Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got issues with my Samba configuration. I've been running Samba for about 12 or 13 years, and I've never seen this before. There was a time when I was pretty knowledgeable about Windows domains, but the Windows world has passed me by, and the various facets of Samba that have grown along with Active Directory are confusing me.

My setup is really straightforward. I've just got a single server with some disk space and a printer that I want to share among 4 other computers. For all these years, I have been using a simple domain with a single PDC. Lately, something has changed. I can't figure out if it's been going to Lucid or whether it was a particular update with Samba, but something keeps breaking in my database.

From time to time, my account's password will become "wrong." I'll be able to login -- using cached credentials, I presume -- but I won't be able to mount the drives or print to the printer. I think it's happening about every 30 days. Maybe it's 45. I've been dealing with this by just resetting the password on the server, but this has become really annoying. Also, I'm noticing from the logs that the machine passwords are becoming fouled up as well.

I finally guessed that my database -- that I've migrated and updated for about a dozen years now -- was just too out of date, so I deleted it and started from scratch on a new domain. Now it's happening again, so that clearly wasn't the problem.

I thought maybe it was just my Windows 7 box, but now my XP machines are doing it too.

I wouldn't think that it's a password expiration policy thing. If it were, I should be getting a prompt that says it's time to change my password, right? When I go to investigate such a thing, I get lost with all the various permutations of net and pdbedit and wbinfo commands. I'm used to not needing them in general. I think I've added my account into the "Domain Administrators" group with one of them at some point, but I don't remember how that's done.

I'm especially confused with the docs regarding whether I should have winbind running at all in my configuration. I don't think I do, but obviously running wbinfo to do diagnostics needs it, and I figure I'm not hurting anything by having it running. It runs by default in Ubuntu, so I've wanted to leave it and work with it if possible. Winbind is NOT referenced in my /etc/nsswitch.conf.

I'm getting lots of interesting error messages in my logs, but Google isn't leading me to understanding any of them. Here's one in smb.conf telling me that one of my workstations isn't connected correctly:

[2011/08/27 19:02:04,  0] rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client PROXIMA machine account PROXIMA$

Lots of this one from log.winbindd-idmap on Google, with no clear indication of what might be wrong or if it even needs fixing. (And, yeah, I need idmapd for NFSv4.) Seems particular to Ubuntu. I haven't a clue what might be "incomplete" about my "configuration."

[2011/08/27 19:02:04,  0] winbindd/idmap_tdb.c:287(idmap_tdb_open_db)
  Upgrade of IDMAP_VERSION from -1 to 2 is not possible with incomplete configuration
[2011/08/27 19:02:04,  1] winbindd/idmap.c:321(idmap_init_domain)
  idmap initialization returned NT_STATUS_UNSUCCESSFUL

I think this one from log.winbindd is harmless, as winbindd is just figuring out if my server is a PDC or something else:

[2011/08/27 17:55:46,  0] libsmb/namequery.c:75(saf_store)
  saf_store: refusing to store 0 length domain or servername!
[2011/08/27 17:55:46,  1] rpc_client/cli_pipe.c:949(cli_pipe_validate_current_pdu)
  cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from host EXCELSIOR!

Finally, here's my smb.conf:

        workgroup = STARFLEET
        map to guest = Bad User
        obey pam restrictions = yes
        smb passwd file = /var/lib/samba/passdb.tdb
        private dir = /var/lib/samba
        pam password change = yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = yes
        log level = 2
        load printers = yes
        printcap name = cups
        add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
        add group script = /usr/sbin/addgroup --force-badname %g
        add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
        logon script = %U.bat
        logon path =
        logon drive = Z:
        logon home =
        domain logons = yes
        os level = 65
        preferred master = yes
        domain master = yes
        wins support = yes
        usershare allow guests = yes
        use sendfile = yes

        comment = Home Directories
        path = /data/Users/%U
        valid users = %S
        read only = no
        create mask = 0700
        directory mask = 0700

        comment = Network Logon Service
        path = /var/lib/samba/netlogon
        guest ok = yes
        browseable = no
        browsable = no
        share modes = no

        comment = All Printers
        path = /var/spool/samba
        create mask = 0700
        printable = yes
        browseable = yes
        browsable = yes

        path = /data
        read only = no
        guest ok = yes

        path = /data/Temp
        read only = no
        guest ok = yes
        comment = Home Directories
        path = /data/Users/%U
        valid users = %S
        read only = no
        create mask = 0700
        directory mask = 0700

So... What's going on, and how do I fix it?

share|improve this question

closed as too localized by fossfreedom May 1 '12 at 22:32

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question. – Tachyons Apr 3 '12 at 9:03
This question may be a better fit elsewhere, try our friends at Unix and Linux Stack Exchange. Regards, – Ringtail Apr 5 '12 at 4:42
I guess the problem either was solved or is no longer relevant. – Braiam Jan 19 '14 at 3:44

Browse other questions tagged or ask your own question.