We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when querying groups using the groups command and/or sudo. Getent and winbind however return correct consistent results on all servers.
user.name1 and user.name2 are members of the group test.group1. test.group1 is a member of the group test.group2
Running the following commands is consistent on all servers:
# getent group test.group1 test.group1:*:16126:user.name1,user.name2 # getent group test.group2 test.group2:*:16125:user.name1,user.name2 # wbinfo --group-info test.group1 test.group1:*:16126:user.name1,user.name2 # wbinfo --group-info test.group2 test.group2:*:16125:user.name1,user.name2
However server A incorrectly returns:
# groups user.name2 test.group1
Server B correctly returns:
# groups user.name2 test.group1 test.group2
The Samba config looks like:
winbind use default domain = true winbind offline logon = false winbind separator = + winbind enum users = Yes winbind enum groups = Yes winbind nested groups = Yes winbind expand groups = 10 server string = Linux Server strict locking = no wins server = 192.168.0.1 idmap config * : range = 10000-50000000 idmap config * : backend = rid idmap config SENT : range = 10000-50000000 idmap config SENT : default = yes idmap config SENT : backend = rid idmap uid = 10000-50000000 idmap gid = 10000-50000000
nsswitch.conf looks like:
passwd: files winbind shadow: files winbind group: files winbind
I'd hazard a guess to say the answer is somewhere in PAM or perhaps a winbind lookup error, Any thoughts or suggestions as where to look? Winbind / servers have been restarted, tdb files rebuilt. The problem may be intermittent as well.