Van Svensson
2017-Aug-05 15:38 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
Rowland Penny wrote:> On Sat, 5 Aug 2017 15:29:54 +0200 > Van Svensson via samba <samba at lists.samba.org> wrote: > > > Rowland Penny wrote: > > > > > On Sat, 5 Aug 2017 14:44:34 +0200 > > > Van Svensson via samba <samba at lists.samba.org> wrote: > > > > > > > Rowland Penny wrote: > > > > > > > > > On Sat, 5 Aug 2017 13:06:18 +0200 > > > > > Van Svensson via samba <samba at lists.samba.org> wrote: > > > > > > > > > > > Thanks for your reply! I have now filed a bug in launchpad > > > > > > (https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1708817). > > > > > > > > > > > > When I compare the cups error_log with 14.04 where it does > > > > > > work I see that 16.04 uses two backslashes when setting > > > > > > KRB5CCNAME while 14.04 does not use backslashes, maybe that > > > > > > is the problem? > > > > > > > > > > > > Sometimes the cups error_log also have the below line > > > > > > "HTTP_STATE_WAITING Closing for error 32 (Broken pipe)" like I > > > > > > show below. Both this line and the line "Could not determine > > > > > > network interfaces, you must use a interfaces config line" > > > > > > maybe can give some idea on what goes wrong? The line > > > > > > "Printing jobs and dirty files" can maybe be ignored since it > > > > > > also shows up in 14.04 where it works. > > > > > > > > > > It might help if you could tell us what versions of Samba you > > > > > are using (it might shock you, but some people don't use Ubuntu > > > > > ), it would also be a good idea to post your smb.conf files. > > > > > > > > I attach the smb.conf file which is exactly the same for both > > > > Ubuntu 14.04 and 16.04. On 14.04 I have Samba version > > > > 2:4.3.11+dfsg-0ubuntu0.14.04.10 and on 16.04 I have > > > > 2:4.3.11+dfsg-0ubuntu0.16.04.9. > > > > > > Sorry, but this mailing list strips off attachments, you will need > > > to copy it into the post. > > > > Here it comes (according to "diff" the smb.conf file is exactly the > > same for both Ubuntu 14.04 and 16.04): > > > > [...] > > OK, after I removed all the commented lines and default lines, I was > left with this: > > [global] > server string = %h server (Samba, Ubuntu) > dns proxy = no > > log file = /var/log/samba/log.%m > max log size = 1000 > syslog = 0 > panic action = /usr/share/samba/panic-action %d > > server role = standalone server > obey pam restrictions = yes > unix password sync = yes > > passwd program = /usr/bin/passwd %u > passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . > > pam password change = yes > map to guest = bad user > usershare allow guests = yes > > [printers] > comment = All Printers > browseable = no > path = /var/spool/samba > printable = yes > create mask = 0700 > > [print$] > comment = Printer Drivers > path = /var/lib/samba/printers > > About the only thing wrong with this is that you haven't set: > 'security = user'Sorry, I should have removed the comments etc from smb.conf and when I did that with "grep -v ^# /etc/samba/smb.conf|grep -v ^\;|grep -v ^$" I was left with the following which have a few more lines in comparison to what you was left with above. I have also added the line "security = user" at the end of the section "global": [global] workgroup = WORKGROUP server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = standalone server passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user usershare allow guests = yes security = user [printers] comment = All Printers browseable = no path = /var/spool/samba printable = yes guest ok = no read only = yes create mask = 0700 [print$] comment = Printer Drivers path = /var/lib/samba/printers browseable = yes read only = yes guest ok = no After rebooting the computer and testing printing again it unfortunately still does not work to print on 16.04. Please note that smb.conf on 14.04 does not contain this "security = user" and printing still works.> I also take it that your users exist on the machine in /etc/passwd and > in SambaI should have mentioned this earlier, but the users does not exist in /etc/passwd, instead they are in LDAP and when they log in to the computer they get some Kerberos tickets for the domain and the file system. When printing on 14.04 they get another Kerberos ticket for the printing system according to "klist" after they have done "lpr" and printed a document. On 16.04 nothing is printed and the user gets no Kerberos ticket for the printing system and the job is left in "lpq". Thanks / Van
Rowland Penny
2017-Aug-05 15:56 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
On Sat, 5 Aug 2017 17:38:23 +0200 Van Svensson via samba <samba at lists.samba.org> wrote:> I should have mentioned this earlier, but the users does not exist > in /etc/passwd, instead they are in LDAP and when they log in to the > computer they get some Kerberos tickets for the domain and the file > system. When printing on 14.04 they get another Kerberos ticket for > the printing system according to "klist" after they have done "lpr" > and printed a document. On 16.04 nothing is printed and the user gets > no Kerberos ticket for the printing system and the job is left in > "lpq". >Are your main users running Windows ? Are they members of an AD domain ? If the answers to the questions are both 'yes', then you might want to have a read here: https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member and here: https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server Rowland
Van Svensson
2017-Aug-05 17:06 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
> > I should have mentioned this earlier, but the users does not exist > > in /etc/passwd, instead they are in LDAP and when they log in to the > > computer they get some Kerberos tickets for the domain and the file > > system. When printing on 14.04 they get another Kerberos ticket for > > the printing system according to "klist" after they have done "lpr" > > and printed a document. On 16.04 nothing is printed and the user gets > > no Kerberos ticket for the printing system and the job is left in > > "lpq". > > Are your main users running Windows ? > Are they members of an AD domain ?At my part of the organization most people are running Linux: Ubuntu 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but after the upgrade the printing does no longer work. Centrally at the organization they are running Windows and we Linux users are using the centrally provided printing system through SMB-Kerberos. Everything works fine in 14.04. After upgrading to 16.04 everything works except the printing. As I mentioned earlier I see that double backslashes are used in 16.04 when SMBSPOOL_KRB5 is setting KRB5CCNAME, can that cause this problem? Ubuntu 16.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' Ubuntu 14.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to 'FILE:/tmp/krb5cc_1000' Do you have any idea about what the error "HTTP_STATE_WAITING Closing for error 32 (Broken pipe)" can tell me in this situation when it is printed right after SMBSPOOL_KRB5 has set KRB5CCNAME? Also wondering about why I get this right after the above error: "Could not determine network interfaces, you must use a interfaces config line" (As a side note, not sure if it is interesting, but I see in the /var/log/cups/error_log that SMBSPOOL_KRB5 sets KRB5CCNAME to /tmp/krb5cc_UID (where UID is >= 1000). In our environment the user gets /tmp/krb5cc_UID_RANDOM (where RANDOM is a random string) from Heimdal Kerberos when logging in so in 14.04 (where printing works) you have to create a symbolic link from /tmp/krb5cc_UID to /tmp/krb5cc_UID_RANDOM to have the printing work which we do through a small script in /etc/profile.d/. Maybe this has been fixed in later versions of Samba so that we do not need to create this symbolic link for each user? (Of course I have checked that this symbolic link creation works in 16.04.)) Thanks / Van
Seemingly Similar Threads
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04