Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bug#909465: samba: Upgrade samba fails if winbind is install with default config

3,325 views
Skip to first unread message

Louis van Belle

unread,
Sep 24, 2018, 5:50:03 AM9/24/18
to
Package: samba
Version: 2:4.9.1+nmu-1~deb9
Severity: normal
Tags: d-i


Hai,

Im testing the samba 4.8.5 4.9.0 and (4.9.1 personal/community repo) and i notice the following.
Since samba 4.9.0. ( from experimental ) samba upgrades fail if winbind is installed even with the default config.

Steps to reproduce
install samba and winbind.
Upgrade to 4.9.0
This fails while upgrading with a systemd 255/n/a status.
apt-get remove winbind and the upgrade finishes fine.

I suspect a bug in the detection of settings with the parameter security =


-- Package-specific info:
* /etc/samba/smb.conf present, and attached
* /var/lib/samba/dhcp.conf not present

-- System Information:
Debian Release: 9.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages samba depends on:
ii adduser 3.115
ii dpkg 1.18.25
ii libbsd0 0.8.3-1
ii libc6 2.24-11+deb9u3
ii libldb1 2:1.4.2-2.1~deb9+1
ii libpam-modules 1.1.8-3.6
ii libpam-runtime 1.1.8-3.6
ii libpopt0 1.16-10+b2
ii libpython2.7 2.7.13-2+deb9u2
ii libtalloc2 2.1.14+nmu-1.1~deb9
ii libtdb1 1.3.16+nmu-1.1~deb9
ii libtevent0 0.9.37+nmu-1.1~deb9
ii lsb-base 9.20161125
ii procps 2:3.3.12-3+deb9u1
ii python 2.7.13-2
ii python-dnspython 1.15.0-1
ii python-samba 2:4.9.1+nmu-1~deb9
ii python2.7 2.7.13-2+deb9u2
ii samba-common 2:4.9.1+nmu-1~deb9
ii samba-common-bin 2:4.9.1+nmu-1~deb9
ii samba-libs 2:4.9.1+nmu-1~deb9
ii tdb-tools 1.3.16+nmu-1.1~deb9

Versions of packages samba recommends:
ii attr 1:2.4.47-2+b2
ii logrotate 3.11.0-0.1
ii samba-dsdb-modules 2:4.9.1+nmu-1~deb9
ii samba-vfs-modules 2:4.9.1+nmu-1~deb9

Versions of packages samba suggests:
pn bind9 <none>
pn bind9utils <none>
pn ctdb <none>
pn ldb-tools <none>
pn ntp | chrony <none>
pn smbldap-tools <none>
pn ufw <none>
pn winbind <none>

-- no debconf information
smb.conf

L.P.H. van Belle

unread,
Sep 24, 2018, 8:30:03 AM9/24/18
to
Hai,
Few steps to see whats happening with some output.
Below is shown with 4.9.1 *(own package) but it also happens with 4.9.0. ( exact the same. )

On a clean new installed debian (stretch) server.
apt-get install samba winbind
.....
.....
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE

Done
Setting up samba-dsdb-modules:amd64 (2:4.9.1+nmu-1~deb9) ...
Setting up winbind (2:4.9.1+nmu-1~deb9) ...
mkdir: created directory '/var/lib/samba/winbindd_privileged'
changed group of '/var/lib/samba/winbindd_privileged' from root to winbindd_priv
mode of '/var/lib/samba/winbindd_privileged' changed from 0755 (rwxr-xr-x) to 0750 (rwxr-x---)
Created symlink /etc/systemd/system/multi-user.target.wants/winbind.service ?¨ /lib/systemd/system/winbind.service.
Setting up samba (2:4.9.1+nmu-1~deb9) ...
Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding those services.
(samba-ad-dc.service masked)
Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xe" for details.
invoke-rc.d: initscript smbd, action "start" failed.
?? smbd.service - Samba SMB Daemon
Loaded: loaded (/lib/systemd/system/smbd.service; disabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2018-09-24 13:23:24 CEST; 7ms ago
Docs: man:smbd(8)
man:samba(7)
man:smb.conf(5)
Process: 12594 ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS (code=exited, status=255)
Main PID: 12594 (code=exited, status=255)

Sep 24 13:23:24 debian9test systemd[1]: Starting Samba SMB Daemon...
Sep 24 13:23:24 debian9test systemd[1]: smbd.service: Main process exited, code=exited, status=255/n/a
Sep 24 13:23:24 debian9test systemd[1]: Failed to start Samba SMB Daemon.
Sep 24 13:23:24 debian9test systemd[1]: smbd.service: Unit entered failed state.
Sep 24 13:23:24 debian9test systemd[1]: smbd.service: Failed with result 'exit-code'.
dpkg: error processing package samba (--configure):
subprocess installed post-installation script returned error exit status 1
Processing triggers for libc-bin (2.24-11+deb9u3) ...
Processing triggers for systemd (232-25+deb9u4) ...
Errors were encountered while processing:
samba
E: Sub-process /usr/bin/dpkg returned an error code (1)


Test:
systemctl stop winbind
apt-get -f install
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up samba (2:4.9.1+nmu-1~deb9) ...
Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding those services.
(samba-ad-dc.service already masked)
Created symlink /etc/systemd/system/multi-user.target.wants/nmbd.service ?¨ /lib/systemd/system/nmbd.service.
Failed to preset unit: Unit file /etc/systemd/system/samba-ad-dc.service is masked.
/usr/bin/deb-systemd-helper: error: systemctl preset failed on samba-ad-dc.service: No such file or directory
Created symlink /etc/systemd/system/multi-user.target.wants/smbd.service ?¨ /lib/systemd/system/smbd.service.
Processing triggers for libc-bin (2.24-11+deb9u3) ...
W: APT had planned for dpkg to do more than it reported back (0 vs 4).
Affected packages: samba:amd64

Results in ps fax :
15173 ? Ss 0:00 /usr/sbin/smbd --foreground --no-process-group
15175 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15176 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15178 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15211 ? Ss 0:00 /usr/sbin/nmbd --foreground --no-process-group

The only error ( with the default smb.conf settings )
Logs show :
[2018/09/24 14:06:01.620243, 0] ../source3/auth/auth_util.c:1382(make_new_session_info_guest)
create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/09/24 14:06:01.620284, 0] ../source3/smbd/server.c:2000(main)
ERROR: failed to setup guest info.
[2018/09/24 14:06:34.850213, 0] ../lib/util/become_daemon.c:138(daemon_ready)
daemon_ready: STATUS=daemon 'smbd' finished starting up and ready to serve connections

systemctl start winbind
ps fax
15173 ? Ss 0:00 /usr/sbin/smbd --foreground --no-process-group
15175 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15176 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15178 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
15211 ? Ss 0:00 /usr/sbin/nmbd --foreground --no-process-group
15289 ? Ss 0:00 /usr/sbin/winbindd --foreground --no-process-group
15291 ? S 0:00 \_ winbindd: domain child [DEBIAN9TEST]



Or what also works is removing winbind.
apt-get remove winbind
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
winbind
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 1,903 kB disk space will be freed.
Do you want to continue? [Y/n]
(Reading database ... 36955 files and directories currently installed.)
Removing winbind (2:4.9.1+nmu-1~deb9) ...
Processing triggers for libc-bin (2.24-11+deb9u3) ...
Processing triggers for man-db (2.7.6.1-2) ...
root@debian9test:/var# apt-get -f install
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

ps fax show
12709 ? Ss 0:00 /usr/sbin/smbd --foreground --no-process-group
12711 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
12712 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
12714 ? S 0:00 \_ /usr/sbin/smbd --foreground --no-process-group
12747 ? Ss 0:00 /usr/sbin/nmbd --foreground --no-process-group

L.P.H. van Belle

unread,
Sep 25, 2018, 4:10:03 AM9/25/18
to
Hai,
 
i've done some extra testing.
Thank you Mathieu for the quick upgrade to 4.9.1 in experimental.
 
The server in the previous post is a vm, i snaphoted it before i installed samba.
Now i've upgraded to Debian buster, rebooted reboot.
 
BUSTER, samba 4.8.5  ( all fine )
apt-get install samba winbind
 
Setting up samba-common-bin (2:4.8.5+dfsg-1) ...
Checking smb.conf with testparm

Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE
 
Done
Setting up samba-dsdb-modules:amd64 (2:4.8.5+dfsg-1) ...
Setting up winbind (2:4.8.5+dfsg-1) ...

mkdir: created directory '/var/lib/samba/winbindd_privileged'
changed group of '/var/lib/samba/winbindd_privileged' from root to winbindd_priv
mode of '/var/lib/samba/winbindd_privileged' changed from 0755 (rwxr-xr-x) to 0750 (rwxr-x---)
Created symlink /etc/systemd/system/multi-user.target.wants/winbind.service → /lib/systemd/system/winbind.service.
Setting up samba (2:4.8.5+dfsg-1) ...

Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding those services.
(samba-ad-dc.service masked)
Created symlink /etc/systemd/system/multi-user.target.wants/nmbd.service → /lib/systemd/system/nmbd.service.

Failed to preset unit: Unit file /etc/systemd/system/samba-ad-dc.service is masked.
/usr/bin/deb-systemd-helper: error: systemctl preset failed on samba-ad-dc.service: No such file or directory
Created symlink /etc/systemd/system/multi-user.target.wants/smbd.service → /lib/systemd/system/smbd.service.
Processing triggers for libc-bin (2.27-6) ...
Processing triggers for initramfs-tools (0.132) ...
update-initramfs: Generating /boot/initrd.img-4.18.0-1-amd64
Processing triggers for systemd (239-9) ...
 
ps fax
 6128 ?        Ss     0:00 /usr/sbin/winbindd --foreground --no-process-group
 6130 ?        S      0:00  \_ winbindd: domain child [DEBIAN9TEST]
 6242 ?        S      0:00  \_ winbindd: idmap child
 6243 ?        S      0:00  \_ winbindd: domain child [BUILTIN]
 6238 ?        Ss     0:00 /usr/sbin/smbd --foreground --no-process-group
 6240 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 6241 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 6244 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 6279 ?        Ss     0:00 /usr/sbin/nmbd --foreground --no-process-group
 
 
i've now added :  deb http://ftp.nl.debian.org/debian/ experimental main non-free contrib
to apt/sources.list
 
And installing samba with : apt-get install -t experimental samba winbind
This files, screen outputs are shown here.
 
BUSTER, Upgrade to 4.9.1
Setting up samba-common-bin (2:4.9.1+dfsg-1) ...
Checking smb.conf with testparm

Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE
 
Done
Setting up samba-dsdb-modules:amd64 (2:4.9.1+dfsg-1) ...
Setting up winbind (2:4.9.1+dfsg-1) ...
Setting up samba (2:4.9.1+dfsg-1) ...

Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding those services.
(samba-ad-dc.service already masked)
Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xe" for details.
invoke-rc.d: initscript smbd, action "restart" failed.
● smbd.service - Samba SMB Daemon
   Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2018-09-25 09:53:30 CEST; 8ms ago

     Docs: man:smbd(8)
           man:samba(7)
           man:smb.conf(5)
  Process: 8904 ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS (code=exited, status=255)
 Main PID: 8904 (code=exited, status=255)
 
Sep 25 09:53:30 debian9test systemd[1]: Starting Samba SMB Daemon...
Sep 25 09:53:30 debian9test systemd[1]: smbd.service: Main process exited, code=exited, status=255/n/a
Sep 25 09:53:30 debian9test systemd[1]: smbd.service: Failed with result 'exit-code'.
Sep 25 09:53:30 debian9test systemd[1]: Failed to start Samba SMB Daemon.

dpkg: error processing package samba (--configure):
 installed samba package post-installation script subprocess returned error exit status 1
Processing triggers for libc-bin (2.27-6) ...

Errors were encountered while processing:
 samba
E: Sub-process /usr/bin/dpkg returned an error code (1)
 
apt-get remove winbind

The following packages will be REMOVED:
  winbind
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 2,008 kB disk space will be freed.

Do you want to continue? [Y/n]
(Reading database ... 45774 files and directories currently installed.)
Removing winbind (2:4.9.1+dfsg-1) ...
Processing triggers for libc-bin (2.27-6) ...
Processing triggers for man-db (2.8.4-2) ...
Setting up samba (2:4.9.1+dfsg-1) ...

Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding those services.
(samba-ad-dc.service already masked)
Failed to preset unit: Unit file /etc/systemd/system/samba-ad-dc.service is masked.
/usr/bin/deb-systemd-helper: error: systemctl preset failed on samba-ad-dc.service: No such file or directory
Processing triggers for libc-bin (2.27-6) ...
 

apt-get -f install
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  dh-python libbind9-140 libdns162 libgmime-2.6-0 libicu57 libisc160 libisccc140 libisccfg140 liblwres141 libnotmuch4 libperl5.24 libpython3.5-minimal libpython3.5-stdlib linux-image-4.9.0-7-amd64
  python3-distutils python3-lib2to3 python3.5 python3.5-minimal rename sgml-base xml-core
Use 'apt autoremove' to remove them.

0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
 
ps fax
 9198 ?        Ss     0:00 /usr/sbin/smbd --foreground --no-process-group
 9200 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9201 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9202 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9237 ?        Ss     0:00 /usr/sbin/nmbd --foreground --no-process-group
 
 apt-get install winbind

 systemctl start winbind
 
 ps fax
   462 ?        S      0:00  \_ (sd-pam)
 9198 ?        Ss     0:00 /usr/sbin/smbd --foreground --no-process-group
 9200 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9201 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9202 ?        S      0:00  \_ /usr/sbin/smbd --foreground --no-process-group
 9237 ?        Ss     0:00 /usr/sbin/nmbd --foreground --no-process-group
 9554 ?        Ss     0:00 /usr/sbin/winbindd --foreground --no-process-group
 9556 ?        S      0:00  \_ winbindd: domain child [DEBIAN9TEST]
 
 
reboot
 
ps fax | egrep "winbind|?mbd"
  457 ?        Ss     0:00 /usr/sbin/nmbd --foreground --no-process-group
  540 pts/0    S+     0:00                          \_ grep -E winbind|?mbd
  465 ?        Ss     0:00 /usr/sbin/winbindd --foreground --no-process-group
  467 ?        S      0:00  \_ winbindd: domain child [DEBIAN9TEST]
  472 ?        S      0:00  \_ winbindd: idmap child
 
and smbd isnt running anymore after the reboot.
 
systemctl start smbd

Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xe" for details.
 
-- Unit smbd.service has begun starting up.
Sep 25 09:58:49 debian9test systemd[1]: smbd.service: Main process exited, code=exited, status=255/n/a
Sep 25 09:58:49 debian9test systemd[1]: smbd.service: Failed with result 'exit-code'.
Sep 25 09:58:49 debian9test systemd[1]: Failed to start Samba SMB Daemon.
-- Subject: Unit smbd.service has failed
-- Defined-By: systemd
-- Support:
https://www.debian.org/support
--
-- Unit smbd.service has failed.
--
-- The result is RESULT.
 
cat /var/log/samba/log.smbd
[2018/09/25 09:52:11.431287,  0] ../lib/util/become_daemon.c:138(daemon_ready)

  daemon_ready: STATUS=daemon 'smbd' finished starting up and ready to serve connections
[2018/09/25 09:53:30.808201,  0] ../source3/auth/auth_util.c:1382(make_new_session_info_guest)
  create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/09/25 09:53:30.808246,  0] ../source3/smbd/server.c:2000(main)

  ERROR: failed to setup guest info.
[2018/09/25 09:53:48.724111,  0] ../lib/util/become_daemon.c:138(daemon_ready)

  daemon_ready: STATUS=daemon 'smbd' finished starting up and ready to serve connections
[2018/09/25 09:56:51.050810,  0] ../source3/auth/auth_util.c:1382(make_new_session_info_guest)
  create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/09/25 09:56:51.051352,  0] ../source3/smbd/server.c:2000(main)

  ERROR: failed to setup guest info.
[2018/09/25 09:58:34.429130,  0] ../source3/auth/auth_util.c:1382(make_new_session_info_guest)
  create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/09/25 09:58:34.429174,  0] ../source3/smbd/server.c:2000(main)

  ERROR: failed to setup guest info.
[2018/09/25 09:58:49.892008,  0] ../source3/auth/auth_util.c:1382(make_new_session_info_guest)
  create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/09/25 09:58:49.892053,  0] ../source3/smbd/server.c:2000(main)
 
 
 
 
 

Eric Valette

unread,
Sep 27, 2018, 12:50:04 PM9/27/18
to
Paramétrage de samba (2:4.9.1+dfsg-1) ...
Samba is not being run as an AD Domain Controller: Masking
samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding
those services.
(samba-ad-dc.service already masked)
Job for smbd.service failed because the control process exited with
error code.
See "systemctl status smbd.service" and "journalctl -xe" for details.
invoke-rc.d: initscript smbd, action "restart" failed.
● smbd.service - Samba SMB Daemon
Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor
preset: enabled)
Active: failed (Result: exit-code) since Thu 2018-09-27 18:43:16
CEST; 7ms ago
Docs: man:smbd(8)
man:samba(7)
man:smb.conf(5)
Process: 8724 ExecStart=/usr/sbin/smbd --foreground
--no-process-group $SMBDOPTIONS (code=exited, status=255)
Main PID: 8724 (code=exited, status=255)

sept. 27 18:43:16 nas2 systemd[1]: Starting Samba SMB Daemon...
sept. 27 18:43:16 nas2 systemd[1]: smbd.service: Main process exited,
code=exited, status=255/n/a
sept. 27 18:43:16 nas2 systemd[1]: smbd.service: Failed with result
'exit-code'.
sept. 27 18:43:16 nas2 systemd[1]: Failed to start Samba SMB Daemon.
dpkg: erreur de traitement du paquet samba (--configure) :
installed samba package post-installation script subprocess returned
error exit status
-- eric

L.P.H. van Belle

unread,
Sep 28, 2018, 2:50:03 AM9/28/18
to
Hai,
 
We have found the following.
This only happings with the standalone install if you setup for a ADDC or Member server, you get past this bug.
 
It happens due to systemd smbd.service
# /lib/systemd/system/smbd.service
[Unit]
Description=Samba SMB Daemon
Documentation=man:smbd(8) man:samba(7) man:smb.conf(5)
Wants=network-online.target
After=network.target network-online.target nmbd.service winbind.service
The "After .. winbind.service" shows the bug in question and this causes smbd to fail at boot.
 
I have a few workarounds to make it work.
 
install a stand-alone server.
apt-get install samba
 
To avoid the problem run :
net groupmap add sid=S-1-5-32-546 unixgroup=nobody type=builtin
 
or define the idmap in smb.conf

idmap config * : backend = tdb
idmap config * : range = 3000-7999

Now you can install winbind also, if you dont need winbind, then the bug does not show.

Greetz,

 
Louis
 

L.P.H. van Belle

unread,
Oct 19, 2018, 4:30:03 AM10/19/18
to
Hai,

I have an update on this and created working package without startup problems.

i've added in the samba-common.postinst the following part at the end just before #DEBHELPER#

# Test server role and change smb.conf to enable idmap * by default.
SERVER_ROLE=`samba-tool testparm --parameter-name="server role" 2>/dev/null | tail -1`

# Enable idmap config * by default. Only match untouched configs.
if [ "$SERVER_ROLE" = "standalone server" ] || [ "$SERVER_ROLE" = "auto" ]; then
sed -i \
-e 's/; idmap config \* : backend = tdb/ idmap config * : backend = tdb/g' \
-e 's/; idmap config \* : range = 3000-7999/ idmap config * : range = 3000-7999/g' \
"$CONFIG"
fi


The sed command might need some improvement here, but this allow a flawless install.
Upgrade from a 4.8.5 also worked fine for me, its tested by users off the sambalist now.

Thoughts of this are.

- a new install used the smb.conf and the change is applied.
and all services are starting as they should
- a old install with the defaults intact gets the changes also.
and all services are starting as they should
- any modified smb.conf where idmap is already enabled isnt applied.
you must manual change smb.conf.
- it only applies to the standalone server


This is imo a good workaround until this bug is fixed in samba for the new/upgrade installations
As posted in the previous message. the other is
net groupmap add sid=S-1-5-32-546 unixgroup=nogroup type=builtin
Note, the previous mesasge had nobody as group, should be nogroup.


Greetz,

Louis

Javier Fernandez-Sanguino

unread,
Nov 11, 2018, 4:00:03 AM11/11/18
to
Dear colleagues,

Yesterday I upgraded to samba (from 2:4.8.5+dfsg-1 to 2:4.9.1+dfsg-2)
and had a similar issue, after the upgrade samba would not start,
breaking the 'apt-get dist-upgrade' at the end. To fix it I had to run
'net -s /dev/null groupmap add sid=S-1-5-32-546 unixgroup=nobody
type=builtin' and restart the smbd service.

Note that:
- The issue was not detected by testparm
- Smbd would not start, nmbd and winbind would restart properly
- My smb.conf is very similar to the standard default one provided
in the package already (if you want a copy let me know)

Reviewing the upgrade information here is some relevant output:

______________________________________________
$ apt-get dist-upgrade
(....)
Preparing to unpackage .../0256-samba-common_2%3a4.9.1+dfsg-2_all.deb ...
Unpackaging samba-common (2:4.9.1+dfsg-2) over (2:4.8.5+dfsg-1) ...
(...)
Configuring samba-common-bin (2:4.9.1+dfsg-2) ...
Checking smb.conf with testparm
Load smb config files from /etc/samba/smb.conf
WARNING: The "syslog" option is deprecated
Loaded services file OK.
Server role: ROLE_STANDALONE
Done
(...)
Configuring samba (2:4.9.1+dfsg-2) ...
Samba is not being run as an AD Domain Controller: Masking samba-ad-dc.service
Please ignore the following error about deb-systemd-helper not finding
those services.
(samba-ad-dc.service already masked)
Job for smbd.service failed because the control process exited with error code.
See "systemctl status smbd.service" and "journalctl -xe" for details.
invoke-rc.d: initscript smbd, action "restart" failed.
(...)
______________________________________________

This is from /var/log/samba/smbd.log:

______________________________________________
2018/11/11 02:36:13.835610, 0]
../source3/auth/auth_util.c:1382(make_new_session_info_guest)
create_local_token failed: NT_STATUS_ACCESS_DENIED
[2018/11/11 02:36:13.836169, 0] ../source3/smbd/server.c:2000(main)
ERROR: failed to setup guest info.
_____________________________________________

After looking for similar problems I found RedHat Bug #1648399
(https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=1648399)
which points to the folowing thread in the Samba mailing list:
https://lists.samba.org/archive/samba-technical/2018-September/130377.html

And apparently boils down to the following change in Samba and the
fact that the BUILTIN\Guests group is not mapped to a proper Unix user
:

______________________________________________
With 4.9.0 we expanded guest handling to differentiate between
anonymous and guest sessions. This required a proper handling of
BUILTIN\Guests and thus is now forces to be able to have either
writable backend or aliases configured properly.
______________________________________________

The action proposed in the bug reported, worked for me, and is the following:

______________________________________________
# net -s /dev/null groupmap add sid=S-1-5-32-546 unixgroup=nobody type=builtin
Successfully added group nobody to the mapping db as a wellknown group
______________________________________________

Maybe this action should be added into the postinst? (after checking
if the group is not mapped properly?)

Regards

Javier

Bernhard Schmidt

unread,
Nov 13, 2018, 11:40:02 AM11/13/18
to
Control: notfound -1 2:4.9.1+nmu-1~deb9
Control: found -1 2:4.9.1+dfsg-2
Control: tags -1 - d-i
Control: severity -1 important
Control: retitle -1 smbd fails to start in 2:4.9.1+dfsg-2, "failed to setup guest info."

On Sun, Nov 11, 2018 at 09:48:51AM +0100, Javier Fernandez-Sanguino wrote:

Dear Javier,

> Yesterday I upgraded to samba (from 2:4.8.5+dfsg-1 to 2:4.9.1+dfsg-2)
> and had a similar issue, after the upgrade samba would not start,
> breaking the 'apt-get dist-upgrade' at the end. To fix it I had to run
> 'net -s /dev/null groupmap add sid=S-1-5-32-546 unixgroup=nobody
> type=builtin' and restart the smbd service.

Thanks!!! I've been scratching my head about this.

I'm changing the version tracking and description to properly fit the
symptoms/versions in Debian.

Bernhard

Andreas Hasenack

unread,
Nov 30, 2018, 6:50:04 AM11/30/18
to
I filed this bug upstream for the time being, since the mailing list
threads about this topic all died with no clear solution:

https://bugzilla.samba.org/show_bug.cgi?id=13697

Mathieu Parent

unread,
Dec 2, 2018, 10:20:03 AM12/2/18
to
Control: forwarded -1 https://bugzilla.samba.org/show_bug.cgi?id=13697
Thanks for this. I'm waiting for upstream position on this. Andrew, any idea?

Regards
--
Mathieu Parent

Andreas Hasenack

unread,
Dec 15, 2018, 2:40:03 PM12/15/18
to
Same here, samba 4.9.x is blocked in Ubuntu until this is resolved, one way or another.

Andrew Bartlett

unread,
Dec 16, 2018, 1:50:03 AM12/16/18
to
I've raised the priority on the bug and hopefully we can get a fix.

I don't really understand what is going on here and why our tests don't
notice this.

Andrew Bartlett

--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba

L.P.H. van Belle

unread,
Dec 21, 2018, 6:20:03 AM12/21/18
to
hai,
 
I've just updated my 4.9.4 package including the fix from the bugzilla report and tested the patch
Solved it for me.
 
 
 
 
Greetz,
 
Louis
 
 
 
 
0 new messages