 0d04 054e 7456 6572 0404 PDC01....NtVer..
0x0070: 0600 0000 300a 0408 4e65 744c 6f67 6f6e ....0...NetLogon
17:23:25.902620 IP 192.168.0.247.389 > 172.20.0.221.33128: UDP, length: 193
0x0000: 4500 00dd 5324 0000 7f11 795b c0a8 00f7 E...S$....y[....
0x0010: ac14 00dd 0185 8168 00c9 afb3 3084 0000 .......h....0...
0x0020: 00a5 0201 0464 8400 0000 9c04 0030 8400 .....d.......0..
0x0030: 0000 9430 8400 0000 8e04 086e 6574 6c6f ...0.......netlo
0x0040: 676f 6e31 8400 0000 7e04 7c17 0000 00fd gon1....~.|.....
0x0050: 0100 00c5 d185 2978 a6e5 4fa6 4a2d c06a ......)x..O.J-.j
0x0060: b0e3 e006 6164 7465 7374 066c 696e 626f ....adtest.linbo
0x0070: 7803 636f 6d00 c018 0f6d 6166 6961 2d6c x.com....mafia-l
0x0080: 3666 6673 7433 7570 c018 0641 4454 4553 6ffst3up...ADTES
0x0090: 5400 0f4d 4146 4941 2d4c 3646 4653 5433 T..MAFIA-L6FFST3
0x00a0: 5550 0000 1750 7265 6d69 6572 2d53 6974 UP...Premier-Sit
0x00b0: 652d 7061 722d 6465 6661 7574 00c0 5905 e-par-defaut..Y.
0x00c0: 0000 00ff ffff ff30 8400 0000 1002 0104 .......0........
0x00d0: 6584 0000 0007 0a01 0004 0004 00 e............
And a chunk of the tethereal output:
SAMBA request:
Internet Protocol, Src Addr: 192.168.0.247 (192.168.0.247), Dst Addr:
172.20.0.221 (172.20.0.221)
...
LDAP Message, Search Request
Message Id: 4
Message Type: Search Request (0x03)
Message Length: 93
Base DN: (null)
Scope: Base (0x00)
Dereference: Never (0x00)
Size Limit: 0
Time Limit: 0
Attributes Only: False
Filter: (&(DnsDomain=adtest.linbox.com)(Host=PDC01)(NtVer=\006)
Attribute: NetLogon
Windows 2000 search result:
Internet Protocol, Src Addr: 192.168.0.247 (192.168.0.247), Dst Addr:
172.20.0.221 (172.20.0.221)
...
LDAP Message, Search Result
Message Id: 4
Message Type: Search Result (0x05)
Message Length: 7
Response To: 11
Time: 0.001484000 seconds
Result Code: success (0x00)
Matched DN: (null)
Error Message: (null)
Should I file a bug report ?
Regards,
--
Cedric Delfosse Linbox / Free&ALter Soft
152, rue de Grigy - Technopole Metz 57070 METZ - FRANCE
tel: +33 (0)3 87 50 87 98 http://linbox.com
Cédric Delfosse
2006-Nov-17 15:44 UTC
[Samba] [3.0.23d] winbind: ads_connect for domain X failed: Operations error
Le jeudi 16 novembre 2006 ? 17:47 +0100, C?dric Delfosse a ?crit :> SAMBA 3.0.23d (netbios name is PDC01, domain is LINBOXTEST) > Windows 2000 server SP4 in mixed mode (netbios name is MAFIA-L6FFST3UP, > domain is ADTEST / adtest.linbox.com) > > Hello, > > So I've successfully established a two ways interdomain trust > relationship between a SAMBA PDC and a Windows domain. It was working > fine: for example a windows user was able to connect on a share on the > SAMBA server. > > But now that I restarted samba and winbind, windows user can no more > connect to the SAMBA share.I tried again this setup. I configured a new AD server, this time with a DNS service on the same machine. And I told the SAMBA server to use this DNS, as it is needed for Kerberos stuff. Now looks like all works fine \o/ Regards, -- Cedric Delfosse Linbox / Free&ALter Soft 152, rue de Grigy - Technopole Metz 57070 METZ - FRANCE tel: +33 (0)3 87 50 87 98 http://linbox.com
Possibly Parallel Threads
- winbind: getent passwd displays the user, but SAMBA says Get_Pwnam_internals didn't find user
- linux_set_kernel_oplock: Refused oplock on file. F_SETLEASE semantic problem ?
- Sharing in another network
- I can't get multiple interfaces to work
- Setting a HP 9300 driver with APW -> Windows protection fault