Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very frustrating problem I'm trying to solve for a few days now, maybe one of you can help me.

I have two (standalone) samba servers which should authenticate the users using an LDAP server. Both samba servers use LDAP for nss and unix user authentication (i.e. ssh works for all LDAP users, getent passwd/group shows all users/groups) correctly. However, samba does only work on server 1 but not server 2, there I get

[2013/06/06 19:03:06.972236,  3] auth/auth.c:216(check_ntlm_password)
  check_ntlm_password:  Checking password for unmapped user [XXX]\[xxx]@[XXX] with the new password interface
[2013/06/06 19:03:06.972266,  3] auth/auth.c:219(check_ntlm_password)
  check_ntlm_password:  mapped user is: [YYY]\[xxx]@[XXX]
[2013/06/06 19:03:06.972311,  3] smbd/sec_ctx.c:210(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2013/06/06 19:03:06.972334,  3] smbd/uid.c:429(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2013/06/06 19:03:06.972351,  3] smbd/sec_ctx.c:310(set_sec_ctx)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2013/06/06 19:03:06.972395,  3] smbd/sec_ctx.c:418(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2013/06/06 19:03:06.972414,  3] auth/auth_sam.c:399(check_sam_security)
  check_sam_security: Couldn't find user 'xxx' in passdb.
[2013/06/06 19:03:06.972432,  2] auth/auth.c:314(check_ntlm_password)
  check_ntlm_password:  Authentication for user [xxx] -> [xxx] FAILED with error NT_STATUS_NO_SUCH_USER
[2013/06/06 19:03:06.972463,  3] smbd/error.c:80(error_packet_set)
  error packet at smbd/sesssetup.c(111) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE

The general section of the smb.conf is exactly the same on both servers. However, server 1 uses LDAP correctly:

[2013/06/06 19:15:38.458920,  3] auth/auth.c:216(check_ntlm_password)
  check_ntlm_password:  Checking password for unmapped user [YYY]\[xxx]@[XXX] with the new password interface
[2013/06/06 19:15:38.458941,  3] auth/auth.c:219(check_ntlm_password)
  check_ntlm_password:  mapped user is: [XXX]\[xxx]@[XXX]
[2013/06/06 19:15:38.458961,  3] smbd/sec_ctx.c:210(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2013/06/06 19:15:38.458974,  3] smbd/uid.c:429(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2013/06/06 19:15:38.458987,  3] smbd/sec_ctx.c:310(set_sec_ctx)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2013/06/06 19:15:38.465392,  3] lib/smbldap.c:735(smb_ldap_start_tls)
  StartTLS issued: using a TLS connection
[2013/06/06 19:15:38.479800,  2] lib/smbldap.c:950(smbldap_open_connection)
  smbldap_open_connection: connection opened
[2013/06/06 19:15:38.481107,  3] lib/smbldap.c:1166(smbldap_connect_system)
  ldap_connect_system: successful connection to the LDAP server
[2013/06/06 19:15:38.481136,  4] lib/smbldap.c:1242(smbldap_open)
  The LDAP server is successfully connected
[2013/06/06 19:15:38.481922,  2] passdb/pdb_ldap.c:572(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: ldaplookup

The only significant difference is that server 1 is a debian 6.0.3 with samba 3.5.6 and server 2 is a CentOS 6.3 with samba 3.5.10. The configuration files of ldap and pam are in different places, but samba looks identical to me. Here's the smb.conf w/o shares:

[global]
   workgroup = XXX
   server string = %h server
   dns proxy = no
   name resolve order = lmhosts host wins bcast
   hosts allow = 127.0.0.0/8 192.168.99.0/24 172.24.0.0/16 172.25.0.0/16 172.30.0.0/16
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   encrypt passwords = true
   passdb backend = ldapsam:ldap://myldapserver
   ldap suffix = dc=mydomain,dc=com
   ldap admin dn = cn=replicator,dc=mydomain,dc=com
   ldap user suffix = ou=users
   ldap group suffix = ou=groups
   ldap machine suffix = ou=computers
   ldap passwd sync = Yes
   ldap ssl = start tls
   ldap debug level = 4
   log level = 4
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes

I was looking into guides and tutorials for the last few days but mostly they used winbind and idmap, but since my setup works for one server I don't see the need for setting up additional services. There must be an error in the configuration somewhere I cannot see. Since I only used debian and ubuntu as server OS before I don't know if I'm missing something simple which I have to enable/disable/change in centOS.

I reloaded (but not restarted) the samba service on both servers after changing the configuration. Restarting is not possible for the next days as users are working in it 24/7 and a restart would drop the connection afaik. However, the configuration was, according to log.smbd, updated:

[2013/06/06 19:44:15.896620,  3] param/loadparm.c:7873(do_section)
  Processing section "[global]"
...
  doing parameter passdb backend = ldapsam:ldap://myldapserver
  doing parameter ldap suffix = dc=mydomain,dc=com
...

And changing stuff like debug level works. Could this be the problem, that a reload only reloads some parts of the configuration but not all?

I'm thankful for every hint!

share|improve this question
    
I found a hint how to restart samba without a connection loss: ubuntuforums.org/showthread.php?t=903896 The user there states that sending SIGHUP to the root smbd process would restart samba but not kill the active connections. Can someone backup/verify this statement? –  Phil Jun 7 '13 at 11:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.