samba - Nov 2019 - security=domain fails after upgr. to 4.9, winbind doesn't help

Hi Rowland,

thanks for all your input!

Rowland penny via samba wrote:
> Could it be Selinux or Apparmor (not sure which SLES uses) stopping smbd
> contacting winbindd ?
No, none of these is running on our systems.
  
> Could the SLES Samba packages be wrong ?
Yes, that's a possibility. I opened a SR with SUSE support, but they
usually take some time to analyse and propose a solution. I asked here
because I thought there might be an obvious mis-configuration that
I did and that expers on this list would immediately see :-) But
if that's not then I guess an error in the SuSE packages is likely.
  
> Have you tried starting smbd and then winbind ?
Yes, in all combinations and restarts etc. Nothing helped :-(


-- 
Dipl.-Inform. Frank Steiner   Web:  http://www.bio.ifi.lmu.de/~steiner/
Lehrstuhl f. Bioinformatik    Mail: http://www.bio.ifi.lmu.de/~steiner/m/
LMU, Amalienstr. 17           Phone: +49 89 2180-4049
80333 Muenchen, Germany       Fax:   +49 89 2180-99-4049
* Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

On 11/29/19 10:04 AM, Frank Steiner via samba wrote:
> Hi Rowland,
> 
> thanks for all your input!
> 
> Rowland penny via samba wrote:
> 
>> Could it be Selinux or Apparmor (not sure which SLES uses) stopping
smbd
>> contacting winbindd ?
> 
> No, none of these is running on our systems.
> ?
>> Could the SLES Samba packages be wrong ?
> 
> Yes, that's a possibility. I opened a SR with SUSE support, but they
> usually take some time to analyse and propose a solution. I asked here
> because I thought there might be an obvious mis-configuration that
> I did and that expers on this list would immediately see :-) But
> if that's not then I guess an error in the SuSE packages is likely.
> ?
>> Have you tried starting smbd and then winbind ?
> 
> Yes, in all combinations and restarts etc. Nothing helped :-(
which doesn't surprise me. Wasn't "security=domain" removed in
that
timeframe?

You may want to switch to security=ads.w

-slow

-- 
Ralph Boehme, Samba Team                https://samba.org/
Samba Developer, SerNet GmbH   https://sernet.de/en/samba/
GPG-Fingerprint   FAE2C6088A24252051C559E4AA1E9B7126399E46

On 29/11/2019 09:13, Ralph Boehme via samba wrote:
> On 11/29/19 10:04 AM, Frank Steiner via samba wrote:
>> Hi Rowland,
>>
>> thanks for all your input!
>>
>> Rowland penny via samba wrote:
>>
>>> Could it be Selinux or Apparmor (not sure which SLES uses) stopping
smbd
>>> contacting winbindd ?
>> No, none of these is running on our systems.
>>   
>>> Could the SLES Samba packages be wrong ?
>> Yes, that's a possibility. I opened a SR with SUSE support, but
they
>> usually take some time to analyse and propose a solution. I asked here
>> because I thought there might be an obvious mis-configuration that
>> I did and that expers on this list would immediately see :-) But
>> if that's not then I guess an error in the SuSE packages is likely.
>>   
>>> Have you tried starting smbd and then winbind ?
>> Yes, in all combinations and restarts etc. Nothing helped :-(
> which doesn't surprise me. Wasn't "security=domain"
removed in that
> timeframe?
No, it is still there, 'security = domain' == Nt4-style PDC,
'security =
ADS' == AD DC
>
> You may want to switch to security=ads.w
Well yes, but this would entail a classicupgrade

Rowland

Hi,

Ralph Boehme via samba wrote:
> which doesn't surprise me. Wasn't "security=domain"
removed in that
> timeframe?
I've found no hint that security=domain was removed. Do you have a
reference for that?
https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
still lists it as option and in many examples.
> You may want to switch to security=ads.w
We have no ADS realm and no kerberos installation.

cu,
Frank


-- 
Dipl.-Inform. Frank Steiner   Web:  http://www.bio.ifi.lmu.de/~steiner/
Lehrstuhl f. Bioinformatik    Mail: http://www.bio.ifi.lmu.de/~steiner/m/
LMU, Amalienstr. 17           Phone: +49 89 2180-4049
80333 Muenchen, Germany       Fax:   +49 89 2180-99-4049
* Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *