[Samba] unsafe_string_function_usage_here when linking smbd
I'm trying to build 3.0.30 on Alpha/Tru64-4.0G. The configure step works, but make fails when it tries to link smbd: Compiling popt/popt.c Compiling popt/poptconfig.c Compiling popt/popthelp.c Compiling popt/poptparse.c Linking bin/smbd ld: Unresolved: __unsafe_string_function_usage_here_size_t__ gmake: *** [bin/smbd] Error 1 This Should Never Happen :) -- that looks like a message for the developers. How can I track down the cause of this and fix it? Here are some details: I'm using the samba-3.0.30.tar.gz source distribution downloaded from samba.org. I configured the build as follows: > env CC=cc LDFLAGS=-L/local/lib CPPFLAGS=-I/local/include ./ configure \ --with-winbind --with-krb5=/local --with-ldap --with-ads (I have to use the vendor cc, because if I try to build with gcc, I get the same errors Bengt Nilsson is reporting about tdb_open, _E__lc_ctype, tdb_traverse, _Eioctl and many others.) Prior to running make, I fixed what appears to be a typo in the Makefile: > diff Makefile Makefile.orig 590c590 < LIBSMBSHAREMODES_OBJ = libsmb/smb_share_modes.o $(TDBBASE_OBJ) --- > LIBSMBSHAREMODES_OBJ = libsmb/smb_share_modes.o $(TDB_BASE_OBJ) Dunno if that's important. Then I ran make like so, using GNU make: > limit datasize 1048576 > limit memoryuse 2041072 > gmake The make process begins by reporting (long lines wrapped): Using FLAGS = -I/usr/local/include -O -D_SAMBA_BUILD_=3 -I/src/pub/samba-3.0.30/source/popt -I/src/pub/samba-3.0.30/source/iniparser/src -Iinclude -I./include - I. -I. -I./lib/replace -I./lib/talloc -I./tdb/include -I./libaddns -I./librpc -DHAVE_CONFIG_H -I/usr/local/include -I/local/include -DLDAP_DEPRECATED -I/src/pub/samba-3.0.30/source/lib -D_SAMBA_BUILD_=3 PICFLAG= -fPIC LIBS = -lproplist -lsecurity -lresolv -lresolv LDFLAGS= -L/usr/local/lib -Wl,-rpath -Wl,/usr/local/lib -L/ local/lib DYNEXP = LDSHFLAGS = -shared -L/usr/local/lib -Wl,-rpath -Wl,/usr/ local/lib -L/local/lib SHLIBEXT = so SONAMEFLAG = -Wl,-soname, Generating smbd/build_options.c This dies with the "unresolved" complaint from the linker as shown above. My guess is this is a false-positive from safe_string.h -- i.e., there's nothing wrong with the string function calls in the smbd source files, but rather safe_string is mistakenly reporting a problem. Is it possible to muzzle safe_string and just get on with the build? I have previously built 3.0.25 successfully on this same Alpha box. But when I was trying to build 3.0.28 after it came out, I hit the same "unsafe_string_function_usage" error as I'm now seeing with 3.0.30. At that time I just gave up; this time I'd like to solve the problem. -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] unsafe_string_function_usage_here when linking smbd
On Jun 6, 2008, at 7:27 AM, Volker Lendecke wrote: On Fri, Jun 06, 2008 at 03:52:54PM +0200, Bengt Nilsson wrote: So the problem is for the older Digital UNIX V4.0F system. Do you have access to such a system? No, sorry :-) Volker If you did have such a system, how would you troubleshoot this problem? In other words, can you suggest how Bengt and I should proceed? (I'm on Digital UNIX 4.0G.) I've pretty well determined that the offending string function call is in trans2.c; is there a way we can instrument that source file to get some information about which specific function call is causing our unsafe_usage error? There are 27 calls in trans2.c that could potentially be replaced by the unsafe_usage string, so it would be very helpful to narrow that down. :) -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] unsafe_string_function_usage_here when linking smbd
On Jun 6, 2008, at 10:10 AM, Herb Lewis wrote: try doing an nm on the suspected .o file and see if the reference to the function is there. That will prove which file(s) is comes from than maybe you can determine which function it comes from. Thanks, but I've already done that; I used "nm" to confirm that the call to an undefined external function called "unsafe_string_function_usage_here_size_t" was present in trans2.o and in no other object file under source/smbd. The trouble is there are 27 calls in trans2.c that have been wrapped by safe_string.h and I haven't thought of a way to determine which one is getting replaced by the "unsafe_" marker. -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] unsafe_string_function_usage_here when linking smbd
On Jun 8, 2008, at 1:47 PM, Bengt Nilsson wrote: I was wrong about building completed. After removing smbd and re-make I got Linking bin/smbd ld: Unresolved: srvstr_push_fn2 make: *** [bin/smbd] Error 1 A quick summary of what I've discovered today: The offending line (that generates the unresolved error when linking smbd) is line 3694 of trans2.c, which is in the function call_trans2qfilepathinfo. Here it is with a bit of context: pdata += 24; SIVAL(pdata,0,ea_size); pdata += 4; /* EA info */ len = srvstr_push(outbuf, pdata+4, dos_fname, max_data_bytes - (pdata+4 - *ppdata), STR_UNICODE); SIVAL(pdata,0,len); pdata += 4 + len; data_size = PTR_DIFF(pdata,(*ppdata)); Line 3964 is the "len = srvstr_push()" call. That line is expanded by the cpp into: len = ((sizeof(pdata+4) != (max_data_bytes - (pdata+4 - *ppdata)) && sizeof(pdata+4) != sizeof(char *)) ? __unsafe_string_function_usage_here_size_t__() : srvstr_push_fn((""), (0), outbuf, pdata+4, dos_fname, max_data_bytes - (pdata+4 - *ppdata), 8)); And it's this line which, when compiled, returns the reference to __unsafe_string_function_usage_here_size_t__ instead of a reference to srvstr_push_fn. So either ((sizeof(pdata+4) != (max_data_bytes - (pdata+4 - *ppdata)) is evaluating to an unexpected value, or sizeof(pdata+4) != sizeof(char *)) is. I can't spend any more time on this today, but maybe this update will suggest something to someone here. -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Failed building 3.0.30 for tru64 4.0F
On Jun 10, 2008, at 8:40 AM, Volker Lendecke wrote: It compiled with the attached patch. I don't know why the compiler isn't able to optimize away the safe_string stuff. Volker Attachment: Thanks, Volker, this seems to have done the trick. Starting from a fresh 3.0.30 tarball, I applied your patches, and was then able to get a successful build in the usual way (config for cc, not gcc, fix TDB_BASE_OBJ in Makefile, and use gmake, not make). This is on an Alpha Tru64 v4.0G box. There are a whole bunch of warnings in the gmake output that list unresolved routines during the following steps: Linking libmsrpc shared library bin/libmsrpc.so Linking libaddns shared library bin/libaddns.so Building plugin bin/recycle.so Building plugin bin/audit.so Building plugin bin/extd_audit.so Building plugin bin/full_audit.so Building plugin bin/netatalk.so Building plugin bin/fake_perms.so Building plugin bin/default_quota.so Building plugin bin/readonly.so Building plugin bin/cap.so Building plugin bin/expand_msdfs.so Building plugin bin/shadow_copy.so Building plugin bin/readahead.so Building plugin bin/CP850.so Building plugin bin/CP437.so Building plugin bin/script.so But these appear to be harmless -- I got the same warnings when I built 3.0.25, and it's been running just fine on our Alpha box for months. I expect to be able to test this build of 3.0.30 on Monday. -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] Smbd internal error and panic with nfs-mounted share
0)] smbd/proce ss.c:(927) switch message SMBnttrans (pid 19041) conn 0x14018e050 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/nttra ns.c:(2082) call_nt_transact_query_security_desc: file = ., info_wanted = 0x3 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] passdb/loo kup_sid.c:(1009) fetch sid from uid cache 0 -> S-1-5-21-1975590968-77483778-2269577258-1000 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(1069) Transaction 7 of length 45 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(927) switch message SMBclose (pid 19041) conn 0x14018e050 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/reply .c:(3329) close directory fnum=4529 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(1069) Transaction 8 of length 74 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(927) switch message SMBtrans2 (pid 19041) conn 0x14018e050 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/trans 2.c:(2285) call_trans2qfsinfo: level = 1 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(1069) Transaction 9 of length 130 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/proce ss.c:(927) switch message SMBtrans2 (pid 19041) conn 0x14018e050 [2008/06/30 09:12:49, 3, pid=19041, effective(2104, 601), real(0, 0)] smbd/trans 2.c:(1701) call_trans2findfirst: dirtype = 16, maxentries = 4, close_after_first=1, close _if_end = 2 requires_resume_key = 4 level = 0x104, max_data_bytes = 16644 [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/fault. c:(41) === [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/fault. c:(42) INTERNAL ERROR: Signal 6 in pid 19041 (3.0.30) Please read the Trouble-Shooting section of the Samba3-HOWTO [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/fault. c:(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/fault. c:(45) === [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/util.c :(1632) PANIC (pid 19041): internal error [2008/06/30 09:12:49, 0, pid=19041, effective(2104, 601), real(0, 0)] lib/util.c :(1787) unable to produce a stack trace on this platform [2008/06/30 09:12:49, 0, pid=19041, effective(0, 0), real(0, 0)] lib/ fault.c:(18 1) dumping core in /usr/local/samba/var/cores/smbd -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] Leopard mounting issues
Mike Bann wrote: Anyone else noticed issues with mounting Samba from Leopard? Leopard claims to have never made the connection, but the logs of the connection say it authenticated but looks like it never sent a directory to mount. Yes, we're also seeing failures when trying to use Leopard to mount a Samba share. The same shares work fine with Mac OS 10.4. We're just starting to troubleshoot this; have you learned anything more since your original post? -- Kai LanzStanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] Leopard Macs using Kerberos: Failed to parse negTokenTarg
t Tkt-vno: 5 Realm: SU.WIN.STANFORD.EDU Server Name (Principal): cifs/ sesfs.stanford.edu Name-type: Principal (1) Name: cifs Name: sesfs.stanford.edu enc-part rc4-hmac Encryption type: rc4-hmac (23) Kvno: 2 enc-part: 24F85A3983BE0989B20CC51F... Authenticator des-cbc-md5 Encryption type: des-cbc-md5 (3) Authenticator data: ADB975580F588B675C... Native OS: MacOSX Native LAN Manager: NETSMB Finally, here's the dump of the successful packet (Reassembled TCP (2431 bytes)). As before, the security blob starts at byte 0x3f, but in this packet, at byte 0x62 (the 36th byte of the security blob), we have a byte of 0xa2, like the parser is expecting. 00 00 09 7b ff 53 4d 42 73 00 00 00 00 08 01 48 ...{.SMBs..H 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0020 00 00 01 00 0c ff 00 00 00 04 41 32 00 02 00 58 ..A2...X 0030 4b 00 00 32 09 00 00 00 00 4c 00 00 80 40 09 60 [EMAIL PROTECTED] 0040 82 09 2e 06 06 2b 06 01 05 05 02 a0 82 09 22 30 .+"0 0050 82 09 1e a0 0d 30 0b 06 09 2a 86 48 82 f7 12 01 .0...*.H 0060 02 02 a2 82 09 0b 04 82 09 07 60 82 09 03 06 09 ..`. 0070 2a 86 48 86 f7 12 01 02 02 01 00 6e 82 08 f2 30 *.Hn...0 0080 82 08 ee a0 03 02 01 05 a1 03 02 01 0e a2 07 03 0090 05 00 00 00 00 00 a3 82 08 46 61 82 08 42 30 82 .Fa..B0. 00a0 08 3e a0 03 02 01 05 a1 15 1b 13 53 55 2e 57 49 .>.SU.WI 00b0 4e 2e 53 54 41 4e 46 4f 52 44 2e 45 44 55 a2 25 N.STANFORD.EDU.% 00c0 30 23 a0 03 02 01 01 a1 1c 30 1a 1b 04 63 69 66 0#...0...cif 00d0 73 1b 12 73 65 73 66 73 2e 73 74 61 6e 66 6f 72 s..sesfs.stanfor 00e0 64 2e 65 64 75 a3 82 07 f7 30 82 07 f3 a0 03 02 d.edu0.. I've posted the full text of the log files and packet displays on the web at: http://www.stanford.edu/~lanz/leopard-samba/ Does this analysis look correct? And if so, is this something that can be patched in Samba? -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] Winbindd can't convert between SIDs and uid/gid
Samba 3.5.8 on OpenSolaris (SunOS 5.11) Intel platform; gcc 4.2.3; built with "configure --with-winbind --with-krb5 --with-ldap --with-ads" Samba is joined to our Windows-2008 AD domain. Pretty much everything works, except that winbindd can't convert between SIDs and uid/gid: 1. wbinfo -r WIN\\lanz (Returns nothing -- no output) First I obtain my SID from "wbinfo -n WIN\\lanz", then: 2. wbinfo -S Could not convert to uid 3. wbinfo -U 2104 <-- That's my correct Unix numerical uid Could not convert uid 2104 to sid 4. wbinfo -G 37 <-- That's my correct Unix numerical gid Could not convert gid 37 to sid First I obtain my group SID on another machine, then: 5. wbinfo -Y Could not convert sid to gid These tests were all done with caching disabled on winbindd (-n option). Note that nscd is NOT running (no daemon, service is disabled). Here's the stuff I've tried that works: Forward/reverse DNS kinit/klist getent nslookup -query=SRV _ldap._tcp.dc._msdcs.su.win.stanford.edu nmblookup smbclient -L sestestns1 (from another machine, with anonymous login) net ads testjoin wbinfo -t wbinfo -g wbinfo -u wbinfo --all-domains wbinfo --user-sids wbinfo -n WIN\\lanz wbinfo -s wbinfo --name-to-sid wbinfo -D SU Mounting a directory shared by Samba using Kerberos authentication (had to increase NGROUPS_MAX before this would work) I'm hoping someone can suggest where the problem is likely to be, given these examples of what works and what doesn't. I ran "wbinfo -G 37" with winbindd debug level set to 10; here's the end of the log entries I got: [2011/05/12 11:11:49.492068, 10] winbindd/winbindd.c: 593(process_request) process_request: Handling async request 22838:GID_TO_SID [2011/05/12 11:11:49.492094, 3] winbindd/winbindd_gid_to_sid.c: 46(winbindd_gid_to_sid_send) gid_to_sid 37 [2011/05/12 11:11:49.492136, 10] winbindd/winbindd_dual.c: 1309(fork_domain_child) fork_domain_child called without domain. [2011/05/12 11:11:49.493161, 10] winbindd/winbindd_dual.c: 1342(fork_domain_child) Child process 22839 [2011/05/12 11:11:49.495592, 5] winbindd/winbindd_gid_to_sid.c: 82(winbindd_gid_to_sid_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2011/05/12 11:11:49.495627, 10] winbindd/winbindd.c: 655(wb_request_done) wb_request_done[22838:GID_TO_SID]: NT_STATUS_NONE_MAPPED I'm suspicious of the "fork_domain_child called without domain." Also, where did it get the idea to convert S-0-0? Excerpt from our smb.conf [global] section: workgroup = SU realm = SU.WIN.STANFORD.EDU client ntlmv2 auth = yes allow trusted domains = yes lanman auth = Yes client lanman auth = Yes client plaintext auth = Yes preferred master = Auto password server = sudc0.su.win.stanford.edu netbios name = sestestns1 wins server = 171.64.7.155 171.64.7.177 winbind enum groups = yes winbind enum users = yes winbind nested groups = no local master = no dns proxy = Yes name resolve order = lmhosts wins bcast host interfaces = e1000g0 client schannel = No security = ads passdb backend = smbpasswd domain master = auto idmap backend = idmap uid = 65001-65500 idmap gid = 21-31 -- Kai LanzStanford UniversitySchool of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] How can I confirm that idmap_ad is being used?
How can I confirm that idmap_ad is being called? I've configured Samba with --with-shared-modules=idmap_ad, built and installed it; the file ad.so is now present in /usr/local/samba/lib/ idmap/ as expected. I then added the following to smb.conf: idmap backend = tdb idmap uid = 65536 - 99 idmap gid = 65536 - 99 idmap config SU : backend = ad idmap config SU : schema_mode = rfc2307 idmap config SU : range = 1 - 65535 idmap config WIN : backend = ad idmap config WIN : schema_mode = rfc2307 idmap config WIN : range = 1 - 65535 Now I fire up winbindd with debug-level = 10, and issue some queries via wbinfo. Some requests work as expected, some fail, but when I look in log.winbindd I never see any reference to idmap.c or idmap_ad.c. I'd like to confirm that this module is being used. I went so far as to deliberately break the smb.conf by specifying idmap config SU range = 1 - which I expected to produce an error from idmap_ad_initialize(), "invalid filter range". But that message is never logged; instead I see only errors from winbindd_util.c, add_trusted_domain(): [2011/05/16 16:57:11.442318, 1] winbindd/winbindd_util.c: 204(add_trusted_domain) invalid range syntax in idmap config SU: 1 - Have I missed out on some crucial bit of configuration that's required to enable idmap_ad? -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] How can I confirm that idmap_ad is being used?
Hi Daniel, On May 17, 2011, at 5:50 AM, Zabel, Daniel wrote: Have a look at: log.winbindd-idmap I've looked at that file; it's empty. (Not a single entry.) I run my tests with "winbindd -n -d 10 -D". Also have a look at: https://bugzilla.samba.org/show_bug.cgi?id=6322 Now, this is interesting! The problem Edgar Holleis describes sounds exactly like the one I am facing. See my post to the Samba mailing list, "Winbindd can't convert between SIDs and uid/gid". Edgar said: Winbind correctly resolves: User-Name->SID (wbinfo -n), Group-Name->SID (wbinfo -s) What doesn't work: SID->UID (wbinfo -S), UID->SID (wbinfo -U), SID->GID (wbinfo -Y), GID->UID (wbinfo -G) (Except, "wbinfo -s" is SID->User-name, the reverse of "wbinfo -n", not Group-Name->SID as Edgar wrote...) That's the same pattern of success and failure I get in my wbinfo tests. So, how does one go from Edgar's bug report, with 4 failing wbinfo queries, to your comment, "wbinfo resolves everything correctly"? I'm running samba-3.5.8 on OpenSolaris. Following Michael Adam's example, I tried the following in my smb.conf: idmap backend = tdb idmap uid = 5 - 9 idmap gid = 5 - 9 idmap config SU : backend = ad idmap config SU : schema_mode = rfc2307 idmap config SU : range = 1 - 2 idmap config WIN : backend = ad idmap config WIN : schema_mode = rfc2307 idmap config WIN : range = 3 - 4 Note the disjoint ranges for each domain. I still get the same failures with wbinfo S, U, G, and Y. It seems I'm still missing something, since our wbinfo doesn't "resolve everything correctly". Is nsswitch.conf important, perhaps? It doesn't seem to make any difference whether I add "winbind" to the passwd and group lines or not. Is that expected? -Ursprüngliche Nachricht- Von: samba-boun...@lists.samba.org [mailto:samba-boun...@lists.samba.org ] Im Auftrag von Kai Lanz Gesendet: Dienstag, 17. Mai 2011 02:56 An: samba@lists.samba.org Betreff: [Samba] How can I confirm that idmap_ad is being used? How can I confirm that idmap_ad is being called? I've configured Samba with --with-shared-modules=idmap_ad, built and installed it; the file ad.so is now present in /usr/local/samba/lib/ idmap/ as expected. I then added the following to smb.conf: idmap backend = tdb idmap uid = 65536 - 99 idmap gid = 65536 - 99 idmap config SU : backend = ad idmap config SU : schema_mode = rfc2307 idmap config SU : range = 1 - 65535 idmap config WIN : backend = ad idmap config WIN : schema_mode = rfc2307 idmap config WIN : range = 1 - 65535 Now I fire up winbindd with debug-level = 10, and issue some queries via wbinfo. Some requests work as expected, some fail, but when I look in log.winbindd I never see any reference to idmap.c or idmap_ad.c. I'd like to confirm that this module is being used. I went so far as to deliberately break the smb.conf by specifying idmap config SU range = 1 - which I expected to produce an error from idmap_ad_initialize(), "invalid filter range". But that message is never logged; instead I see only errors from winbindd_util.c, add_trusted_domain(): [2011/05/16 16:57:11.442318, 1] winbindd/winbindd_util.c: 204(add_trusted_domain) invalid range syntax in idmap config SU: 1 - Have I missed out on some crucial bit of configuration that's required to enable idmap_ad? -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] How can I confirm that idmap_ad is being used?
Daniel, On May 18, 2011, at 12:00 AM, Zabel, Daniel wrote: I've looked at that file; it's empty. (Not a single entry.) I run my tests with "winbindd -n -d 10 -D". Try to add to your smb.conf: log level = 3 idmap:10 winbind:10 to force idmap Logging also to Debuglevel 10. I've discovered that Samba is writing to log files under /usr/local/ samba/var, as well as to files under /var/log/samba. (Why is it doing that? In smb.conf it is told to put log files in /var/log/samba.) Anyway, now I can see that idmap_ad is being called and is making log entries at debug level 10. This enabled me to see that my "idmap config SU : range" settings were wrong -- I was filtering out values I wanted to see. Once I set the ranges correctly, "wbinfo -S" started to work. (I can now map a user SID to the correct Unix numerical UID.) The other wbinfo mappings still fail: U, G, and Y. Did "net ads testjoin" and "net ads info" work? Yes, both these commands work. Nsswicth.conf is important! Should look like this: passwd:files winbind group: files winbind I've configured my nsswitch.conf like this, but it made no difference. These winbind relevant seetings I have also in my config winbind nss info = rfc2307 template winbind normalize names = yes winbind use default domain = yes winbind offline logon = yes winbind cache time = 180 winbind enum users = yes winbind enum groups = yes winbind nested groups = yes winbind trusted domains only = no Thanks; I altered my config to match these settings, but again, it didn't affect my wbinfo tests. -- Kai Lanz On May 17, 2011, at 5:50 AM, Zabel, Daniel wrote: Have a look at: log.winbindd-idmap I've looked at that file; it's empty. (Not a single entry.) I run my tests with "winbindd -n -d 10 -D". Also have a look at: https://bugzilla.samba.org/show_bug.cgi?id=6322 Now, this is interesting! The problem Edgar Holleis describes sounds exactly like the one I am facing. See my post to the Samba mailing list, "Winbindd can't convert between SIDs and uid/gid". Edgar said: Winbind correctly resolves: User-Name->SID (wbinfo -n), Group-Name->SID (wbinfo -s) What doesn't work: SID->UID (wbinfo -S), UID->SID (wbinfo -U), GID (wbinfo -Y), GID->UID SID->(wbinfo -G) (Except, "wbinfo -s" is SID->User-name, the reverse of "wbinfo -n", not Group-Name->SID as Edgar wrote...) That's the same pattern of success and failure I get in my wbinfo tests. So, how does one go from Edgar's bug report, with 4 failing wbinfo queries, to your comment, "wbinfo resolves everything correctly"? I'm running samba-3.5.8 on OpenSolaris. Following Michael Adam's example, I tried the following in my smb.conf: idmap backend = tdb idmap uid = 5 - 9 idmap gid = 5 - 9 idmap config SU : backend = ad idmap config SU : schema_mode = rfc2307 idmap config SU : range = 1 - 2 idmap config WIN : backend = ad idmap config WIN : schema_mode = rfc2307 idmap config WIN : range = 3 - 4 Note the disjoint ranges for each domain. I still get the same failures with wbinfo S, U, G, and Y. It seems I'm still missing something, since our wbinfo doesn't "resolve everything correctly". Is nsswitch.conf important, perhaps? It doesn't seem to make any difference whether I add "winbind" to the passwd and group lines or not. Is that expected? -- Kai Lanz -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] Porting CTDB to Solaris
We wanted to try out clustered Samba on a pair of small OpenSolaris/ Intel boxes. But after downloading the CTDB source from the Samba git repository, I discovered that it won't build on Solaris -- the configure script supports only Linux and AIX. Is there a Solaris port for CTDB, or is somebody working on one? (If not, I might take a crack at it; would it be a straightforward port?) -- Kai Lanz Stanford University School of Earth Sciences -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba