I have samba 3.0.20b with ldapsam. Two way trust. After update to 3.0.21a trust relationship failed. Upon attempt to check trusts from Windows 2000 Server (SP4) samba log for the server gives (ISMA-ACNT is trusted domain): [2006/01/12 13:13:38, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/01/12 13:13:38, 0] rpc_server/srv_netlog_nt.c:_net_sam_logon(665) _net_sam_logon: creds_server_step failed. Rejecting auth request from client ISMA-ACNT-SRV machine account ISMA-ACNT$ [2006/01/12 13:13:38, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/01/12 13:13:38, 0] rpc_server/srv_netlog_nt.c:_net_sam_logon(665) _net_sam_logon: creds_server_step failed. Rejecting auth request from client ISMA-ACNT-SRV machine account ISMA-ACNT$ [2006/01/12 13:13:38, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/01/12 13:13:38, 0] rpc_server/srv_netlog_nt.c:_net_sam_logon(665) _net_sam_logon: creds_server_step failed. Rejecting auth request from client ISMA-ACNT-SRV machine account ISMA-ACNT$ [2006/01/12 13:13:38, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/01/12 13:13:38, 0] rpc_server/srv_netlog_nt.c:_net_sam_logon(665) _net_sam_logon: creds_server_step failed. Rejecting auth request from client ISMA-ACNT-SRV machine account ISMA-ACNT$ [2006/01/12 13:14:04, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/01/12 13:14:04, 0] rpc_server/srv_netlog_nt.c:_net_sam_logon(665) _net_sam_logon: creds_server_step failed. Rejecting auth request from client ISMA-ACNT-SRV machine account ISMA-ACNT$ Even worse, after I rollback to 3.0.20b trust relations check passed, but I still can not connect to shares on samba domain server from trusted Windows 2000 domain. Share has following permissions: valid users = @samba_domain_group, ISMA-ACNT\user Attempt to map the samba share from ISMA-ACNT domain machine with ISMA-ACNT\user valid credentials fails with: [2006/01/12 13:15:37, 0] auth/auth_util.c:make_server_info_info3(1297) make_server_info_info3: pdb_init_sam failed! In case of deliberately wrong password for user ISMA-ACNT\user log shows: [2006/01/12 13:09:31, 0] auth/auth_domain.c:domain_client_validate(238) domain_client_validate: unable to validate password for user acnttest in domain ISMA-ACNT to Domain controller ISMA-ACNT-SRV. Error was NT_STATUS_WRONG_PASSWORD.
Created attachment 1670 [details] config file the shorted config file
This is much worse than it looks. Two 3.0.20b systems with a two way trust (ACDEV <-> DEVEX): * XP-SP2 joins DEVEX (log on to box shows: local computer, ACDEV and DEVEX) * User from DEVEX logs in DEXEV ok. * User from ACDEV logs into DEVEX ok. * Same user from ACDEV logs into ACDEV ok. Everything is perfect. Two 3.0.21a systems with a two way trust (ACDEV <->DEVEX): * XP-SP2 joins DEVEX (log on to box shows: local computer, ACDEV and DEVEX) * User from DEVEX log in DEVEX ok. * User from ACDEV attemps login to DEVEX. At this point the smbds on both servers attemps to check EXDEV$ and ACEDEV$ credentials (the NETBIOS names of the servers). They think each other is a Domain Member server and forget there is a trust established. What's worse is this begins a cyclical connect from smbd to each others winbindd that eventually (within 5 minutes for my testing) causes winbindd to use up all 200 connections on each system rendering both DC's dead. I'm collecting the logs now and will post here within the hour.
Thanks Bill. I'll fix this on Monday. Will need those logs though. Please attach them here.
Created attachment 1682 [details] log files from one side of two way trust.
Created attachment 1683 [details] log files from other side of two way trust.
Bill, any chance you could give the current SAMBA_3_0_RELEASE and see if this is still an issue. I remember a related checkin.
Bill says it looks ok now fopr 3.0.21b
Unfortunately the bug is still in place trough out 21a, 21b, 21c versions.
I cannot repro this anymore. Reopen if there is a problem in 3.0.24/3.0.25