Re: [Samba] Winbind issue connecting to trusted domain controllers
So, is there a way I can specify that winbind only uses the CSS domain and does not try and connect to the other trusted domains? allow trusted domains = no Thanks for the suggestion, but this didn't make a difference. However, I've managed to find the answer / workaround: The following needs to be set in smb.conf: winbind:ignore domains = MAT LPS LAB MMSC GRP IMCR UPGRADE CENTRAL MISE 4THFLOOR AD CSSDEV NAS In case it's not obvious, the list is the names of all the trusted domains I want Winbind to ignore. I did see a patch that performs the inverse of this (so you specify the domains you *want* to search) but as this is not part of the mainline code I decided to avoid it as I don't want to be maintaining different versions. Thanks Julian -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] Winbind issue connecting to trusted domain controllers
Hi I'm following up my original message with more information, but unfortunately no real progress. I've updated to Samba 3.4.0 and winbindd -V now reports: Version 3.4.0-SerNet-RedHat I've also tried setting password server = 10.1.10.120 which is the IP address of one of my local domain controllers. However, following the logs, I'm still watching Winbind cycle through the list of all trusted domains and the domain controllers within those domains (as detailed below), even when my Samba server is unable to connect to those servers. I can't believe we are the only organisation to want to use Samba in a site with links to other, trusted domains, but my Google skills are failing me. Is this a configuration problem with the Samba server, or a configuration problem with Active Directory itself? I'm now stuck and don't know how to progress this, so would really appreciate some input from the gurus on this list. Many thanks in anticipation. Julian From: jrmailgate-sa...@yahoo.co.uk jrmailgate-sa...@yahoo.co.uk To: samba@lists.samba.org Sent: Thursday, 23 July, 2009 13:12:37 Subject: [Samba] Winbind issue connecting to trusted domain controllers Hi. The quick question: Is there a way of forcing a Samba server that is an Active Directory member server to limit lookups to it's local domain only and not all trusted domains? The question in more detail: I have a Samba server that is joined to my local AD domain (css.ad.example.com). There are other domains under ad.example.com such as lps.ad.example.com and mat.ad.example.com within the same forest, and additional trusts setup to external domains. The problem I have is that authentication works some of the time and then fails for seemingly random amounts of time before working again. I've managed to reproduce this behaviour through running wbinfo numerous times in succession and monitoring the output. Running wbinfo -t returns the following: checking the trust secret via RPC calls succeeded However, running wbinfo -u returns: Error looking up domain users Having done some debugging with the Samba debug level set to 10, and performing packet captures with tcpdump/wireshark, I believe the following is happening: Winbind is obtaining a list of of trusted domains and is adding them to a list using add_trusted_domain. [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain CSS CSS.AD.EXAMPLE.COM S-1-5-21-2722945677-2571981173-1559263515 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain CENTRAL central.ad.example.com S-1-5-21-1546731521-1604605983-311576647 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain GRP grp.ad.example.com S-1-5-21-4165802252-723863699-2563104143 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain MMSC mmsc-example.com S-1-5-21-3925889671-1378681824-3250279791 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain LPS lps.ad.example.com S-1-5-21-3593956825-942678665-1239839976 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain MAT mat.ad.example.com S-1-5-21-227787951-1760200910-3128242332 The last added entry MAT mat.ad.example.com is then set as the domain(?): [2009/07/23 12:09:41, 4] libsmb/namequery_dc.c:ads_dc_name(73) ads_dc_name: domain=MAT Winbind then attempts to get a list of all the domain controllers: [2009/07/23 12:09:41, 3] libsmb/namequery.c:get_dc_list(1495) get_dc_list: preferred server list: , * Winbind attempts to locate the LDAP server in the MAT domain, but fails: [2009/07/23 12:10:01, 3] libads/dns.c:dns_send_req(303) ads_dns_lookup_srv: Failed to resolve _ldap._tcp.dc._msdcs.mat.ad.example.com (Connection timed out) [2009/07/23 12:10:01, 3] libads/dns.c:ads_dns_lookup_srv(363) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_IO_TIMEOUT) [2009/07/23 12:10:01, 4] libsmb/namequery.c:get_dc_list(1522) get_dc_list: no servers found Having failed to obtain the LDAP address by DNS, Winbind then tries to resolve the address using lmhosts and WINS. Both fail because although the trusts are in place, the Samba server does not have network access to the MAT domain. After Winbind exhausts the various options of resolving the MAT domain, it then attempts the same with the LPS domain. LPS was the entry added immediately before MAT so it appears to be traversing the list of trusted : [2009/07/23 12:10:24, 4] libsmb/namequery_dc.c:ads_dc_name(73) ads_dc_name: domain=LPS [2009/07/23 12:10:24, 3] libsmb/namequery.c:get_dc_list(1495) get_dc_list: preferred server list: , * [2009/07/23 12:10:24, 4] libsmb/namequery.c:get_dc_list(1605) get_dc_list: returning 21 ip addresses in an ordered list
Re: [Samba] Winbind issue connecting to trusted domain controllers
So, is there a way I can specify that winbind only uses the CSS domain and does not try and connect to the other trusted domains? allow trusted domains = no I'm running CentOS 5.3 with Samba 3.0.33-3.7.el5 with the following smb.conf: [global] workgroup = CSS realm = CSS.AD.EXAMPLE.COM server string = Samba Server Version %v security = ADS passdb backend = tdbsam preferred master = No winbind use default domain = Yes Any help much appreciated!!! Thanks Julian -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
[Samba] Winbind issue connecting to trusted domain controllers
Hi. The quick question: Is there a way of forcing a Samba server that is an Active Directory member server to limit lookups to it's local domain only and not all trusted domains? The question in more detail: I have a Samba server that is joined to my local AD domain (css.ad.example.com). There are other domains under ad.example.com such as lps.ad.example.com and mat.ad.example.com within the same forest, and additional trusts setup to external domains. The problem I have is that authentication works some of the time and then fails for seemingly random amounts of time before working again. I've managed to reproduce this behaviour through running wbinfo numerous times in succession and monitoring the output. Running wbinfo -t returns the following: checking the trust secret via RPC calls succeeded However, running wbinfo -u returns: Error looking up domain users Having done some debugging with the Samba debug level set to 10, and performing packet captures with tcpdump/wireshark, I believe the following is happening: Winbind is obtaining a list of of trusted domains and is adding them to a list using add_trusted_domain. [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain CSS CSS.AD.EXAMPLE.COM S-1-5-21-2722945677-2571981173-1559263515 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain CENTRAL central.ad.example.com S-1-5-21-1546731521-1604605983-311576647 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain GRP grp.ad.example.com S-1-5-21-4165802252-723863699-2563104143 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain MMSC mmsc-example.com S-1-5-21-3925889671-1378681824-3250279791 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain LPS lps.ad.example.com S-1-5-21-3593956825-942678665-1239839976 [2009/07/23 12:09:28, 2] nsswitch/winbindd_util.c:add_trusted_domain(172) Added domain MAT mat.ad.example.com S-1-5-21-227787951-1760200910-3128242332 The last added entry MAT mat.ad.example.com is then set as the domain(?): [2009/07/23 12:09:41, 4] libsmb/namequery_dc.c:ads_dc_name(73) ads_dc_name: domain=MAT Winbind then attempts to get a list of all the domain controllers: [2009/07/23 12:09:41, 3] libsmb/namequery.c:get_dc_list(1495) get_dc_list: preferred server list: , * Winbind attempts to locate the LDAP server in the MAT domain, but fails: [2009/07/23 12:10:01, 3] libads/dns.c:dns_send_req(303) ads_dns_lookup_srv: Failed to resolve _ldap._tcp.dc._msdcs.mat.ad.example.com (Connection timed out) [2009/07/23 12:10:01, 3] libads/dns.c:ads_dns_lookup_srv(363) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_IO_TIMEOUT) [2009/07/23 12:10:01, 4] libsmb/namequery.c:get_dc_list(1522) get_dc_list: no servers found Having failed to obtain the LDAP address by DNS, Winbind then tries to resolve the address using lmhosts and WINS. Both fail because although the trusts are in place, the Samba server does not have network access to the MAT domain. After Winbind exhausts the various options of resolving the MAT domain, it then attempts the same with the LPS domain. LPS was the entry added immediately before MAT so it appears to be traversing the list of trusted : [2009/07/23 12:10:24, 4] libsmb/namequery_dc.c:ads_dc_name(73) ads_dc_name: domain=LPS [2009/07/23 12:10:24, 3] libsmb/namequery.c:get_dc_list(1495) get_dc_list: preferred server list: , * [2009/07/23 12:10:24, 4] libsmb/namequery.c:get_dc_list(1605) get_dc_list: returning 21 ip addresses in an ordered list [2009/07/23 12:10:24, 4] libsmb/namequery.c:get_dc_list(1606) get_dc_list: 10.236.113.22:389 10.236.62.21:389 10.236.30.22:389 10.236.100.22:389 10.236.94.21:389 10.236.92.21:389 10.236.114.22:389 10.91.160.41:389 10.236.113.21:389 10.236.114.21:389 10.91.160.40:389 10.236.94.22:389 10.236.92.22:389 10.236.112.22:389 10.236.112.21:389 10.154.110.21:389 10.154.110.22:389 10.91.157.132:389 10.236.62.22:389 10.236.30.21:389 10.236.100.21:389 In Wireshark, I can see this request being made by the NetrGetAnyDCName call and the response from a local domain controller, but the contents of the packet are encrypted. This time the IP addresses for the domain controllers on the LPS domain are returned (so presumably the local domain controller Winbind is querying at this point knows about the LPS domain controllers). Winbind then attempts to connect to the first IP address in the list (10.236.113.22): [2009/07/23 12:10:31, 3] libads/ldap.c:ads_try_connect(189) ads_try_connect: CLDAP request 10.236.113.22 failed. This fails so it tries the second in the list and so on. None of these addresses will work as the Samba server is unable to connect to these external DCs
