[Samba] Successes an failures with Samba 4.3.9 and FreeBSD-10.3

[Zaphod Beeblebrox]

So... I've been running Samba 3.6 for too long and I upgraded. I did save
my packages for 3.6, but I don't _think_ I'm going back.

Points for the group:

- Samba 4.4.x is broken on FreeBSD. I forget exactly, but it seems to
be a known problem (tm), so I'll move on.
- Whether I use BIND9_DLZ or I use SAMBA_INTERNAL, samba_dnsupdate
complains. Strange thing, tho: all the domains seem to lookup fine. I
can't exactly find the problem here.
- BIG ONE: wbinfo isn't working and (related, for me) idmap isn't either.

... so on that last one, wbinfo -u or -g print nothing (not even errors).
wbinfo -D HOME or -t are fine. wbinfo -i adminsitrator prints out the
unhelpful

[2:282:582]***@vr:/var/log/samba4> wbinfo -i administrator
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user administrator

... which aparently WBC_ERR_DOMAIN_NOT_FOUND is just the default error (or
that's what I read in one place).

Now... this is pretty bupkis, because ldbsearch finds the SID for
administrator _and_ for my login just fine. In addition, ldbedit lets me
change my xidNumber. I did so. when I re-ldbedit... it's changed.

... but this doesn't change the uid that files are created with. Sigh.
More reading said that there's another SID ... the SID for the "group of
me" ... and I have instructions for wbinfo to find that SID so I can
ldbedit it. But you see my problem: wbinfo for finding SIDs is broke.

Now... I've put my time into this. I've broken out ktrace and log level =
10. I've put a whole afternoon into this. Log stuff is a _bit_
interesting. When I wbinfo -i zbeeble, I get:

[2016/07/11 01:10:37.408526, 1, pid=24476, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debu
g)
wbint_LookupName: struct wbint_LookupName
in: struct wbint_LookupName
domain : *
domain : 'HOME'
name : *
name : 'ZBEEBLE'
flags : 0x00000008 (8)
[2016/07/11 01:10:37.414175, 1, pid=24476, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
wbint_LookupName: struct wbint_LookupName
out: struct wbint_LookupName
type : *
type : SID_NAME_USE_NONE (0)
sid : *
sid : S-0-0
result : NT_STATUS_UNSUCCESSFUL

but further on in the file (probably coming from a random SMB file access)
I see:

Parsing value for key
[IDMAP/SID2XID/S-1-5-21-3505373935-2275348003-3197909400-1104]:
value=[3000016:B]
[2016/07/11 01:10:56.209343, 10, pid=24476, effective(0, 0), real(0, 0)]
../source3/lib/idmap_cache.c:75(idmap_cache_find_sid2unixid)
Parsing value for key
[IDMAP/SID2XID/S-1-5-21-3505373935-2275348003-3197909400-1104]:
id=[3000016], endptr=[:B]
[2016/07/11 01:10:56.209352, 10, pid=24476, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send)
SID 1: S-1-5-21-3505373935-2275348003-3197909400-513

... which is curious because 3000016 is the wrong, old or automatically
assigned UID and the SID there is my SID.


... all very frustrating.


At least my Shield TV talks to the box. Sigh.

[Zaphod Beeblebrox]

See inline comments

Post by Zaphod Beeblebrox
So... I've been running Samba 3.6 for too long and I upgraded. I did save
my packages for 3.6, but I don't _think_ I'm going back.
- Samba 4.4.x is broken on FreeBSD. I forget exactly, but it seems to
be a known problem (tm), so I'll move on.

What is wrong with Samba 4.4.x on FreeBSD ?

Urm... I _think_ it was a build problem. It hit very early on and mailing
list traffic from June 2016-ish seem to validate it was a known thing. I
don't have an easy place to test as it will refuse to build with 4.3 loaded
up. Maybe I'll make a jail after these problems are fixed.

- Whether I use BIND9_DLZ or I use SAMBA_INTERNAL, samba_dnsupdate

Post by Zaphod Beeblebrox
complains. Strange thing, tho: all the domains seem to lookup fine.
I
can't exactly find the problem here.

I understand this is a known problem and can possibly be 'fixed' by adding
'allow dns updates = nonsecure and secure' to smb.conf on the DC.

Not in my case. Already have that line.

Post by Zaphod Beeblebrox
Now... this is pretty bupkis, because ldbsearch finds the SID for
administrator _and_ for my login just fine. In addition, ldbedit lets me
change my xidNumber. I did so. when I re-ldbedit... it's changed.

And this where lots of people make the same mistake, don't change the
'xidNumber' attribute in idmap.ldb, add a 'uidNumber' attribute to the
users object in sam.ldb.

uidNumber doesn't work. I ldbedited'd my SID to add that attribute. Then
I restarted samba, then I created a file with my workstation. Still has
3000016 rather than 101 as the uid.

[Zaphod Beeblebrox]

OK. "net cache flush" worked (dunno why a restart isn't equivalent, but
hey). So let's start peeling back other issues!

Post by Zaphod Beeblebrox
- Whether I use BIND9_DLZ or I use SAMBA_INTERNAL, samba_dnsupdate
complains. Strange thing, tho: all the domains seem to
lookup fine. I
can't exactly find the problem here.
I understand this is a known problem and can possibly be 'fixed'
by adding 'allow dns updates = nonsecure and secure' to smb.conf
on the DC.
Not in my case. Already have that line.

How are you using samba_dnsupdate ?

An example would be "/usr/local/sbin/samba_dnsupdate --verbose --all-names
-d 15"

But even just samba_dnsupdate by itself squaks. I put the output in
https://owncloud.eicat.ca/index.php/s/vAKUymZr3OD59i7

[Zaphod Beeblebrox]

Post by Zaphod Beeblebrox
OK. "net cache flush" worked (dunno why a restart isn't equivalent, but
hey). So let's start peeling back other issues!

Post by Zaphod Beeblebrox
- Whether I use BIND9_DLZ or I use SAMBA_INTERNAL, samba_dnsupdate
complains. Strange thing, tho: all the domains seem to
lookup fine. I
can't exactly find the problem here.
I understand this is a known problem and can possibly be 'fixed'
by adding 'allow dns updates = nonsecure and secure' to smb.conf
on the DC.
Not in my case. Already have that line.

How are you using samba_dnsupdate ?

An example would be "/usr/local/sbin/samba_dnsupdate --verbose
--all-names -d 15"
But even just samba_dnsupdate by itself squaks. I put the output in
https://owncloud.eicat.ca/index.php/s/vAKUymZr3OD59i7

aargh. That link is all better as of now. Has the output (with debug
turned on).

[Zaphod Beeblebrox]

This post might be inappropriate. Click to display it.

[David STIEVENARD]

Hi

See inline comments

Post by Zaphod Beeblebrox
So... I've been running Samba 3.6 for too long and I upgraded. I did save
my packages for 3.6, but I don't _think_ I'm going back.
- Samba 4.4.x is broken on FreeBSD. I forget exactly, but it seems to
be a known problem (tm), so I'll move on.

What is wrong with Samba 4.4.x on FreeBSD ?

Here's the info I collected

I added this bug, with the package version of 4.4.3_1 on FreeBSD 10.3,
the domain provisioning fails
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209787

There is also this bug
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209707

There are in total 38 bugs in the list, and it seems that the port
maintainer is quite busy with all of this.

Post by Zaphod Beeblebrox
- Whether I use BIND9_DLZ or I use SAMBA_INTERNAL, samba_dnsupdate
complains. Strange thing, tho: all the domains seem to lookup fine. I
can't exactly find the problem here.

I understand this is a known problem and can possibly be 'fixed' by
adding 'allow dns updates = nonsecure and secure' to smb.conf on the DC.

I confirm, this information made my test work

Post by Zaphod Beeblebrox
- BIG ONE: wbinfo isn't working and (related, for me) idmap isn't either.
... so on that last one, wbinfo -u or -g print nothing (not even errors).
wbinfo -D HOME or -t are fine. wbinfo -i adminsitrator prints out the
unhelpful

This is regression from the 'badlock' patches and should have been
https://www.samba.org/samba/history/samba-4.4.3.html

Post by Zaphod Beeblebrox
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user administrator
... which aparently WBC_ERR_DOMAIN_NOT_FOUND is just the default error (or
that's what I read in one place).
Now... this is pretty bupkis, because ldbsearch finds the SID for
administrator _and_ for my login just fine. In addition, ldbedit lets me
change my xidNumber. I did so. when I re-ldbedit... it's changed.

And this where lots of people make the same mistake, don't change the
'xidNumber' attribute in idmap.ldb, add a 'uidNumber' attribute to the
users object in sam.ldb.
Rowland

Post by Zaphod Beeblebrox
... but this doesn't change the uid that files are created with. Sigh.
More reading said that there's another SID ... the SID for the "group of
me" ... and I have instructions for wbinfo to find that SID so I can
ldbedit it. But you see my problem: wbinfo for finding SIDs is broke.
Now... I've put my time into this. I've broken out ktrace and log level =
10. I've put a whole afternoon into this. Log stuff is a _bit_
[2016/07/11 01:10:37.408526, 1, pid=24476, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debu
g)
wbint_LookupName: struct wbint_LookupName
in: struct wbint_LookupName
domain : *
domain : 'HOME'
name : *
name : 'ZBEEBLE'
flags : 0x00000008 (8)
[2016/07/11 01:10:37.414175, 1, pid=24476, effective(0, 0), real(0, 0)]
../librpc/ndr/ndr.c:439(ndr_print_function_debug)
wbint_LookupName: struct wbint_LookupName
out: struct wbint_LookupName
type : *
type : SID_NAME_USE_NONE (0)
sid : *
sid : S-0-0
result : NT_STATUS_UNSUCCESSFUL
but further on in the file (probably coming from a random SMB file access)
Parsing value for key
value=[3000016:B]
[2016/07/11 01:10:56.209343, 10, pid=24476, effective(0, 0), real(0, 0)]
../source3/lib/idmap_cache.c:75(idmap_cache_find_sid2unixid)
Parsing value for key
id=[3000016], endptr=[:B]
[2016/07/11 01:10:56.209352, 10, pid=24476, effective(0, 0), real(0, 0),
class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send)
SID 1: S-1-5-21-3505373935-2275348003-3197909400-513
... which is curious because 3000016 is the wrong, old or automatically
assigned UID and the SID there is my SID.
... all very frustrating.
At least my Shield TV talks to the box. Sigh.

Unfortunatly I'm facing another problem : freenas 9.10 has a problem to
join a samba 4.3.9 domain on freebsd 10.3
https://forums.freenas.org/index.php?threads/ad-auth-fails-after-upgrade.42836/#post-279550
https://bugs.freenas.org/issues/15823

this post seems to have the solution :
https://forums.freenas.org/index.php?threads/ad-auth-fails-after-upgrade.42836/#post-279550
but I didn't get it yet.