I've got issues with my Samba configuration. I've been running Samba for about 12 or 13 years, and I've never seen this before. There was a time when I was pretty knowledgeable about Windows domains, but the Windows world has passed me by, and the various facets of Samba that have grown along with Active Directory are confusing me.
My setup is really straightforward. I've just got a single server with some disk space and a printer that I want to share among 4 other computers. For all these years, I have been using a simple domain with a single PDC. Lately, something has changed. I can't figure out if it's been going to Lucid or whether it was a particular update with Samba, but something keeps breaking in my database.
From time to time, my account's password will become "wrong." I'll be able to login -- using cached credentials, I presume -- but I won't be able to mount the drives or print to the printer. I think it's happening about every 30 days. Maybe it's 45. I've been dealing with this by just resetting the password on the server, but this has become really annoying. Also, I'm noticing from the logs that the machine passwords are becoming fouled up as well.
I finally guessed that my database -- that I've migrated and updated for about a dozen years now -- was just too out of date, so I deleted it and started from scratch on a new domain. Now it's happening again, so that clearly wasn't the problem.
I thought maybe it was just my Windows 7 box, but now my XP machines are doing it too.
I wouldn't think that it's a password expiration policy thing. If it were, I should be getting a prompt that says it's time to change my password, right? When I go to investigate such a thing, I get lost with all the various permutations of
wbinfo commands. I'm used to not needing them in general. I think I've added my account into the "Domain Administrators" group with one of them at some point, but I don't remember how that's done.
I'm especially confused with the docs regarding whether I should have winbind running at all in my configuration. I don't think I do, but obviously running
wbinfo to do diagnostics needs it, and I figure I'm not hurting anything by having it running. It runs by default in Ubuntu, so I've wanted to leave it and work with it if possible. Winbind is NOT referenced in my /etc/nsswitch.conf.
I'm getting lots of interesting error messages in my logs, but Google isn't leading me to understanding any of them. Here's one in smb.conf telling me that one of my workstations isn't connected correctly:
[2011/08/27 19:02:04, 0] rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3) _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client PROXIMA machine account PROXIMA$
Lots of this one from log.winbindd-idmap on Google, with no clear indication of what might be wrong or if it even needs fixing. (And, yeah, I need idmapd for NFSv4.) Seems particular to Ubuntu. I haven't a clue what might be "incomplete" about my "configuration."
[2011/08/27 19:02:04, 0] winbindd/idmap_tdb.c:287(idmap_tdb_open_db) Upgrade of IDMAP_VERSION from -1 to 2 is not possible with incomplete configuration [2011/08/27 19:02:04, 1] winbindd/idmap.c:321(idmap_init_domain) idmap initialization returned NT_STATUS_UNSUCCESSFUL
I think this one from log.winbindd is harmless, as winbindd is just figuring out if my server is a PDC or something else:
[2011/08/27 17:55:46, 0] libsmb/namequery.c:75(saf_store) saf_store: refusing to store 0 length domain or servername! [2011/08/27 17:55:46, 1] rpc_client/cli_pipe.c:949(cli_pipe_validate_current_pdu) cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from host EXCELSIOR!
Finally, here's my smb.conf:
[global] workgroup = STARFLEET map to guest = Bad User obey pam restrictions = yes smb passwd file = /var/lib/samba/passdb.tdb private dir = /var/lib/samba pam password change = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . unix password sync = yes log level = 2 load printers = yes printcap name = cups add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u add group script = /usr/sbin/addgroup --force-badname %g add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u logon script = %U.bat logon path = logon drive = Z: logon home = domain logons = yes os level = 65 preferred master = yes domain master = yes wins support = yes usershare allow guests = yes use sendfile = yes [homes] comment = Home Directories path = /data/Users/%U valid users = %S read only = no create mask = 0700 directory mask = 0700 [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = yes browseable = no browsable = no share modes = no [printers] comment = All Printers path = /var/spool/samba create mask = 0700 printable = yes browseable = yes browsable = yes [data] path = /data read only = no guest ok = yes [temp] path = /data/Temp read only = no guest ok = yes [homes] comment = Home Directories path = /data/Users/%U valid users = %S read only = no create mask = 0700 directory mask = 0700
So... What's going on, and how do I fix it?