Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up a PDC using Samba, LDAP and Postgresql. I have successfully added all the necessari entries to my database and can also see all the necessary entreis in LDAP.

I can also successfully join my windows XP machine to the domain. The problem is that once the machine is connected and after reboot, I cannot login using any of the usernames I have in LDAP even the one having administrative rights with which I had just joined the machine to the domain. I receive the following error:

Windows cannot connect to the domain, either because the domain controller is down or otherwise unavailable, or because your computer account was not found. Please try again later. If this message continues to appear contact your system administrator

I have also tried to use the net test in cmd:

C:\ net user testuser1 secret /domain The request will be processed at a domain controller for domain EXAMPLE.

System error 1326 has occured.

Login failure: Unknown user name or bad password.

Interesting point is that I had just used user 'testuser1' to join the machine to the domain and it worked. I have also added the machine account to ly database.

I would be grateful if anyone could give me any hints to what might be the problem here. Since I have create all the tables in my databse myself and have manually done all the attribute mappings, I suspect that some attribute might be missing somewhere for one of the entries.

System info:

OpenLDAP 2.4.35

Samba 3.6.3

Ubuntu Precise 12.04

Log level 3 for the machine when I try to logon in the welcome screen:

[2013/07/02 10:42:21.351168, 3] auth/auth.c:219(check_ntlm_password) check_ntlm_password: Checking password for unmapped user [][]@[ALI] with the new password interface [2013/07/02 10:42:21.351378, 3] auth/auth.c:222(check_ntlm_password) check_ntlm_password: mapped user is: [EXAMPLE][]@[ALI] [2013/07/02 10:42:21.351550, 3] auth/auth.c:268(check_ntlm_password) check_ntlm_password: guest authentication for user [] succeeded [2013/07/02 10:42:21.356908, 2] lib/smbldap.c:1018(smbldap_open_connection) smbldap_open_connection: connection opened [2013/07/02 10:42:21.431712, 3] lib/smbldap.c:1240(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server [2013/07/02 10:42:21.806045, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
pdb_create_builtin_alias: Could not get a gid out of winbind [2013/07/02 10:42:21.806259, 2] auth/token_util.c:479(finalize_local_nt_token) WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids? [2013/07/02 10:42:24.631502, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init) NTLMSSP Sign/Seal - Initialising with flags: [2013/07/02 10:42:24.631749, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags) Got NTLMSSP neg_flags=0xa2088205 [2013/07/02 10:42:24.631909, 3] smbd/password.c:297(register_existing_vuid) register_existing_vuid: User name: nobody Real name: (null) [2013/07/02 10:42:24.632076, 3] smbd/password.c:307(register_existing_vuid) register_existing_vuid: UNIX uid 65534 is UNIX user nobody, and will be vuid 100 [2013/07/02 10:42:24.634098, 3] smbd/process.c:1662(process_smb) Transaction 3 of length 90 (0 toread) [2013/07/02 10:42:24.634241, 3] smbd/process.c:1467(switch_message) switch message SMBtconX (pid 2871) conn 0x0 [2013/07/02 10:42:24.634457, 3] lib/access.c:338(allow_access) Allowed connection from 192.168.0.25 (192.168.0.25) [2013/07/02 10:42:24.634638, 3] smbd/service.c:837(make_connection_snum) Connect path is '/tmp' for service [IPC$] [2013/07/02 10:42:24.634855, 3] smbd/vfs.c:102(vfs_init_default) Initialising default vfs hooks [2013/07/02 10:42:24.635016, 3] smbd/vfs.c:128(vfs_init_custom)
Initialising custom vfs hooks from [/[Default VFS]/] [2013/07/02 10:42:24.636214, 3] smbd/service.c:1081(make_connection_snum) ali (192.168.0.25) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 2871) [2013/07/02 10:42:24.636462, 3] smbd/reply.c:871(reply_tcon_and_X) tconX service=IPC$ [2013/07/02 10:42:24.637178, 3] smbd/process.c:1662(process_smb) Transaction 4 of length 108 (0 toread) [2013/07/02 10:42:24.637311, 3] smbd/process.c:1467(switch_message) switch message SMBntcreateX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.638633, 3] smbd/process.c:1662(process_smb) Transaction 5 of length 140 (0 toread) [2013/07/02 10:42:24.638767, 3] smbd/process.c:1467(switch_message) switch message SMBwriteX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.638993, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req) api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon [2013/07/02 10:42:24.639143, 3] rpc_server/srv_pipe.c:339(check_bind_req) check_bind_req for \netlogon [2013/07/02 10:42:24.639270, 3] rpc_server/srv_pipe.c:346(check_bind_req) check_bind_req: \PIPE\netlogon -> \PIPE\netlogon [2013/07/02 10:42:24.639442, 3] smbd/pipes.c:361(pipe_write_andx_done) writeX-IPC nwritten=72 [2013/07/02 10:42:24.640300, 3] smbd/process.c:1662(process_smb)
Transaction 6 of length 63 (0 toread) [2013/07/02 10:42:24.640641, 3] smbd/process.c:1467(switch_message) switch message SMBreadX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.640911, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context) free_pipe_context: destroying talloc pool of size 26 [2013/07/02 10:42:24.641565, 3] smbd/pipes.c:485(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=72 [2013/07/02 10:42:24.642875, 3] smbd/process.c:1662(process_smb) Transaction 7 of length 164 (0 toread) [2013/07/02 10:42:24.643190, 3] smbd/process.c:1467(switch_message) switch message SMBwriteX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.643582, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) api_rpcTNP: rpc command: NETR_SERVERREQCHALLENGE [2013/07/02 10:42:24.644025, 3] smbd/pipes.c:361(pipe_write_andx_done) writeX-IPC nwritten=96 [2013/07/02 10:42:24.645470, 3] smbd/process.c:1662(process_smb)
Transaction 8 of length 63 (0 toread) [2013/07/02 10:42:24.645826, 3] smbd/process.c:1467(switch_message) switch message SMBreadX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.646157, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context) free_pipe_context: destroying talloc pool of size 26 [2013/07/02 10:42:24.646487, 3] smbd/pipes.c:485(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=36 [2013/07/02 10:42:24.648392, 3] smbd/process.c:1662(process_smb) Transaction 9 of length 192 (0 toread) [2013/07/02 10:42:24.648547, 3] smbd/process.c:1467(switch_message) switch message SMBwriteX (pid 2871) conn 0x21219448 [2013/07/02 10:42:24.648767, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) api_rpcTNP: rpc command: NETR_SERVERAUTHENTICATE3 [2013/07/02 10:42:24.649162, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain) Returning domain sid for domain EXAMPLE -> S-1-5-21-3293726787-918720374-2706850127 [2013/07/02 10:42:25.268132, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: ali$ [2013/07/02 10:42:26.017966, 3] passdb/lookup_sid.c:1754(get_primary_group_sid) Forcing Primary Group to 'Domain Users' for ali$ [2013/07/02 10:42:26.019114, 3] rpc_server/rpc_handles.c:281(close_policy_hnd) Closed policy [2013/07/02 10:42:26.019272, 3] rpc_server/rpc_handles.c:281(close_policy_hnd) Closed policy [2013/07/02 10:42:26.019646, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo) User:[ali$] [2013/07/02 10:42:26.020013, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo) User:[ali$]

share|improve this question
    
What is in the server logs of the PDC? –  Jenny D Jul 1 '13 at 12:53
    
A wild guess: are machine accounts still suffixed with a $ sign? I setup my domain controller so that it makes machine accounts automatically, and all machine accounts are blabla$. –  Halfgaar Jul 1 '13 at 19:34
    
Yes I have attached the dollar sign. I have also tested the machine names by trying to join a machine whose account doesn't exist in my postgresql database and it fails. It works only when I add the account. –  alibaba Jul 2 '13 at 8:30
    
Here is the samba log of the concerned machine (xp20; the domain is EXAMPLE): –  alibaba Jul 2 '13 at 8:38
    
Since the logs in the PDC are long I put them in the question. I have put log level 3. –  alibaba Jul 2 '13 at 8:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.