toonverdonck at dommel.be
2010-Mar-09 07:57 UTC
[Samba] Windows machine has to join two times
Hi, I'm running a debian lenny machine with samba (3.5.0) and OpenLDAP installed (2.4.11). When i add a machine to the domain, windows reports the following error: "The specified computer account could not be found". The computer account is added to the LDAP database but without the samba attributes. The weird thing is that if i try it a second the, the samba attributes are added to the computer account and the machine successfully joins the domain. This happens with XP, Vista and Windows 7 cli?nts. I have no idea why it doesn't work the first time. On the internet and in this mailing list i found other people where the samba attributes aren't added but i didn't find anyone where it does work on a second attempt. Log after the first try (fail): [2010/03/08 11:35:35.135255, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2010/03/08 11:35:35.158356, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2010/03/08 11:35:35.159037, 2] lib/smbldap.c:950(smbldap_open_connection) smbldap_open_connection: connection opened [2010/03/08 11:35:35.184862, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: root [2010/03/08 11:35:35.242603, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 513 [2010/03/08 11:35:35.246777, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 512 [2010/03/08 11:35:35.246893, 2] auth/auth.c:304(check_ntlm_password) check_ntlm_password: authentication for user [root] -> [root] -> [root] succeeded [2010/03/08 11:35:35.353990, 2] auth/auth.c:314(check_ntlm_password) check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with error NT_STATUS_NO_SUCH_USER [2010/03/08 11:35:35.503246, 0] rpc_server/srv_netlog_nt.c:669(_netr_ServerAuthenticate3) _netr_ServerAuthenticate3: no challenge sent to client QSDF-PC [2010/03/08 11:35:35.664174, 2] auth/auth.c:314(check_ntlm_password) check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with error NT_STATUS_NO_SUCH_USER [2010/03/08 11:35:35.811769, 2] rpc_server/srv_samr_nt.c:4115(_samr_LookupDomain) Returning domain sid for domain SAMBADOM -> S-1-5-21-2536920342-1981552595-828935944 Log after the second time: [2010/03/08 12:05:27.002217, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2010/03/08 12:05:27.005300, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2010/03/08 12:05:27.005945, 2] lib/smbldap.c:950(smbldap_open_connection) smbldap_open_connection: connection opened [2010/03/08 12:05:27.021907, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: root [2010/03/08 12:05:27.087024, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 513 [2010/03/08 12:05:27.093436, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 512 [2010/03/08 12:05:27.093545, 2] auth/auth.c:304(check_ntlm_password) check_ntlm_password: authentication for user [root] -> [root] -> [root] succeeded [2010/03/08 12:05:27.144319, 2] auth/auth.c:314(check_ntlm_password) check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with error NT_STATUS_NO_SUCH_USER [2010/03/08 12:05:27.261506, 0] rpc_server/srv_netlog_nt.c:669(_netr_ServerAuthenticate3) _netr_ServerAuthenticate3: no challenge sent to client QSDF-PC [2010/03/08 12:05:27.392859, 2] auth/auth.c:314(check_ntlm_password) check_ntlm_password: Authentication for user [qsdf] -> [qsdf] FAILED with error NT_STATUS_NO_SUCH_USER [2010/03/08 12:05:27.488414, 2] rpc_server/srv_samr_nt.c:4115(_samr_LookupDomain) Returning domain sid for domain SAMBADOM -> S-1-5-21-2536920342-1981552595-828935944 [2010/03/08 12:05:27.505219, 2] lib/smbldap_util.c:277(smbldap_search_domain_info) smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=SAMBADOM))] [2010/03/08 12:05:27.592142, 2] passdb/pdb_ldap.c:1200(init_ldap_from_sam) init_ldap_from_sam: Setting entry for user: QSDF-PC$ [2010/03/08 12:05:27.633889, 2] passdb/pdb_ldap.c:2384(ldapsam_add_sam_account) ldapsam_add_sam_account: added: uid == QSDF-PC$ in the LDAP database [2010/03/08 12:05:27.640585, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: qsdf-pc$ [2010/03/08 12:05:27.647470, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: qsdf-pc$ [2010/03/08 12:05:27.663073, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: qsdf-pc$ [2010/03/08 12:05:27.663625, 2] passdb/pdb_ldap.c:1200(init_ldap_from_sam) init_ldap_from_sam: Setting entry for user: qsdf-pc$ [2010/03/08 12:05:27.677274, 2] passdb/pdb_ldap.c:2061(ldapsam_update_sam_account) ldapsam_update_sam_account: successfully modified uid = qsdf-pc$ in the LDAP database [2010/03/08 12:05:31.219790, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: qsdf-pc$ [2010/03/08 12:05:31.224875, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 515 [2010/03/08 12:05:31.232154, 2] passdb/pdb_ldap.c:2446(init_group_from_ldap) init_group_from_ldap: Entry found for group: 515 I don't think it has anything to do with the "Authentication for user [qsdf] -> [qsdf] FAILED with error NT_STATUS_NO_SUCH_USER" error because the second time it does work. Although i have no idea what this error is and if I should fix it. My smb.conf: [global] workgroup = SAMBADOM server string = %h server (Samba, Ubuntu) passdb backend = ldapsam:ldap://127.0.0.1 passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *passwd:*password\supdated\ssuccessfully* . log level = 2 syslog = 0 log file = /var/log/samba/log.%m max log size = 1000 add user script = /usr/sbin/smbldap-useradd -m "%u" delete user script = /usr/sbin/smbldap-userdel "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" delete group script = /usr/sbin/smbldap-groupdel "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" logon path domain logons = Yes dns proxy = No ldap admin dn = cn=admin,dc=test,dc=com ldap delete dn = Yes ldap group suffix = ou=Groups ldap idmap suffix = ou=Users ldap machine suffix = ou=Computers ldap passwd sync = yes ldap suffix = dc=test, dc=com ldap ssl = no ldap user suffix = ou=Users panic action = /usr/share/samba/panic-action %d [netlogon] comment = Network Logon Service path = /home/samba/netlogon guest ok = Yes share modes = No [printers] comment = All Printers path = /var/spool/samba create mask = 0700 printable = Yes browseable = No [print$] comment = Printer Drivers path = /var/lib/samba/printers The add machine script should be good. Samba should add the samba attributes, not ldap (regarding the manual). My slapd.conf: # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values logfile /var/log/slapd.log loglevel -1 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=test,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=test,dc=com" # Where the database file are physically stored for database #1 directory "/ldap_data" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq index uid,memberUid eq index sambaDomainName,gidNumber eq index sambaGroupType,sambaSID eq index sambaSIDList eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=test,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=test,dc=com" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=test,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be hdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org"
On 2010-03-09 at 08:57 +0100 toonverdonck at dommel.be sent off:> I'm running a debian lenny machine with samba (3.5.0) and OpenLDAP installed > (2.4.11). When i add a machine to the domain, windows reports the following > error: "The specified computer account could not be found". The computer > account is added to the LDAP database but without the samba attributes. The > weird thing is that if i try it a second the, the samba attributes are added to > the computer account and the machine successfully joins the domain. This > happens with XP, Vista and Windows 7 cli?nts. I have no idea why it doesn't > work the first time.make sure to invoke nscd -i passwd at the end of your add machine/user script and maybe sleep a second. Bj?rn -- SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen phone: +49-551-370000-0, fax: +49-551-370000-9 AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available URL: <http://lists.samba.org/pipermail/samba/attachments/20100309/55b86eda/attachment.pgp>
toonverdonck at dommel.be
2010-Mar-10 12:16 UTC
[Samba] Windows machine has to join two times
I channged the add machine and the add user script to: smbldap-useradd .. "%u" && nscd -i passwd && sleep 1s I think that is what you mean? Unfortunately it didn't solved the problem.>> On 09 Mar 2010, at 16:53, Bj?rn Jacke wrote: >> >> On 2010-03-09 at 08:57 +0100 toonverdonck at dommel.be sent off: >> I'm running a debian lenny machine with samba (3.5.0) and OpenLDAP installed >> (2.4.11). When i add a machine to the domain, windows reports the following >> error: "The specified computer account could not be found". The computer >> account is added to the LDAP database but without the samba attributes. The >> weird thing is that if i try it a second the, the samba attributes are added >> to >> the computer account and the machine successfully joins the domain. This >> happens with XP, Vista and Windows 7 cli?nts. I have no idea why it doesn't >> work the first time. >> >> make sure to invoke nscd -i passwd at the end of your add machine/user script >> and maybe sleep a second. >> >> Bj?rn >> -- >> SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen >> phone: +49-551-370000-0, fax: +49-551-370000-9 >> AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen
On Wed, Mar 10, 2010 at 10:46 AM, <toonverdonck at dommel.be> wrote:> Ok, so it's better to clear the cache after adding a machine into the LDAP > directory so SAMBA can add the right attributes instead of disabling the > nscd > service?I just create the machine accounts via LAM before adding a machine to the domain in windows. http://www.ldap-account-manager.org/ There was a thread last year about this. Google search for samba "Unable to add machine accounts" John