I've got issues with my Samba configuration. I've been running Samba for about 12 or 13 years, and I've never seen this before. There was a time when I was pretty knowledgeable about Windows domains, but the Windows world has passed me by, and the various facets of Samba that have grown along with Active Directory are confusing me.
My setup is really straightforward. I've just got a single server with some disk space and a printer that I want to share among 4 other computers. For all these years, I have been using a simple domain with a single PDC. Lately, something has changed. I can't figure out if it's been going to Lucid or whether it was a particular update with Samba, but something keeps breaking in my database.
From time to time, my account's password will become "wrong." I'll be able to login -- using cached credentials, I presume -- but I won't be able to mount the drives or print to the printer. I think it's happening about every 30 days. Maybe it's 45. I've been dealing with this by just resetting the password on the server, but this has become really annoying. Also, I'm noticing from the logs that the machine passwords are becoming fouled up as well.
I finally guessed that my database -- that I've migrated and updated for about a dozen years now -- was just too out of date, so I deleted it and started from scratch on a new domain. Now it's happening again, so that clearly wasn't the problem.
I thought maybe it was just my Windows 7 box, but now my XP machines are doing it too.
I wouldn't think that it's a password expiration policy thing. If it were, I should be getting a prompt that says it's time to change my password, right? When I go to investigate such a thing, I get lost with all the various permutations of net and pdbedit and wbinfo commands. I'm used to not needing them in general. I think I've added my account into the "Domain Administrators" group with one of them at some point, but I don't remember how that's done.
I'm especially confused with the docs regarding whether I should have winbind running at all in my configuration. I don't think I do, but obviously running wbinfo to do diagnostics needs it, and I figure I'm not hurting anything by having it running. It runs by default in Ubuntu, so I've wanted to leave it and work with it if possible. Winbind is NOT referenced in my /etc/nsswitch.conf.
I'm getting lots of interesting error messages in my logs, but Google isn't leading me to understanding any of them. Here's one in smb.conf telling me that one of my workstations isn't connected correctly:
[2011/08/27 19:02:04, 0] rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3)
_netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client PROXIMA machine account PROXIMA$
Lots of this one from log.winbindd-idmap on Google, with no clear indication of what might be wrong or if it even needs fixing. (And, yeah, I need idmapd for NFSv4.) Seems particular to Ubuntu. I haven't a clue what might be "incomplete" about my "configuration."
[2011/08/27 19:02:04, 0] winbindd/idmap_tdb.c:287(idmap_tdb_open_db)
Upgrade of IDMAP_VERSION from -1 to 2 is not possible with incomplete configuration
[2011/08/27 19:02:04, 1] winbindd/idmap.c:321(idmap_init_domain)
idmap initialization returned NT_STATUS_UNSUCCESSFUL
I think this one from log.winbindd is harmless, as winbindd is just figuring out if my server is a PDC or something else:
[2011/08/27 17:55:46, 0] libsmb/namequery.c:75(saf_store)
saf_store: refusing to store 0 length domain or servername!
[2011/08/27 17:55:46, 1] rpc_client/cli_pipe.c:949(cli_pipe_validate_current_pdu)
cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from host EXCELSIOR!
Finally, here's my smb.conf:
[global]
workgroup = STARFLEET
map to guest = Bad User
obey pam restrictions = yes
smb passwd file = /var/lib/samba/passdb.tdb
private dir = /var/lib/samba
pam password change = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
unix password sync = yes
log level = 2
load printers = yes
printcap name = cups
add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
add group script = /usr/sbin/addgroup --force-badname %g
add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
logon script = %U.bat
logon path =
logon drive = Z:
logon home =
domain logons = yes
os level = 65
preferred master = yes
domain master = yes
wins support = yes
usershare allow guests = yes
use sendfile = yes
[homes]
comment = Home Directories
path = /data/Users/%U
valid users = %S
read only = no
create mask = 0700
directory mask = 0700
[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
guest ok = yes
browseable = no
browsable = no
share modes = no
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = yes
browseable = yes
browsable = yes
[data]
path = /data
read only = no
guest ok = yes
[temp]
path = /data/Temp
read only = no
guest ok = yes
[homes]
comment = Home Directories
path = /data/Users/%U
valid users = %S
read only = no
create mask = 0700
directory mask = 0700
So... What's going on, and how do I fix it?
