samba - Nov 2023 - WInbind hang?

Hello

We are running several Red Hat 7 servers as domain members using AD for winbind
idmap backend and it had been working fine (no sssd is configured either)

The last month or so (possibly since the latest samba-winbind package update we
applied on Sep 24), server ssh logins on several servers hang on occasion, until
a winbind restart, when it all works again

Since this is the Red Hat supplied samba-winbind I do have a ticket open with
them but thought I might pose a question here too in case it sounds familiar to
anyone

We ALWAYS see this entry in log.winbindd at the moment the problem happens ..

[2023/10/31 13:51:05.544086,  1]
../../source3/winbindd/winbindd_dual.c:337(wb_child_request_cleanup)
  wb_child_request_cleanup: keep orphaned subreq[0x55cbee9dc870]

but, we never see what appears to be the "response", when the problem
does not happen like this ..

[2023/09/06 16:51:23.703029,  1]
../../source3/winbindd/winbindd_dual.c:337(wb_child_request_cleanup)
  wb_child_request_cleanup: keep orphaned subreq[0x555c02252ca0]
[2023/09/06 16:52:07.229083,  1]
../../source3/winbindd/winbindd_dual.c:281(wb_child_request_orphaned)
  wb_child_request_orphaned: cleanup orphaned subreq[0x555c02252ca0]

One other thing, when the problem occurs, the restart of winbind seems to kill
winbindd processes except one, which hangs out for something like 60 seconds,
then eventually dies and new processes show up

Thanks,

Rob




----------------------------------------------------------------------
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information.  No one
else may read, print, store, copy, forward or act in reliance on it or its
attachments.  If you are not the intended recipient, please return this message
to the sender and delete the message and any attachments from your computer.
Your cooperation is appreciated.

I've had that happen in the past with non-RedHat linux boxes.
Fortunately we have Saltstack on all the boxes and can just salt '*'
cmd.run 'killall -SIGKILL winbindd; service winbind restart'

But it hangs SSH sessions and things like 'ls -lha' that need to resolve
usernames and groups.

i.e. if you removed winbind from /etc/nsswitch.conf it would stop happening.

The issue stopped happening to us in more recent versions.  We're
using 4.17.12 from the Debian repos.
The last time I used RedHat, I noticed they loved having software that was
wildly out-of-date in the name of stability and compatibility.  YMMV. ;)

-A

On Thu, Nov 16, 2023 at 1:32?PM Vaughan, Robert J via samba <
samba at lists.samba.org> wrote:
> Hello
>
> We are running several Red Hat 7 servers as domain members using AD for
> winbind idmap backend and it had been working fine (no sssd is configured
> either)
>
> The last month or so (possibly since the latest samba-winbind package
> update we applied on Sep 24), server ssh logins on several servers hang on
> occasion, until a winbind restart, when it all works again
>
> Since this is the Red Hat supplied samba-winbind I do have a ticket open
> with them but thought I might pose a question here too in case it sounds
> familiar to anyone
>
> We ALWAYS see this entry in log.winbindd at the moment the problem happens
> ..
>
> [2023/10/31 13:51:05.544086,  1]
> ../../source3/winbindd/winbindd_dual.c:337(wb_child_request_cleanup)
>   wb_child_request_cleanup: keep orphaned subreq[0x55cbee9dc870]
>
> but, we never see what appears to be the "response", when the
problem does
> not happen like this ..
>
> [2023/09/06 16:51:23.703029,  1]
> ../../source3/winbindd/winbindd_dual.c:337(wb_child_request_cleanup)
>   wb_child_request_cleanup: keep orphaned subreq[0x555c02252ca0]
> [2023/09/06 16:52:07.229083,  1]
> ../../source3/winbindd/winbindd_dual.c:281(wb_child_request_orphaned)
>   wb_child_request_orphaned: cleanup orphaned subreq[0x555c02252ca0]
>
> One other thing, when the problem occurs, the restart of winbind seems to
> kill winbindd processes except one, which hangs out for something like 60
> seconds, then eventually dies and new processes show up
>
> Thanks,
>
> Rob
>
>
>
>
> ----------------------------------------------------------------------
> This is an e-mail from General Dynamics Land Systems. It is for the
> intended recipient only and may contain confidential and privileged
> information.  No one else may read, print, store, copy, forward or act in
> reliance on it or its attachments.  If you are not the intended recipient,
> please return this message to the sender and delete the message and any
> attachments from your computer. Your cooperation is appreciated.
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>