Pat Riehecky
2007-May-11  16:51 UTC
[Samba] BDC keeps taking over and not allowing logins from NT PDC
Hello, thanks for looking over my ramblings...
We have an NT4 PDC with and NT4 BDC on 192.168.132.X, these boxes are
very very old and overloaded.  I am trying to replace them with a nice
shinny new Samba box.  My problem is that while I am trying to test it
out to make sure it plays nice it keeps winning the elections.
I find this weird as I have set the box to domain master = no and turned
the os level and announce values to really low values.
When it does win no one can login to the domain (and therefore their
workstations) and I have to stop samba to get users back logging in and
able to work.
I joined it to the domain via:
net rpc join -S [NT netbios name or IP] -UAdministrator%password
I got BDC rights and ran:
# net rpc vampire -S [NT netbios name or IP] -W [domainname]
-UAdministrator%password
About the time that users reported login problems I got lots of copies
of 
[2007/05/11 08:01:14, 0] lib/util_sock.c:get_peer_addr(1225)
  getpeername failed. Error was Transport endpoint is not connected
in /var/log/log.smbd
To add further complexity the samba box is on a 10. address while the
PDC and BDC are on 192.168. addresses.  Is this a problem?
Any ideas why it is winning the election, why users cannot login to
their systems, is my switch to a different address space a problem?
Thanks!
-- data snippets --
# ping 192.168.132.15
PING 192.168.132.15 (192.168.132.15) 56(84) bytes of data.
64 bytes from 192.168.132.15: icmp_seq=1 ttl=127 time=0.282 ms
64 bytes from 192.168.132.15: icmp_seq=2 ttl=127 time=0.228 ms
64 bytes from 192.168.132.15: icmp_seq=3 ttl=127 time=0.240 ms
--- 192.168.132.15 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.228/0.250/0.282/0.023 ms
# pdbedit -Lv prieheck
Unix username:        prieheck
NT username:          prieheck
Account Flags:        [UX         ]
User SID:             S-1-5-21-769903590-661906358-2446119016-1958
Primary Group SID:    S-1-5-21-769903590-661906358-2446119016-513
Full Name:            Pat Riehecky
Home Directory:       \\files\prieheck
HomeDir Drive:        
Logon Script:         
Profile Path:         \\files\prieheck\profile
Domain:               IWUADMIN
Account desc:         
Workstations:         
Munged dial:          
Logon time:           0
Logoff time:          Mon, 18 Jan 2038 21:14:07 CST
Kickoff time:         Mon, 18 Jan 2038 21:14:07 CST
Password last set:    Fri, 30 Mar 2007 09:00:41 CDT
Password can change:  0
Password must change: Mon, 18 Jan 2038 21:14:07 CST
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
# testparm
[global]
        display charset = UTF8
        workgroup = IWUADMIN
        server string = %h server (Samba, Ubuntu)
        announce version = 2.0
        announce as = win95
        os level = 0
        obey pam restrictions = Yes
        passdb backend = tdbsam
        algorithmic rid base = 10000
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew
\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
        username map = /etc/samba/users.map
        restrict anonymous = 2
        lanman auth = No
        client NTLMv2 auth = Yes
        client lanman auth = No
        client plaintext auth = No
        log level = 1
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        min protocol = NT1
        max mux = 100
        change notify timeout = 300
        deadtime = 900
        max disk size = 5240
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
SO_KEEPALIVE IPTOS_LOWDELAY
        load printers = No
        add user script = /usr/sbin/adduser --quiet --disabled-password
--gecos "" %u
        delete user script = /usr/sbin/userdel -r '%u'
        add group script = /usr/sbin/groupadd '%g'
        delete group script = /usr/sbin/groupdel '%g'
        add user to group script = /usr/sbin/usermod -G '%g'
'%u'
        add machine script = /usr/sbin/useradd -s /bin/false
-d /dev/null '%u'
        lm announce = No
        preferred master = No
        domain master = No
        wins server = 192.168.132.25
        panic action = /usr/share/samba/panic-action %d
        invalid users = backup, bin, daemon, dhcp, games, gnats, irc,
klog, list, lp, mail, man, news, nobody, postfix, proxy, sync, sys,
syslog, uucp, www-data, root
        hosts allow = 192.168.132., 10., 172.16.1., 127.0.0.1
        remote announce = 192.168.132.255/IWUADMIN
[homes]
        comment = Home Directories
        valid users = %S
        browseable = No
[netlogon]
        comment = Network Logon Service
        path = /home/samba/netlogon
        guest ok = Yes
        share modes = No
[template]
        path = /tmp
        read only = No
        create mask = 0775
        directory mask = 0775
        strict allocate = Yes
        preserve case = No
        hide special files = Yes
        hide unreadable = Yes
        hide unwriteable files = Yes
        browseable = No
        fstype = FAT
        wide links = No
[TEST]
        copy = template
        path = /home/prieheck
        comment = just a test of group stuff
        valid users = @it
        force group = it
# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:1A:4B:0A:57:12  
          inet addr:10.132.0.30  Bcast:10.132.0.255  Mask:255.255.255.0
          inet6 addr: fe80::21a:4bff:fe0a:5712/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:305547 errors:0 dropped:0 overruns:0 frame:0
          TX packets:294673 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:74791511 (71.3 MiB)  TX bytes:142754073 (136.1 MiB)
          Interrupt:169 
# cat /etc/issue
Ubuntu 6.10 \n \l
# uname -a
Linux files 2.6.17-11-server #2 SMP Tue Mar 13 23:33:44 UTC 2007 i686
GNU/Linux
# dpkg -l |grep samba
ii  libcrypt-smbhash-perl        0.12-1
ii  samba                        3.0.22-1ubuntu4.1
ii  samba-common                 3.0.22-1ubuntu4.1
Possibly Parallel Threads
- [Resolved] Found a way of allowing pam_ldap users (with pam_groupdn or pam_check_host_attr restrictions), AND allowing local root authentication, without pam_unix.so taking presense due to getpwent() returns ldap-users
 - ssh allowing root logins
 - STATUS_INVALID_HANDLE?
 - Credential caching (I guess) problems
 - managesieve configuration
 
