samba - Apr 2008 - winbindd_privileged problem with 3.0.28a

Hi, all.

Has anyone else experienced issues with using ntlm_auth in 3.0.28a?  We have 
had squid set up to use ntlm_auth for quite some time & the latest update 
seems to break.  

I'm getting (in /var/log/messages)

Apr 23 10:13:51 cyclops (ntlm_auth):   Login for user [NSTARBANK]\[drandolph]@
[NSB_DAVELAPTOP] failed due to [winbind client not authorized to
 use winbindd_pam_auth_crap. Ensure permissions 
on /var/lib/samba/winbindd_privileged are set correctly.]
Apr 23 10:13:51 cyclops (ntlm_auth): [2008/04/23 10:13:51, 0] 
utils/ntlm_auth.c:manage_squid_ntlmssp_request(776)
Apr 23 10:13:51 cyclops (ntlm_auth): [2008/04/23 10:13:51, 0] 
utils/ntlm_auth.c:manage_squid_ntlmssp_request(776)
Apr 23 10:13:51 cyclops (ntlm_auth):   NTLMSSP BH: NT_STATUS_ACCESS_DENIED
Apr 23 10:13:51 cyclops (ntlm_auth):   NTLMSSP BH: NT_STATUS_ACCESS_DENIED

 I have checked and double-checked that the squid process is running as 
user "squid" and that "squid" is a member of the wbpriv
group.

Perms on the winbindd_privileged folder are:

drwxr-x---  2 root wbpriv    4096 2008-04-23 10:00 winbindd_privileged
[root@cyclops samba]# pwd
/var/lib/samba



If I fiddle with the perms then winbind won't even start & I'm kind
of at a
loss to explain what is going on as I can't find any bugs filed, etc.  I 
thought I'd ask here & see if the 3.0.28a broke for anyone else.

Thanks for any input.
dave

Dave Randolph <drandolph <at> nstarbank.com> writes:
> 
> Hi, all.
> 
> Has anyone else experienced issues with using ntlm_auth in 3.0.28a?  We
have
> had squid set up to use ntlm_auth for quite some time & the latest
update
> seems to break.  

Just to give an update on this.

The problem seems to be related to the nesting of group membership.  If I run 
squid with an effective group of "wbpriv" it works fine.  If I simply
add
squid to the wbpriv group & run it with effective group of "squid"
I get
the "winbind_crap" error.  

Like I said in the original , this was working fine with squid as a member of 
the wbpriv group in a previous build (honestely can't remember what I was at
before this one but I'm using Fedora core 8).

Before I make my next statement I would like to say that I haven't looked at
the code so I can't speak with any authority.  
That said, this may be a kernel or other kind of issue (We are at 2.6.23.1-
42.fc8 if it helps anyone out.) I tried an experiment by loading up a 3.25.x 
build & I now have the same behavior.  
 
I will keep researching & see if I can find an answer to this.  If anyone
can
shed any light on what is going on I would really appreciate it.
dave