samba - Dec 2008 - To make winbindd upset and unresponsive (3.2.6)

This simple and often-suggested command to test Samba:

getent passwd

reproducibly upsets winbindd on my SLES 10 SP1 machine.  The command
does often return many results from our campus ADS.  But after it
completes -- or if the command pauses for quite some time after
showing local users -- Samba is troubled.  In five tests this
afternoon, after getent passwd,

wbinfo --ping

fails every time until I stop and restart nmd, smb and winbindd.
Usually one of the five winbindd instances shows higher resource use
than most anything else.  No one is accessing files from this machine,
if that matters, except me.

I noticed this as I had been working to understand why my ADS account
in a local (unix) group doesn't let me change files.

Samba on this machine is: Version 3.2.6-3.1-2034-SUSE-CODE10

[global]
        log level = 1
        workgroup = ADS
        security = ADS
        realm = <OUR REALM>
        password server = <our ads>
        client ntlmv2 auth = yes
        encrypt passwords = Yes
        map to guest = Bad User
        add machine script = /usr/sbin/useradd  -c Machine -d
/var/lib/nobody -s /bin/false %m$
        logon path = \\%L\profiles\.msprofile
        logon drive = P:
        logon home = \\%L\%U\.9xprofile
        winbind separator = +
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = No
        template homedir = /home/%D/%U

        idmap uid = 10000-200000
        idmap gid = 10000-200000

        wins support = No
        wins server = <our wins ip>
        winbind:ignore domains = IN-ORTHO LANGLAB GEOSURVEY <and a bunch
more>
        usershare allow guests = No
        usershare max shares = 100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Frank Burleigh wrote:
> This simple and often-suggested command to test Samba:
> 
> getent passwd
> 
> reproducibly upsets winbindd on my SLES 10 SP1 machine.  
....
> [global]
...
>         winbind enum users = Yes
>         winbind enum groups = Yes
Don't enable these.




cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJUDrWIR7qMdg1EfYRAjpsAJ97cpf1sLnK3eG2rSSrbu1Umb3JLwCgjkcI
lH7l2K5vcV12LcRZ6XOEtv4=bT6x
-----END PGP SIGNATURE-----