[Samba] Samba4 quit working after update

[Thomas Smith]

I have multiple Samba server (different customers, separate installations)
and they've all quit working after an apparent automatic update to Ubuntu
14.04 LTS. The symptoms are identical:

- None of the shares are browsable.
- Authentication seems to be working, at least on the Kerberos side.
- When running `smbclient -L localhost -UAdministrator` from the server,
the following error is generated: "session setup failed:
NT_STATUS_OBJECT_NAME_NOT_FOUND"
- `id Administrator` returns the Administrator account and group
memberships.

I'm at a bit of a lost now as to how to proceed--I've been researching now
for several hours and haven't made any headway.

Can anyone help with this please?

Thank you,

~ Tom
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[lingpa...@gmail.com]

On 4/19/2016 12:10 PM, Thomas Smith wrote:
> I have multiple Samba server (different customers, separate installations)
> and they've all quit working after an apparent automatic update to Ubuntu
> 14.04 LTS. The symptoms are identical:
>
> - None of the shares are browsable.
> - Authentication seems to be working, at least on the Kerberos side.
> - When running `smbclient -L localhost -UAdministrator` from the server,
> the following error is generated: "session setup failed:
> NT_STATUS_OBJECT_NAME_NOT_FOUND"
> - `id Administrator` returns the Administrator account and group
> memberships.
>
> I'm at a bit of a lost now as to how to proceed--I've been researching now
> for several hours and haven't made any headway.
>
> Can anyone help with this please?
>
> Thank you,
>
> ~ Tom

Does the samba log itself provide any insight?

--
-James

[Thomas Smith]

I set the Samba debug level to 4 a bit ago, so the logs are a bit
noisy--before that, there didn't seem to be much log activity when I
produced that error.

So with the debug level at 4, these entries kind of stand out a bit:

[2016/04/19 09:55:27.662721, 2]
../source4/smbd/process_standard.c:123(standard_child_pipe_handler)
Child 16336 (winbindd) exited with status 1

These entries repeat numerous times:
[2016/04/19 09:55:27.732104, 0]
../lib/util/util_runcmd.c:328(samba_runcmd_io_handler)
/usr/sbin/samba_dnsupdate: not adding non-broadcast interface as0t15
[2016/04/19 09:55:27.732124, 0]
../lib/util/util_runcmd.c:328(samba_runcmd_io_handler)
/usr/sbin/samba_dnsupdate: added interface eth0 ip=x.x.x.x
bcast=x.x.x.255 netmask=255.255.255.0
[2016/04/19 09:55:29.533765, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface eth0 ip=x.x.x.x bcast=x.x.x.255 netmask=255.255.255.0
[2016/04/19 09:55:31.630708, 3]
../source4/nbt_server/register.c:154(nbtd_register_name_handler)
Registered SERVER<00> with x.x.x.x on interface x.x.x.255

There are a ton of other entries, mostly from "dns_query.c" but also from
dreplsrv_*.

Does this help? I can paste all of the log entries surrounding the time
when I get the error, but there are quite a few--thought it might be too
long to post.

[lingpa...@gmail.com]

> <mailto:lingpa...@gmail.com> <lingpa...@gmail.com

I normally start with log level 0 and restart samba. Go up to level 3 if
needed and look for anything that throws and error. Normally at start up
right after the following.

[2016/04/15 10:52:35.252674, 0, pid=892, effective(0, 0), real(0, 0)]
../source4/smbd/server.c:373(binary_smbd_main)
samba version 4.4.2 started.
Copyright Andrew Tridgell and the Samba Team 1992-2016
[2016/04/15 10:52:35.761965, 0, pid=976, effective(0, 0), real(0, 0)]
../source4/smbd/server.c:485(binary_smbd_main)
samba: using 'standard' process model
[2016/04/15 10:52:35.793428, 0, pid=976, effective(0, 0), real(0, 0)]
../lib/util/become_daemon.c:124(daemon_ready)
STATUS=daemon 'samba' finished starting up and ready to serve connections

How are you running Samba?(ie. Domain Controller). Was it a Ubuntu
update or a Samba update? A few things to try is view recently install
Ubuntu updates

cat /var/log/apt/history.log

Also check if Samba is running correctly.

ps axf | egrep "samba|smbd|nmbd|winbindd"

What samba version are you running?

samba -V

[Thomas Smith]

Here's what I get at level 0 right after stopping/starting Samba:

[2016/04/19 12:27:06.043469, 0]
../source4/smbd/server.c:372(binary_smbd_main)
samba version 4.3.8-Ubuntu started.
Copyright Andrew Tridgell and the Samba Team 1992-2015
[2016/04/19 12:27:06.157629, 0]
../source4/smbd/server.c:490(binary_smbd_main)

samba: using 'standard' process model

samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
[2016/04/19 12:27:06.175375, 0]
../lib/util/util_runcmd.c:328(samba_runcmd_io_handler)
/usr/sbin/winbindd: Failed to exec child - No such file or directory
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
[2016/04/19 12:27:06.177081, 0]
../source4/winbind/winbindd.c:47(winbindd_done)
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
winbindd daemon died with exit status 255
[2016/04/19 12:27:06.177133, 0]
../source4/smbd/service_task.c:35(task_server_terminate)
task_server_terminate: [winbindd child process exited]
[2016/04/19 12:27:06.178228, 0]
../source4/smbd/server.c:211(samba_terminate)
samba_terminate: winbindd child process exited
samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.
[2016/04/19 12:27:06.180787, 0]

../lib/util/become_daemon.c:124(daemon_ready)
STATUS=daemon 'samba' finished starting up and ready to serve connections

samba: setproctitle not initialized, please either call setproctitle_init()
or link against libbsd-ctor.

Samba is running as an AD domain controller.

Some automatic updates were installed by Ubuntu yesterday morning, but the
problems began late last night.

Start-Date: 2016-04-19 06:33:19
Install: libarchive13:amd64 (3.1.2-7ubuntu2.1, automatic), liblzo2-2:amd64
(2.06-1.2ubuntu1.1, automatic), libnettle4:amd64 (2.7.1-1ubuntu0.1,
automatic)
Upgrade: python-samba:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), tdb-tools:amd64 (1.2.12-1,
1.3.8-0ubuntu0.14.04.1), samba:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), python-tdb:amd64 (1.2.12-1,
1.3.8-0ubuntu0.14.04.1), libtevent0:amd64 (0.9.19-1,
0.9.26-0ubuntu0.14.04.1), samba-dsdb-modules:amd64
(4.1.6+dfsg-1ubuntu2.14.04.13, 4.3.8+dfsg-0ubuntu0.14.04.2),
samba-common-bin:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), libldb1:amd64 (1.1.16-1ubuntu0.1,
1.1.24-0ubuntu0.14.04.1), libtdb1:amd64 (1.2.12-1, 1.3.8-0ubuntu0.14.04.1),
samba-libs:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), smbclient:amd64
(4.1.6+dfsg-1ubuntu2.14.04.13, 4.3.8+dfsg-0ubuntu0.14.04.2),
libtalloc2:amd64 (2.1.0-1, 2.1.5-0ubuntu0.14.04.1), python-talloc:amd64
(2.1.0-1, 2.1.5-0ubuntu0.14.04.1), libwbclient0:amd64
(4.1.6+dfsg-1ubuntu2.14.04.13, 4.3.8+dfsg-0ubuntu0.14.04.2),
samba-vfs-modules:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), python-ldb:amd64 (1.1.16-1ubuntu0.1,
1.1.24-0ubuntu0.14.04.1), samba-common:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
4.3.8+dfsg-0ubuntu0.14.04.2), libsmbclient:amd64
(4.1.6+dfsg-1ubuntu2.14.04.13, 4.3.8+dfsg-0ubuntu0.14.04.2)
End-Date: 2016-04-19 06:33:32

Output of `ps axf | egrep "samba|smbd|nmbd|winbindd"`.

16718 pts/1 Tl 0:00 | \_ vim /var/log/samba/log.samba
16908 pts/1 S+ 0:00 | \_ egrep --color=auto
samba|smbd|nmbd|winbindd
16693 ? Ss 0:00 samba -D
16695 ? S 0:00 \_ samba -D
16697 ? Ss 0:00 | \_ /usr/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
16712 ? S 0:00 | \_ /usr/sbin/smbd -D --option=server
role check:inhibit=yes --foreground
16714 ? S 0:00 | \_ /usr/sbin/smbd -D --option=server
role check:inhibit=yes --foreground
16696 ? S 0:00 \_ samba -D
16698 ? S 0:00 \_ samba -D
16699 ? S 0:00 \_ samba -D
16700 ? S 0:03 \_ samba -D
16701 ? S 0:00 \_ samba -D
16702 ? S 0:00 \_ samba -D
16703 ? S 0:00 \_ samba -D
16705 ? S 0:00 \_ samba -D
16707 ? S 0:00 \_ samba -D
16708 ? S 0:00 \_ samba -D
16709 ? S 0:00 \_ samba -D

Version 4.3.8-Ubuntu

[lingpa...@gmail.com]

> > <mailto:lingpa...@gmail.com <mailto:lingpa...@gmail.com>>
> <lingpa...@gmail.com <mailto:lingpa...@gmail.com>
> > <mailto:lingpa...@gmail.com <mailto:lingpa...@gmail.com>>>

When you ran ps axf | egrep "samba|smbd|nmbd|winbindd" did you see any
reference to winbindd?

what does 'ls -l /usr/sbin' give you? Your log has a few issues but
noticeably this.

/usr/sbin/winbindd: Failed to exec child - No such file or directory

[Rowland penny]

Hi, for some reason, winbind is dying:

.............

/usr/sbin/winbindd: Failed to exec child - No such file or directory

........

samba_terminate: winbindd child process exited

................

Is the winbind package installed ??

Can you post your smb.conf

Rowland

[Thomas Smith]

There is no winbindd--it was never installed. I don't recall exactly why I
didn't install it, but I seem to recall something about Samba4 in an AD
domain control role not needing it. I ended up using SSS instead.

Sanatized smb.conf:

# Global parameters
[global]
workgroup = DCS
realm = DCS.LOCAL
netbios name = SERVER
server role = active directory domain controller
dns forwarder = 8.8.8.8
idmap_ldb:use rfc2307 = yes

debug level = 0

[netlogon]
path = /var/lib/samba/sysvol/dcs.local/scripts
read only = No

[sysvol]
path = /var/lib/samba/sysvol
read only = No

# Network shares.
[Share]
comment = Sahre.
path = /srv/samba/Share
read only = no
browsable = no

>> > <mailto:lingpa...@gmail.com> <lingpa...@gmail.com

[Thomas Smith]

It was my understanding that winbind wasn't necessary for Samba4. This
server has been running for months without it.

Sanatized smb.conf:

# Global parameters
[global]
workgroup = DCS
realm = DCS.LOCAL
netbios name = SERVER
server role = active directory domain controller
dns forwarder = 8.8.8.8
idmap_ldb:use rfc2307 = yes

debug level = 0

[netlogon]
path = /var/lib/samba/sysvol/dcs.local/scripts
read only = No

[sysvol]
path = /var/lib/samba/sysvol
read only = No

# Network shares.
[Share]
comment = Sahre.
path = /srv/samba/Share
read only = no
browsable = no

[Rowland penny]

Even if you use sssd, you still need winbind installed and running on a
Samba AD DC.

Rowland

[Thomas Smith]

Ok, thank you--that worked, but it doesn't make sense.

The server's been operational for months without winbind. Did something
change in Samba that it won't operate now without it?

I specifically remember reading that winbind wasn't necessary and, in fact,
wasn't recommended with Samba 4 AD.

[Sketch]

On Tue, 19 Apr 2016, Thomas Smith wrote:

>>>>> Upgrade: python-samba:amd64 (4.1.6+dfsg-1ubuntu2.14.04.13,
>>>>> 4.3.8+dfsg-0ubuntu0.14.04.2)

>
> The server's been operational for months without winbind. Did something
> change in Samba that it won't operate now without it?
>
> I specifically remember reading that winbind wasn't necessary and, in fact,
> wasn't recommended with Samba 4 AD.

That was the case with Samba 4.1, which it looks like you just upgraded
from. Samba 4.1 had it's own internal winbind service. I believe 4.2 is
when the standalone winbindd introduced support for DCs.

[Daniel Carrasco Marín]

Samba4 AD have its own winbind daemon called winbindd:

# ps aux|grep -i winbind
root 1820 0.0 4.9 432100 50616 ? Ss 21:24 0:00
/usr/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 1917 0.0 4.0 437788 41792 ? S 21:25 0:00
/usr/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 2057 0.0 3.5 432100 35936 ? S 21:33 0:00
/usr/sbin/winbindd -D --option=server role check:inhibit=yes --foreground

Sernet packages will install it automatically:
# dpkg -l| grep -i "winbind"
ii sernet-samba-winbind 99:4.2.11-9
amd64 Samba nameservice integration server

Greetings!!

[Rowland penny]

On 19/04/16 21:39, Thomas Smith wrote:
> Ok, thank you--that worked, but it doesn't make sense.
>
> The server's been operational for months without winbind. Did
> something change in Samba that it won't operate now without it?
>
> I specifically remember reading that winbind wasn't necessary and, in
> fact, wasn't recommended with Samba 4 AD.
>

OK, Samba when running as an AD DC originally used 'winbind', this was a
part of the 'samba' binary and you could not run the 'winbindd' binary.
From version 4.2.0, 'winbind' was replaced by the separate 'winbindd'
binary (as used on a domain member), so you had to either explicitly
make the Samba binary run 'winbind' or install winbindd and allow the
Samba binary to start it.

[Thomas Smith]

Ok, thanks--I appreciate the explanation.

So is there a better option? Using the integrated winbind or installing the
separate package?

To get this working today, I just installed Ubuntu's "winbind" package.

[Rowland penny]

On 19/04/16 23:04, Thomas Smith wrote:
> Ok, thanks--I appreciate the explanation.
>
> So is there a better option? Using the integrated winbind or installing the
> separate package?

I wouldn't use the integrated winbind, it could be removed sometime in
the future.

> To get this working today, I just installed Ubuntu's "winbind" package.
>
>
>

That is all you need to do, you do not have to actively use it, it just
needs to be running.