Bug 9694 - Winbind sid lookup issue
Winbind sid lookup issue
Status: RESOLVED WORKSFORME
Product: Samba 3.6
Classification: Unclassified
Component: Winbind
3.6.12
x64 FreeBSD
: P5 normal
: ---
Assigned To: Michael Adam
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-03-01 19:09 UTC by Mike
Modified: 2015-03-08 16:39 UTC (History)
0 users

See Also:


Attachments
winbind -i -d10 output (499.96 KB, application/x-gzip)
2013-03-05 02:11 UTC, Mike
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mike 2013-03-01 19:09:33 UTC
We recently had to switch from 3.5.x to 3.6, due to the ports tree dropping
3.5

Since then, I've have had issues with the looking up users consistently. It
may work for 30 minutes, and then stop.

I finally started to run winbindd -i -d and here are some of my findings:

Environment:

OS: FreeBSD 9.1-RELEASE
uname -a: FreeBSD pkg-server 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825:
Tue Dec  4 09:23:10 UTC 2012
root at farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
amd64

Samba:
pkg info -f samba36
Name           : samba36
Version        : 3.6.12
Origin         : net/samba36
Prefix         : /usr/local
Categories     : net
Licenses       : GPLv3
Maintainer     : timur at FreeBSD.org
WWW            : http://www.samba.org/
Comment        : A free SMB and CIFS client and server for UNIX
Options        :
        LDAP: on
        ADS: on
        CUPS: off
        WINBIND: on
        SWAT: off
        ACL_SUPPORT: on
        AIO_SUPPORT: on
        FAM_SUPPORT: off
        SYSLOG: off
        QUOTAS: off
        UTMP: off
        PAM_SMBPASS: off
        DNSUPDATE: on
        AVAHI: off
        PTHREADPOOL: on
        EXP_MODULES: on
        POPT: on
        IPV6: on
        MAX_DEBUG: off
        SMBTORTURE: off

smb.conf:
[global]
 workgroup = DISCDRIVE
 server string = Samba Server
 security = ads
 log file = /var/log/samba/log.%m
 max log size = 50
 realm = DISCDRIVE.BAYPHOTO.COM
 wins server = dc-3.discdrive.bayphoto.com
 dns proxy = no
 kerberos method = system keytab

 idmap config DISCDRIVE : backend = rid
 idmap config DISCDRIVE : range = 20001-30000
 idmap config DISCDRIVE : base_rid = 0
 idmap config BAYPHOTO : backend = rid
 idmap config BAYPHOTO : range = 10000-20000
 idmap config BAYPHOTO : base_rid = 0
 idmap config DISCDRIVE : default = yes

 allow trusted domains = Yes
 winbind use default domain = yes
 winbind enum users = Yes
 winbind enum groups = Yes
 template shell = /bin/zsh

 template homedir = /home/%D/%U
 winbind use default domain=Yes
 winbind nss info = sfu
 winbind offline logon = Yes
 winbind refresh tickets = True
 winbind nested groups = Yes
 winbind cache time = 3600

 winbind reconnect delay = 30
 winbind expand groups = 10
 winbind max domain connections = 10

 max protocol = SMB2

I can look up some of our users, but I cannot see ALL of them, or I'll see
one and after a while it will no longer show up again.

I've removed /var/db/samba/*, ran net cache flush, restarted samba, but the
follow scenario happens everytime.

samba 3.6.12

freebsd 9.1-RELEASE

# id jenkins-ci
id: jenkins-ci: no such user
# pw usershow jenkins-ci
pw: no such user `jenkins-ci'
# pw usershow mikec
mikec:*:21208:20514::0:0:Mike Carlson:/home/DISCDRIVE/mikec:/bin/zsh
# getent passwd| grep jenkins
jenkins-ci:*:21608:20514:jenkins:/home/DISCDRIVE/jenkins-ci:/bin/zsh
# id 21608
id: 21608: no such user
# wbinfo -i mikec
mikec:*:21208:20514:Mike Carlson:/home/DISCDRIVE/mikec:/bin/zsh
# wbinfo -i jenkins-ci
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user jenkins-ci
# wbinfo -u|grep jenkins-ci
jenkins-ci

All the while, this is what winbindd reports:
winbindd -i -d9

getpwnam jenkins-ci
offline logons active, restricting max domain connections to 1
offline logons active, restricting max domain connections to 1
Could not convert sid S-1-5-21-1193775395-2634469651-4076480956-1607:
NT_STATUS_OBJECT_NAME_NOT_FOUND
closing socket 25, client exited
Comment 1 Björn Jacke 2013-03-01 22:06:38 UTC
as long as you have those parameters set to yes, you have an unsupportable setup in any case:

 winbind use default domain = yes
 winbind enum users = Yes
 winbind enum groups = Yes

if you changed those to yes and you still see this kind of problem, then please reopen this bug with attached winbind log files in log level 10.
Comment 2 Mike 2013-03-05 02:11:31 UTC
Created attachment 8608 [details]
winbind -i -d10 output
Comment 3 Mike 2013-03-05 02:13:08 UTC
(In reply to comment #1)
> as long as you have those parameters set to yes, you have an unsupportable
> setup in any case:
> 
>  winbind use default domain = yes
>  winbind enum users = Yes
>  winbind enum groups = Yes
> 
> if you changed those to yes and you still see this kind of problem, then please
> reopen this bug with attached winbind log files in log level 10.

I've attached the winbindd -i -d10 output

I'm unclear, because you say that using yes is unsupported, but to change it to yes and re-open the issue if I still have a problem.

So, along with the attached zip, here is testparm -v:

testparm -v
Load smb config files from /usr/local/etc/smb.conf
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
Press enter to see a dump of your service definitions

[global]
	dos charset = CP850
	unix charset = UTF-8
	display charset = LOCALE
	workgroup = DISCDRIVE
	realm = DISCDRIVE.BAYPHOTO.COM
	netbios name = PKG-SERVER
	netbios aliases = 
	netbios scope = 
	server string = Samba Server
	interfaces = 
	bind interfaces only = No
	security = ADS
	auth methods = 
	encrypt passwords = Yes
	client schannel = Auto
	server schannel = Auto
	allow trusted domains = Yes
	map to guest = Never
	null passwords = No
	obey pam restrictions = No
	password server = *
	smb passwd file = /usr/local/etc/samba/smbpasswd
	private dir = /usr/local/etc/samba
	passdb backend = tdbsam
	algorithmic rid base = 1000
	root directory = 
	guest account = nobody
	enable privileges = Yes
	pam password change = No
	passwd program = 
	passwd chat = *new*password* %n\n *new*password* %n\n *changed*
	passwd chat debug = No
	passwd chat timeout = 2
	check password script = 
	username map = 
	password level = 0
	username level = 0
	unix password sync = No
	restrict anonymous = 0
	lanman auth = No
	ntlm auth = Yes
	client NTLMv2 auth = Yes
	client lanman auth = No
	client plaintext auth = No
	client use spnego principal = No
	send spnego principal = No
	preload modules = 
	dedicated keytab file = 
	kerberos method = system keytab
	map untrusted to domain = No
	log level = 2
	syslog = 1
	syslog only = No
	log file = /var/log/samba/log.%m
	max log size = 50
	debug timestamp = Yes
	debug prefix timestamp = No
	debug hires timestamp = Yes
	debug pid = No
	debug uid = No
	debug class = No
	enable core files = Yes
	smb ports = 445 139
	large readwrite = Yes
	max protocol = NT1
	min protocol = CORE
	min receivefile size = 0
	read raw = Yes
	write raw = Yes
	disable netbios = No
	reset on zero vc = No
	log writeable files on exit = No
	acl compatibility = auto
	defer sharing violations = Yes
	nt pipe support = Yes
	nt status support = Yes
	announce version = 4.9
	announce as = NT
	max mux = 50
	max xmit = 16644
	name resolve order = lmhosts wins host bcast
	max ttl = 259200
	max wins ttl = 518400
	min wins ttl = 21600
	time server = No
	unix extensions = Yes
	use spnego = Yes
	client signing = auto
	server signing = No
	client use spnego = Yes
	client ldap sasl wrapping = plain
	enable asu support = No
	svcctl list = 
	deadtime = 0
	getwd cache = Yes
	keepalive = 300
	lpq cache time = 30
	max smbd processes = 0
	paranoid server security = Yes
	max disk size = 0
	max open files = 16384
	socket options = TCP_NODELAY
	use mmap = Yes
	hostname lookups = No
	name cache timeout = 660
	ctdbd socket = 
	cluster addresses = 
	clustering = No
	ctdb timeout = 0
	ctdb locktime warn threshold = 0
	smb2 max read = 65536
	smb2 max write = 65536
	smb2 max trans = 65536
	smb2 max credits = 8192
	load printers = Yes
	printcap cache time = 750
	printcap name = 
	cups server = 
	cups encrypt = No
	cups connection timeout = 30
	iprint server = 
	disable spoolss = No
	addport command = 
	enumports command = 
	addprinter command = 
	deleteprinter command = 
	show add printer wizard = Yes
	os2 driver map = 
	mangling method = hash2
	mangle prefix = 1
	max stat cache size = 256
	stat cache = Yes
	machine password timeout = 604800
	add user script = 
	rename user script = 
	delete user script = 
	add group script = 
	delete group script = 
	add user to group script = 
	delete user from group script = 
	set primary group script = 
	add machine script = 
	shutdown script = 
	abort shutdown script = 
	username map script = 
	username map cache time = 0
	logon script = 
	logon path = \\%N\%U\profile
	logon drive = 
	logon home = \\%N\%U
	domain logons = No
	init logon delayed hosts = 
	init logon delay = 100
	os level = 20
	lm announce = Auto
	lm interval = 60
	preferred master = No
	local master = No
	domain master = No
	browse list = Yes
	enhanced browsing = Yes
	dns proxy = No
	wins proxy = No
	wins server = dc-1.discdrive.bayphoto.com
	wins support = No
	wins hook = 
	kernel oplocks = Yes
	lock spin time = 200
	oplock break wait time = 0
	ldap admin dn = 
	ldap delete dn = No
	ldap group suffix = 
	ldap idmap suffix = 
	ldap machine suffix = 
	ldap passwd sync = no
	ldap replication sleep = 1000
	ldap suffix = 
	ldap ssl = start tls
	ldap ssl ads = No
	ldap deref = auto
	ldap follow referral = Auto
	ldap timeout = 15
	ldap connection timeout = 2
	ldap page size = 1024
	ldap user suffix = 
	ldap debug level = 0
	ldap debug threshold = 10
	eventlog list = 
	add share command = 
	change share command = 
	delete share command = 
	preload = 
	lock directory = /var/db/samba
	state directory = /var/db/samba
	cache directory = /var/db/samba
	pid directory = /var/run/samba
	default service = 
	message command = 
	get quota command = 
	set quota command = 
	remote announce = 
	remote browse sync = 
	socket address = 0.0.0.0
	nmbd bind explicit broadcast = Yes
	homedir map = 
	afs username map = 
	afs token lifetime = 604800
	log nt token command = 
	time offset = 0
	NIS homedir = No
	registry shares = No
	usershare allow guests = No
	usershare max shares = 0
	usershare owner only = Yes
	usershare path = /var/db/samba/usershares
	usershare prefix allow list = 
	usershare prefix deny list = 
	usershare template share = 
	allow insecure wide links = No
	async smb echo handler = No
	multicast dns register = Yes
	panic action = 
	perfcount module = 
	host msdfs = Yes
	passdb expand explicit = No
	idmap backend = tdb
	idmap cache time = 604800
	idmap negative cache time = 120
	idmap uid = 
	idmap gid = 
	template homedir = /home/%D/%U
	template shell = /bin/zsh
	winbind separator = \
	winbind cache time = 3600
	winbind reconnect delay = 30
	winbind max clients = 200
	winbind enum users = Yes
	winbind enum groups = Yes
	winbind use default domain = Yes
	winbind trusted domains only = No
	winbind nested groups = Yes
	winbind expand groups = 1
	winbind nss info = sfu
	winbind refresh tickets = Yes
	winbind offline logon = Yes
	winbind normalize names = No
	winbind rpc only = No
	create krb5 conf = Yes
	ncalrpc dir = /var/run/samba/ncalrpc
	winbind max domain connections = 1
	idmap config BAYPHOTO : base_rid = 0
	idmap config BAYPHOTO : range = 10000-20000
	idmap config BAYPHOTO : backend = rid
	idmap config DISCDRIVE : default = yes
	idmap config DISCDRIVE : base_rid = 0
	idmap config DISCDRIVE : range = 20001-30000
	idmap config DISCDRIVE : backend = rid
	idmap config * : backend = tdb
	comment = 
	path = 
	username = 
	invalid users = 
	valid users = 
	admin users = 
	read list = 
	write list = 
	printer admin = 
	force user = 
	force group = 
	read only = Yes
	acl check permissions = Yes
	acl group control = No
	acl map full control = Yes
	create mask = 0744
	force create mode = 00
	security mask = 0777
	force security mode = 00
	directory mask = 0755
	force directory mode = 00
	directory security mask = 0777
	force directory security mode = 00
	force unknown acl user = No
	inherit permissions = No
	inherit acls = No
	inherit owner = No
	guest only = No
	administrative share = No
	guest ok = No
	only user = No
	hosts allow = 
	hosts deny = 
	allocation roundup size = 1048576
	aio read size = 0
	aio write size = 0
	aio write behind = 
	ea support = No
	nt acl support = Yes
	profile acls = No
	map acl inherit = No
	afs share = No
	smb encrypt = auto
	block size = 1024
	change notify = Yes
	directory name cache size = 100
	kernel change notify = Yes
	max connections = 0
	min print space = 0
	strict allocate = No
	strict sync = No
	sync always = No
	use sendfile = No
	write cache size = 0
	max reported print jobs = 0
	max print jobs = 1000
	printable = No
	print notify backchannel = Yes
	print ok = No
	printing = bsd
	cups options = 
	print command = lpr -r -P'%p' %s
	lpq command = lpq -P'%p'
	lprm command = lprm -P'%p' %j
	lppause command = 
	lpresume command = 
	queuepause command = 
	queueresume command = 
	printer name = 
	use client driver = No
	default devmode = Yes
	force printername = No
	printjob username = %U
	default case = lower
	case sensitive = Auto
	preserve case = Yes
	short preserve case = Yes
	mangling char = ~
	hide dot files = Yes
	hide special files = No
	hide unreadable = No
	hide unwriteable files = No
	delete veto files = No
	veto files = 
	hide files = 
	veto oplock files = 
	map archive = Yes
	map hidden = No
	map system = No
	map readonly = yes
	mangled names = Yes
	store dos attributes = No
	dmapi support = No
	browseable = Yes
	access based share enum = No
	blocking locks = Yes
	csc policy = manual
	fake oplocks = No
	locking = Yes
	oplocks = Yes
	level2 oplocks = Yes
	oplock contention limit = 2
	posix locking = Yes
	strict locking = Auto
	share modes = Yes
	dfree cache time = 0
	dfree command = 
	copy = 
	preexec = 
	preexec close = No
	postexec = 
	root preexec = 
	root preexec close = No
	root postexec = 
	available = Yes
	volume = 
	fstype = NTFS
	set directory = No
	wide links = No
	follow symlinks = Yes
	dont descend = 
	magic script = 
	magic output = 
	delete readonly = No
	dos filemode = No
	dos filetimes = Yes
	dos filetime resolution = No
	fake directory create times = No
	vfs objects = 
	msdfs root = No
	msdfs proxy =
Comment 4 Mike 2013-03-05 02:15:18 UTC
Here are the commands that I ran during the debug output:

# id mikec
uid=21208(mikec) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id robm
uid=21179(robm) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id jenkins-ci
uid=21608(jenkins-ci) gid=20514(domain users) groups=20514(domain users)
# id mikec
uid=21208(mikec) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id robm
uid=21179(robm) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id jenkins-ci
uid=21608(jenkins-ci) gid=20514(domain users) groups=20514(domain users)
# id mikec
uid=21208(mikec) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id robm
uid=21179(robm) gid=20514(domain users) groups=20514(domain users),0(wheel)
# id jenkins-ci
uid=21608(jenkins-ci) gid=20514(domain users) groups=20514(domain users)
...
time passes
...
# id mikec
id: mikec: no such user
# id jenkins-ci
id: jenkins-ci: no such user
Comment 5 Björn Jacke 2015-03-08 16:39:21 UTC
there has been a FreeBSD related bug been fixed recently. Please test with latest 4.1 or 4.2 release. If you still encounter that problem, please reopen and attach the config of that 4.1/4.2 setup along with winbind log log. Thanks!