2

I asked this question on stackoverflow and realized I might get better responses here.

Attempting to set up Samba + OpenLDAP using nss_ldap uner Linux. Alls software is compiled by me from source so no RPMs, YUM, etc...

Using Pozix Linux which is our own distribution - vanilla login system meaning out of the box the distro relies on standard /etc/passwd, /etc/group.

Installed all necessary software to convert system to an LDAP based system which seems to work with other software such as SSH except SAMBA.

Was able to join Windows7 to Samba stand alone PDC, I can not login with a domain account unless that account is also added to the /etc/passwd file.

I get: user in passdb, but getpwnam() fails!

Everything I've read points to an NSS_LDAP issue. Here is a list of things I've done:

  1. getent passwd shows users perfectly fine
  2. I am able to ssh into the same Linux host using a user account that is only in the LDAP database.
  3. id test (test is my test account only in LDAP) that works
  4. ./pdbedit -Lv test works
  5. ./net rpc rights list accounts -Uroot works, I see root has all necessary rights
  6. per suggestion from stackoverflow, I changed my nsswitch.conf file from (files ldap) to (ldap files) which essentially changed the dump order of getent passwd & didn't resolve the issue.
  7. commented out rootbinddn and add the bindpw with clear-text version of the password to eliminate any questions with ldap.secret
  8. smb.conf has ldapsam:trusted = yes
  9. smb.conf and ldap.conf both have ssl off a
  10. Not running nscd

Everyting on the samba.org site chapter-5 about making users happy works except for:

./smbclient //tsrvr/test -Utest

This produces the subject error message in log.smbd and ldap debug log shows a query for test with no errors and a successful return value.

If I put 'test' into /etc/passwd, then it works!

It's as if the relationship between nss_ldap and smbd is broken and I stress relationship because LDAP appears OK (slapcat, ldapsearch, etc... all work)... It appears that nss_ldap library is getting a return value that when handed back to smbd, it somehow is not understood.

I would really appreciate any suggestions. I see this problem listed often. Often related to PAM but I'm not using PAM.

Additionally, if I crack open the /etc/passwd file and add a line for the user in question, I can then login.

I'm not using PAM. I added the two Windows7 registry updates required per the Samba.org site.

Software stack is as follows: Samba 3.5.3 OpenLDAP 2.4.21 nss_ldap 264

---------------------[ update ]---------------------

I began looking at Samba source code.

I found this function in samba3/auth/auth_util.c (about line 580)

auth_serversupplied_info *result; 
const char *username = pdb_get_username(sampass); 
pwd = getpwnam_alloc(result, username);

pwd evaluates to NULL even though username is valid. getpwnam_alloc allocates memory for result structure and fills it with the Unix UID, primary GID, etc...

Everything I read says that this call uses NSS. I hope someone from Samba team who has knowledge of this than I can chime in.

---------------------[ update ]--------------------- Examining samba source code here is what I'm discovering:

The failure is happening in auth/auth_util.c (line 580) with a call to getpwnam_alloc

getpwnam_alloc attempts to do some sort of caching and if the username is not found in recent cache the code falls through with a call to:

sys_getpwnam found in lib/system.c which is just a wrapper for getpwnam

Documented here: http://opengroup.org/onlinepubs/007908775/xsh/getpwnam.html

Doesn't appear as of Samba checks the errno described; will add some debug and report back.

Definitely a failure to the OS library implementing getpwnam but not sure what yet.

2 Answers 2

1

SOLVED!!!!!!!!!!!

I have a script that was starting Samba (NMBD, SMBD) as well as OpenLDAP (SLAPD). It's an RC script that reads configuration data from a file to determine, among other things, which processes are already running or if a dependent process fails to start, etc... Here is a snippet of the relevant part in the script. The last line copies a version of the nsswitch.conf into place that specifies to use LDAP lookups.

while [ $i -lt $MAXPROCS ];
  do
   PID=${PROC[$i]}
   StartProc $PID

   if test $? != 0; then
    echo "!!! Aborting Any Remaining Start-up Processes !!!"
    exit 1
   fi

  i=$(($i+1))
done

 cp /etc/rc.d/pozix/nsswitch.conf.ldap /etc/nsswitch.conf

And upon shutdown I was doing the following; notice I copy a nsswitch.conf file that has "noldap" entries in it.

while [ $i -lt $MAXPROCS ];
do
  PID=${PROC[$i]}
  StopProc $PID
  i=$(($i+1))
done

cp /etc/rc.d/pozix/nsswitch.conf.noldap /etc/nsswitch.conf

It turns out that in the start-up scenario, samba wants the nsswtich.conf content to have the ldap entries there prior to invocation. Here is what I did to fix my issues:

cp /etc/rc.d/pozix/nsswitch.conf.ldap /etc/nsswitch.conf

while [ $i -lt $MAXPROCS ];
  do
   PID=${PROC[$i]}
   StartProc $PID

   if test $? != 0; then
    cp /etc/rc.d/pozix/nsswitch.conf.noldap /etc/nsswitch.conf
    echo "!!! Aborting Any Remaining Start-up Processes !!!"
    exit 1
   fi

  i=$(($i+1))
done

In summary, it appears that how you start SMBD is just as important as when you start it. If you start SMBD when nsswitch.conf has no LDAP entries, you get a version of smbd running linked to nss_ldap.so thinking it should only rely upon /etc/passwd (if that is all that is in the nsswitch.conf file) and changing the nsswitch.conf contents after SMBD is running has no effect.

Hope this helps other system builders....

0

nss_ldap configures the Linux login system to use LDAP for authentication, not Samba. You still have to tell Samba to use ldap for authentication. For example:

ldap ssl = off
ldap admin dn = cn=Manager,dc=ldappdc,dc=mydomain,dc=com
ldap suffix = dc=ldappdc,dc=mydomain,dc=com
ldap user suffix = ou=People
ldap group suffix = ou=Group
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=Hosts

Of course, Samba has to have been built with LDAP support.

Now get smbldap-tools for creating users/groups/etc in your LDAP database. smbldap-tools will create the user accounts with the proper password formats (one for Linux, one for Samba) and other required attributes.

Here is what a complete LDAP entry would look like:

dn: uid=someuser,ou=People,dc=corp,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
cn: someuser
displayName: someuser
gecos: System User
gidNumber: 513
givenName: someuser
homeDirectory: /home/someuser
loginShell: /bin/bash
sambaAcctFlags: [U]
sambaHomeDrive: H:
sambaHomePath: \\%L\someuser
sambaKickoffTime: 2147483647
sambaLMPassword: FBB7BAF5868B4CBAAAD3B435B51404EE
sambaLogoffTime: 2147483647
sambaLogonScript: logon.bat
sambaLogonTime: 0
sambaNTPassword: D4CB2D67B19490FB090A6EDEC60E3EAE
sambaPrimaryGroupSID: S-1-5-21-1603264347-769597993-3324459097-513
sambaProfilePath: \\%L\profiles\someuser
sambaPwdCanChange: 0
sambaPwdLastSet: 1277051243
sambaPwdMustChange: 1280939243
sambaSID: S-1-5-21-1603264347-769597993-3324459097-3006
shadowLastChange: 14780
shadowMax: 45
sn: someuser
uid: someuser
uidNumber: 1003
userPassword:: e1NTSEF9Z2RueUNBMnVDMWVrejZLZGg4OGNLUmRJRU9zdlJFdE8=
7
  • I did all that. My original points out that pdbedit -Lv test works which is an indication that my smb.conf file knows how to query LDAP or send the query to nss_ldap. testparm returns no errors either. Although I'm using smbldap-tools, it's not an smbldap-tools issue. Neither the smbclient nor a Win7 host can login unless user is also in /etc/passwd. Ran some straces and found nothing out of the ordinary - no failures or DNS issues. Thanks for your input.
    – Kilo
    Jun 20, 2010 at 16:40
  • If the user has to exist in /etc/passwd for things to work then nss is not looking in LDAP for the users.
    – David
    Jun 21, 2010 at 12:19
  • how can that be though if I can SSH into the same host with an account that only exists in LDAP? I've done nothing to compile or configure openssl to bind to LDAP. Additionally, id test returns details for user test which is only in LDAP database.
    – Kilo
    Jun 22, 2010 at 0:08
  • something else: The admin account is in both LDAP and /etc/passwd. If I remove the files parameter from nsswitch.conf leaving only ldap (getent passwd dumps only ldap entries) I am able to still login with the admin account. The test account still fails to login; test is only in the LDAP database. It's as if Smbd is not using NSS consistently or more like a glibc issue. ld shows no missing library links. And I did restart LDAP server between checks to rule out caching.
    – Kilo
    Jun 22, 2010 at 0:45
  • Are there any error messages in the ldap servers logs?
    – David
    Jun 22, 2010 at 12:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .