Re: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5

To: mp%petermann-it.de@localhost
Subject: Re: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5
From: Kunihiro Yasukouchi <kys%tbf.t-com.ne.jp@localhost>
Date: Thu, 22 Dec 2022 01:31:31 +0900 (JST)
Hi,

little bit old topic,,,

> combination NetBSD 9.99.106 and Samba 4.16.5(from pkgsrc 2022Q3),
> the name resolution for usernames / groups via nss_winbind does not work anymore.
I've also faced this issue on NetBSD 9.99.10[68], 10.99.1 and net/samba4 4.16.x, 4.17.x

however,
NetBSD 9.99.108, 10.99.1, 10_BETA and net/samba4 4.15.x (latest pkgsrc-2022Q2) is no problem.

I could not find any change about winbind/nss_winbind on Samba release notes, but some libraries linked to nss_winbind.so would be changed,

for example, samba 4.15.x on NetBSD
% ldd /usr/lib/nss_winbind.so.0
/usr/lib/nss_winbind.so.0:
    -lwinbind-client-samba4 => /usr/pkg/lib/samba/private/libwinbind-client-samba4.so
    -lreplace-samba4 => /usr/pkg/lib/samba/private/libreplace-samba4.so
    -lc.12 => /usr/lib/libc.so.12
    -lpthread.1 => /usr/lib/libpthread.so.1


on the other hands, samba 4.16.x or later on NetBSD
% ldd /usr/lib/nss_winbind.so.0
/usr/lib/nss_winbind.so.0:
    -lpthread.1 => /usr/lib/libpthread.so.1
    -lc.12 => /usr/lib/libc.so.12

on any Linux or FreeBSD are also same, but working appropriately.

like Matthias, winbind itself works well. wbinfo -u/-g retrieve information from AD.
only via nss don't work well.


> Is there a way to view nsdispatch or the name service switch mechanism
> in more detail or to enable additional logging?

> Has anyone observed the same problem and might have an idea what the
> problem is?
I'm looking for any solution, too...

Regards,
--
kei


In article (Subject: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5 
            Date: Mon, 14 Nov 2022 11:06:20 +0100)
   You(Matthias Petermann <mp%petermann-it.de@localhost>) wrote :

> Hello all,
> 
> I have been using NetBSD 9.99.99 with Samba 4.15.9 (from pkgsrc
> 2022Q2) as Windows Domain Controller for a while now which worked
> well.
> 
> Since I switched to the combination NetBSD 9.99.106 and Samba 4.16.5
> (from pkgsrc 2022Q3), the name resolution for usernames / groups via
> nss_winbind does not work anymore.
> 
> The Windows clients are not directly affected by this, since the nss
> mechanism, especially on the Unix side, ensures that the correct
> plaintext names can be displayed for the numeric user and group ids
> assigned by Samba - for example, with ls. The workaround at the moment
> is to work with the numeric IDs. This is inconvenient and error-prone.
> 
> As proof, I try to display the user information for the built-in
> domain administrator account via id command:
> 
> ```
> net$ id Administrator
> id: Administrator: No such user
> ```
> 
> I have checked the following so far:
> 
> 1) Basic function kerberos with kinit / klist.
> 
> ```
> net$ kinit Administrator
> Administrator@TEST.LOCAL's Password:
> 
> net$ klist
> Credentials cache: FILE:/tmp/krb5cc_1000
>         Principal: Administrator@TEST.LOCAL
> 
>   Issued                Expires               Principal
> Nov 14 10:42:45 2022 Nov 14 20:42:45 2022 krbtgt/TEST.LOCAL@TEST.LOCAL
> ```
> 
> 2) Joining the Domain from a Windows 11 Prof 22H2 based host
> 
>  - works
> 
> 3) Basic function winbind
> 
> ```
> net$ wbinfo -i Administrator
> TEST\administrator:*:0:100::/home/TEST/administrator:/bin/false
> 
> net$ wbinfo -g Administrator
> TEST\cert publishers
> TEST\ras and ias servers
> TEST\allowed rodc password replication group
> TEST\denied rodc password replication group
> TEST\dnsadmins
> TEST\enterprise read-only domain controllers
> TEST\domain admins
> TEST\domain users
> TEST\domain guests
> TEST\domain computers
> TEST\domain controllers
> TEST\schema admins
> TEST\enterprise admins
> TEST\group policy creator owners
> TEST\read-only domain controllers
> TEST\dnsupdateproxy
> ```
> 
> 4) /etc/nsswitch.conf
> 
> ```
> group:          files winbind
> group_compat:   nis
> hosts:          files dns
> netgroup:       files [notfound=return] nis
> networks:       files
> passwd:         files winbind
> passwd_compat:  nis
> shells:         files
> ```
> 
> 5) libnss winbind
> 
> ```
> net$ ls -la /usr/lib/nss_winbind.so.0 
> 
> lrwxr-xr-x 1 root wheel 30 Nov 14 09:56 /usr/lib/nss_winbind.so.0 ->
> /usr/pkg/lib/libnss_winbind.so
> ```
> 
> 6) Ktrace of the "id" command (excerpts)
> 
> ```
> net$ ktrace id Administrator
> id: Administrator: No such user
> net$ kdump
> ....
> 592    592 id       CALL  open(0x785c601b43b8,0x400000,0x1b6)
>    592    592 id       NAMI  "/etc/nsswitch.conf"
>    592    592 id       RET   open 3
>    592 592 id CALL
>    mmap(0,0x7000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338150055936/0x785c606ca000
>    592 592 id CALL
>    mmap(0,0x7000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338150027264/0x785c606c3000
>    592 592 id CALL
>    mmap(0,0x5000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338150006784/0x785c606be000
>    592 592 id CALL
>    mmap(0,0x5000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338149986304/0x785c606b9000
>    592    592 id       CALL  __fstat50(3,0x7f7fff082110)
>    592    592 id       RET   __fstat50 0
>    592 592 id CALL
>    mmap(0,0x5000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338149965824/0x785c606b4000
>    592    592 id       CALL  read(3,0x785c606b4740,0x4000)
>    592    592 id       GIO   fd 3 read 667 bytes
>        "# $NetBSD: nsswitch.conf,v 1.6 2009/10/25 00:17:06 tsarna Exp $\n#\n#
>        nsswitch.conf(5) -\n# name service switch configurat\
>         ion file\n#\n\n\n# These are the defaults in libc\n#\n#group:
>         compat\ngroup: files winbind\ngroup_compat: nis\nh\
>         osts: files dns\nnetgroup: files [notfound=return] nis\nnetworks:
>         files\n#passwd: compat\npasswd: files winbind\
>         \npasswd_compat: nis\nshells: files\n\n\n# List of supported sources
>         for each database\n#\n# group: compat\
>         , dns, files, nis\n# group_compat: dns, nis\n# hosts: dns, files, nis,
>         mdnsd, multicast_dns\n# netgroup:\
>                         files, nis\n# networks: dns, files, nis\n# passwd: compat, dns, files,
>                         nis\n# passwd_compat:\
>                 dns, nis\n# shells:             dns, files, nis\n"
>    592    592 id       RET   read 667/0x29b
>    592    592 id       CALL  read(3,0x785c606b4740,0x4000)
>    592    592 id       GIO   fd 3 read 0 bytes
>        ""
> ....
>  592    592 id       CALL  open(0x7f7fff0817b8,0,7)
>    592    592 id       NAMI  "/usr/lib/nss_files.so.0"
>    592    592 id       RET   open -1 errno 2 No such file or directory
>    592    592 id       CALL  __sigprocmask14(3,0x7f7fff081e60,0)
>    592    592 id       RET   __sigprocmask14 0
>    592 592 id CALL
>    mmap(0,0x5000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338149941248/0x785c606ae000
>    592    592 id       CALL  _lwp_self
>    592    592 id       RET   _lwp_self 592/0x250
>    592 592 id CALL __sigprocmask14(1,0x7f7fff081e20,0x7f7fff081e60)
>    592    592 id       RET   __sigprocmask14 0
>    592    592 id       CALL  open(0x7f7fff0817b8,0,1)
>    592    592 id       NAMI  "/usr/lib/nss_winbind.so.0"
>    592    592 id       RET   open 4
>    592    592 id       CALL  __fstat50(4,0x7f7fff0816b8)
>    592    592 id       RET   __fstat50 0
>    592 592 id CALL
>    mmap(0,0x1000,PROT_READ,0x1<SHARED,FILE,ALIGN=NONE>,4,0,0)
>    592    592 id       RET   mmap 132338149937152/0x785c606ad000
>    592    592 id       CALL  munmap(0x785c606ad000,0x1000)
>    592    592 id       RET   munmap 0
>    592 592 id CALL
>    mmap(0,0x21b000,PROT_READ|PROT_EXEC,0x15000002<PRIVATE,FILE,ALIGN=2MB>,4,0,0)
>    592    592 id       RET   mmap 132338132451328/0x785c5f600000
>    592 592 id CALL
>    mmap(0x785c5f810000,0x2000,PROT_READ|PROT_WRITE,0x12<PRIVATE,FIXED,FILE,ALIGN=NONE>,4,0,0x10000)
>    592    592 id       RET   mmap 132338134614016/0x785c5f810000
>    592 592 id CALL
>    mmap(0x785c5f812000,0x9000,PROT_READ|PROT_WRITE,0x1012<PRIVATE,FIXED,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
>    592    592 id       RET   mmap 132338134622208/0x785c5f812000
>    592    592 id       CALL  mprotect(0x785c5f611000,0x1ff000,PROT_NONE)
>    592    592 id       RET   mprotect 0
>    592    592 id       CALL  close(4)
>    592    592 id       RET   close 0
>    592    592 id       CALL  open(0x7f7fff081728,0,4)
>    592    592 id       NAMI  "/usr/pkg/lib/libpthread.so.1"
>    592    592 id       RET   open -1 errno 2 No such file or directory
>    592    592 id       CALL  open(0x7f7fff081728,0,2)
>    592    592 id       NAMI  "/usr/pkg/lib/samba/private/libpthread.so.1"
>    592    592 id       RET   open -1 errno 2 No such file or directory
>    592    592 id       CALL  open(0x7f7fff081728,0,0)
>    592    592 id       NAMI  "/usr/lib/libpthread.so.1"
>    592    592 id       RET   open 4
>    592    592 id       CALL  __fstat50(4,0x7f7fff081628)
> ```
> 
> There are no peculiarities in the logfiles of Samba or Winbindd, not
> even in the usual syslog logfiles.
> 
> Is there a way to view nsdispatch or the name service switch mechanism
> in more detail or to enable additional logging?
> 
> Has anyone observed the same problem and might have an idea what the
> problem is?
> 
> Kind regards
> Matthias
Follow-Ups:
- Re: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5
  - From: Christos Zoulas
References:
- nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5
  - From: Matthias Petermann
Prev by Date: Re: 10_BETA: Nice QOL improvements to the installer
Next by Date: Re: 10_BETA: Nice QOL improvements to the installer
Previous by Thread: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5
Next by Thread: Re: nss_winbind not functional anymore on NetBSD 9.99.106 and Samba 4.16.5
Indexes:
Home | Main Index | Thread Index | Old Index