I have a very frustrating problem I'm trying to solve for a few days now, maybe one of you can help me.
I have two (standalone) samba servers which should authenticate the users using an LDAP server. Both samba servers use LDAP for nss and unix user authentication (i.e. ssh works for all LDAP users, getent passwd/group shows all users/groups) correctly. However, samba does only work on server 1 but not server 2, there I get
[2013/06/06 19:03:06.972236, 3] auth/auth.c:216(check_ntlm_password) check_ntlm_password: Checking password for unmapped user [XXX]\[xxx]@[XXX] with the new password interface [2013/06/06 19:03:06.972266, 3] auth/auth.c:219(check_ntlm_password) check_ntlm_password: mapped user is: [YYY]\[xxx]@[XXX] [2013/06/06 19:03:06.972311, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2013/06/06 19:03:06.972334, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2013/06/06 19:03:06.972351, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2013/06/06 19:03:06.972395, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2013/06/06 19:03:06.972414, 3] auth/auth_sam.c:399(check_sam_security) check_sam_security: Couldn't find user 'xxx' in passdb. [2013/06/06 19:03:06.972432, 2] auth/auth.c:314(check_ntlm_password) check_ntlm_password: Authentication for user [xxx] -> [xxx] FAILED with error NT_STATUS_NO_SUCH_USER [2013/06/06 19:03:06.972463, 3] smbd/error.c:80(error_packet_set) error packet at smbd/sesssetup.c(111) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE
The general section of the smb.conf is exactly the same on both servers. However, server 1 uses LDAP correctly:
[2013/06/06 19:15:38.458920, 3] auth/auth.c:216(check_ntlm_password) check_ntlm_password: Checking password for unmapped user [YYY]\[xxx]@[XXX] with the new password interface [2013/06/06 19:15:38.458941, 3] auth/auth.c:219(check_ntlm_password) check_ntlm_password: mapped user is: [XXX]\[xxx]@[XXX] [2013/06/06 19:15:38.458961, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2013/06/06 19:15:38.458974, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2013/06/06 19:15:38.458987, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2013/06/06 19:15:38.465392, 3] lib/smbldap.c:735(smb_ldap_start_tls) StartTLS issued: using a TLS connection [2013/06/06 19:15:38.479800, 2] lib/smbldap.c:950(smbldap_open_connection) smbldap_open_connection: connection opened [2013/06/06 19:15:38.481107, 3] lib/smbldap.c:1166(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server [2013/06/06 19:15:38.481136, 4] lib/smbldap.c:1242(smbldap_open) The LDAP server is successfully connected [2013/06/06 19:15:38.481922, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: ldaplookup
The only significant difference is that server 1 is a debian 6.0.3 with samba 3.5.6 and server 2 is a CentOS 6.3 with samba 3.5.10. The configuration files of ldap and pam are in different places, but samba looks identical to me. Here's the smb.conf w/o shares:
[global] workgroup = XXX server string = %h server dns proxy = no name resolve order = lmhosts host wins bcast hosts allow = 127.0.0.0/8 192.168.99.0/24 172.24.0.0/16 172.25.0.0/16 172.30.0.0/16 log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d encrypt passwords = true passdb backend = ldapsam:ldap://myldapserver ldap suffix = dc=mydomain,dc=com ldap admin dn = cn=replicator,dc=mydomain,dc=com ldap user suffix = ou=users ldap group suffix = ou=groups ldap machine suffix = ou=computers ldap passwd sync = Yes ldap ssl = start tls ldap debug level = 4 log level = 4 obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes
I was looking into guides and tutorials for the last few days but mostly they used winbind and idmap, but since my setup works for one server I don't see the need for setting up additional services. There must be an error in the configuration somewhere I cannot see. Since I only used debian and ubuntu as server OS before I don't know if I'm missing something simple which I have to enable/disable/change in centOS.
I reloaded (but not restarted) the samba service on both servers after changing the configuration. Restarting is not possible for the next days as users are working in it 24/7 and a restart would drop the connection afaik. However, the configuration was, according to log.smbd, updated:
[2013/06/06 19:44:15.896620, 3] param/loadparm.c:7873(do_section) Processing section "[global]" ... doing parameter passdb backend = ldapsam:ldap://myldapserver doing parameter ldap suffix = dc=mydomain,dc=com ...
And changing stuff like debug level works. Could this be the problem, that a reload only reloads some parts of the configuration but not all?
I'm thankful for every hint!