Van Svensson
2017-Aug-05 17:06 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
> > I should have mentioned this earlier, but the users does not exist > > in /etc/passwd, instead they are in LDAP and when they log in to the > > computer they get some Kerberos tickets for the domain and the file > > system. When printing on 14.04 they get another Kerberos ticket for > > the printing system according to "klist" after they have done "lpr" > > and printed a document. On 16.04 nothing is printed and the user gets > > no Kerberos ticket for the printing system and the job is left in > > "lpq". > > Are your main users running Windows ? > Are they members of an AD domain ?At my part of the organization most people are running Linux: Ubuntu 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but after the upgrade the printing does no longer work. Centrally at the organization they are running Windows and we Linux users are using the centrally provided printing system through SMB-Kerberos. Everything works fine in 14.04. After upgrading to 16.04 everything works except the printing. As I mentioned earlier I see that double backslashes are used in 16.04 when SMBSPOOL_KRB5 is setting KRB5CCNAME, can that cause this problem? Ubuntu 16.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' Ubuntu 14.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to 'FILE:/tmp/krb5cc_1000' Do you have any idea about what the error "HTTP_STATE_WAITING Closing for error 32 (Broken pipe)" can tell me in this situation when it is printed right after SMBSPOOL_KRB5 has set KRB5CCNAME? Also wondering about why I get this right after the above error: "Could not determine network interfaces, you must use a interfaces config line" (As a side note, not sure if it is interesting, but I see in the /var/log/cups/error_log that SMBSPOOL_KRB5 sets KRB5CCNAME to /tmp/krb5cc_UID (where UID is >= 1000). In our environment the user gets /tmp/krb5cc_UID_RANDOM (where RANDOM is a random string) from Heimdal Kerberos when logging in so in 14.04 (where printing works) you have to create a symbolic link from /tmp/krb5cc_UID to /tmp/krb5cc_UID_RANDOM to have the printing work which we do through a small script in /etc/profile.d/. Maybe this has been fixed in later versions of Samba so that we do not need to create this symbolic link for each user? (Of course I have checked that this symbolic link creation works in 16.04.)) Thanks / Van
Rowland Penny
2017-Aug-05 18:07 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
On Sat, 5 Aug 2017 19:06:49 +0200 Van Svensson via samba <samba at lists.samba.org> wrote:> > > I should have mentioned this earlier, but the users does not exist > > > in /etc/passwd, instead they are in LDAP and when they log in to > > > the computer they get some Kerberos tickets for the domain and > > > the file system. When printing on 14.04 they get another Kerberos > > > ticket for the printing system according to "klist" after they > > > have done "lpr" and printed a document. On 16.04 nothing is > > > printed and the user gets no Kerberos ticket for the printing > > > system and the job is left in "lpq". > > > > Are your main users running Windows ? > > Are they members of an AD domain ? > > At my part of the organization most people are running Linux: Ubuntu > 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but > after the upgrade the printing does no longer work. Centrally at the > organization they are running Windows and we Linux users are using > the centrally provided printing system through SMB-Kerberos. > Everything works fine in 14.04. After upgrading to 16.04 everything > works except the printing. > > As I mentioned earlier I see that double backslashes are used in > 16.04 when SMBSPOOL_KRB5 is setting KRB5CCNAME, can that cause this > problem? Ubuntu 16.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - > Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' Ubuntu > 14.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to > 'FILE:/tmp/krb5cc_1000' > > Do you have any idea about what the error "HTTP_STATE_WAITING Closing > for error 32 (Broken pipe)" can tell me in this situation when it is > printed right after SMBSPOOL_KRB5 has set KRB5CCNAME? > > Also wondering about why I get this right after the above error: > "Could not determine network interfaces, you must use a interfaces > config line" > > (As a side note, not sure if it is interesting, but I see in > the /var/log/cups/error_log that SMBSPOOL_KRB5 sets KRB5CCNAME > to /tmp/krb5cc_UID (where UID is >= 1000). In our environment the > user gets /tmp/krb5cc_UID_RANDOM (where RANDOM is a random string) > from Heimdal Kerberos when logging in so in 14.04 (where printing > works) you have to create a symbolic link from /tmp/krb5cc_UID > to /tmp/krb5cc_UID_RANDOM to have the printing work which we do > through a small script in /etc/profile.d/. Maybe this has been fixed > in later versions of Samba so that we do not need to create this > symbolic link for each user? (Of course I have checked that this > symbolic link creation works in 16.04.)) > > Thanks / Van >To be honest, I don't think this really has anything to do with Samba, the error messages seem to be coming from cups. Rowland
Van Svensson
2017-Aug-06 05:44 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
Rowland Penny wrote:> On Sat, 5 Aug 2017 19:06:49 +0200 > Van Svensson via samba <samba at lists.samba.org> wrote: > > > > > I should have mentioned this earlier, but the users does not exist > > > > in /etc/passwd, instead they are in LDAP and when they log in to > > > > the computer they get some Kerberos tickets for the domain and > > > > the file system. When printing on 14.04 they get another Kerberos > > > > ticket for the printing system according to "klist" after they > > > > have done "lpr" and printed a document. On 16.04 nothing is > > > > printed and the user gets no Kerberos ticket for the printing > > > > system and the job is left in "lpq". > > > > > > Are your main users running Windows ? > > > Are they members of an AD domain ? > > > > At my part of the organization most people are running Linux: Ubuntu > > 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but > > after the upgrade the printing does no longer work. Centrally at the > > organization they are running Windows and we Linux users are using > > the centrally provided printing system through SMB-Kerberos. > > Everything works fine in 14.04. After upgrading to 16.04 everything > > works except the printing. > > > > As I mentioned earlier I see that double backslashes are used in > > 16.04 when SMBSPOOL_KRB5 is setting KRB5CCNAME, can that cause this > > problem? Ubuntu 16.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - > > Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' Ubuntu > > 14.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to > > 'FILE:/tmp/krb5cc_1000' > > > > Do you have any idea about what the error "HTTP_STATE_WAITING Closing > > for error 32 (Broken pipe)" can tell me in this situation when it is > > printed right after SMBSPOOL_KRB5 has set KRB5CCNAME? > > > > Also wondering about why I get this right after the above error: > > "Could not determine network interfaces, you must use a interfaces > > config line" > > > > (As a side note, not sure if it is interesting, but I see in > > the /var/log/cups/error_log that SMBSPOOL_KRB5 sets KRB5CCNAME > > to /tmp/krb5cc_UID (where UID is >= 1000). In our environment the > > user gets /tmp/krb5cc_UID_RANDOM (where RANDOM is a random string) > > from Heimdal Kerberos when logging in so in 14.04 (where printing > > works) you have to create a symbolic link from /tmp/krb5cc_UID > > to /tmp/krb5cc_UID_RANDOM to have the printing work which we do > > through a small script in /etc/profile.d/. Maybe this has been fixed > > in later versions of Samba so that we do not need to create this > > symbolic link for each user? (Of course I have checked that this > > symbolic link creation works in 16.04.)) > > To be honest, I don't think this really has anything to do with Samba, > the error messages seem to be coming from cups.Ok, so if I understand things correctly, in the log sequence below CUPS is calling "smbspool_krb5_wrapper" (since /usr/lib/cups/backend/smb is a symbolic link to /usr/bin/smbspool_krb5_wrapper) and then CUPS is logging those lines starting with "[Job 89] SMBSPOOL_KRB5", but how can CUPS know that it should set e.g. KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' - isn't that something coming from smbspool_krb5_wrapper (part of the smbclient package)? D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Started with uid=0 D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - AUTH_INFO_REQUIRED=negotiate D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Switching to gid=1000 D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Switching to uid=1000 D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' D [05/Aug/2017:12:52:04 +0200] [Client 12] HTTP_STATE_WAITING Closing for error 32 (Broken pipe) D [05/Aug/2017:12:52:04 +0200] [Client 12] Closing connection. D [05/Aug/2017:12:52:04 +0200] cupsdSetBusyState: newbusy="Printing jobs and dirty files", busy="Printing jobs and dirty files" E [05/Aug/2017:12:52:04 +0200] [Job 89] Could not determine network interfaces, you must use a interfaces config line
Van Svensson
2017-Aug-09 14:11 UTC
[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
Rowland Penny wrote:> On Sat, 5 Aug 2017 19:06:49 +0200 > Van Svensson via samba <samba at lists.samba.org> wrote: > > > > > I should have mentioned this earlier, but the users does not exist > > > > in /etc/passwd, instead they are in LDAP and when they log in to > > > > the computer they get some Kerberos tickets for the domain and > > > > the file system. When printing on 14.04 they get another Kerberos > > > > ticket for the printing system according to "klist" after they > > > > have done "lpr" and printed a document. On 16.04 nothing is > > > > printed and the user gets no Kerberos ticket for the printing > > > > system and the job is left in "lpq". > > > > > > Are your main users running Windows ? > > > Are they members of an AD domain ? > > > > At my part of the organization most people are running Linux: Ubuntu > > 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but > > after the upgrade the printing does no longer work. Centrally at the > > organization they are running Windows and we Linux users are using > > the centrally provided printing system through SMB-Kerberos. > > Everything works fine in 14.04. After upgrading to 16.04 everything > > works except the printing. > > > > [...] > > > > Do you have any idea about what the error "HTTP_STATE_WAITING Closing > > for error 32 (Broken pipe)" can tell me in this situation when it is > > printed right after SMBSPOOL_KRB5 has set KRB5CCNAME? > > > > Also wondering about why I get this right after the above error: > > "Could not determine network interfaces, you must use a interfaces > > config line" > > To be honest, I don't think this really has anything to do with Samba, > the error messages seem to be coming from cups.I found out that if I set "interfaces = 127.0.0.0/8 MYINTERFACE" and "bind interfaces only = yes" in /etc/samba/smb.conf then the printing works. I am curious why I need to do that in Ubuntu 16.04 but not in Ubuntu 14.04. I see that the naming of the interfaces in 16.04 has changed to e.g. "enp0s25" instead of e.g. "eth2" but shouldn't Samba 2:4.3.11+dfsg-0ubuntu0.16.04.9 be able to detect the network interface automatically? Best regards, Van
Seemingly Similar Threads
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04
- Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04