Win2000 kann sich nicht an Samba+Ldap anmelden?

[oafish]

Hallo,
OpenLDAP ist soweit konfiguriert, zumindest funktioniert der Login lokal. Samba sollte soweit auch funktionieren. Sobald ich nach dem Eintritt in die Domäne mich anmelden will funktioniert das nicht. Ldap gibt mir folgende Meldung aus:


conn=40 op=4 SRCH attr=gidNumber
conn=40 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text=
conn=39 op=6 SRCH base="dc=io,dc=de" scope=2 filter="(&(uid=tester1)(objectClass=sambaSamAccoun t))"
conn=39 op=6 SRCH attr=uid uidNumber gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn displayName sambaHomeDrive sambaHomePath sambaLogonScript sambaProfilePath description sambaUserWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount sambaBadPasswordTime sambaPasswordHistory modifyTimestamp sambaLogonHours modifyTimestamp
conn=39 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=40 op=5 UNBIND
conn=40 fd=15 closed
conn=41 fd=15 ACCEPT from IP=192.168.1.3:32969 (IP=0.0.0.0:389)
conn=41 op=0 BIND dn="" method=128
conn=41 op=0 RESULT tag=97 err=0 text=
deferring operation
conn=41 op=1 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=tester1)) "
conn=41 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
conn=41 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=41 op=2 UNBIND
conn=41 fd=15 closed
conn=42 fd=15 ACCEPT from IP=192.168.1.3:32970 (IP=0.0.0.0:389)
conn=42 op=0 BIND dn="" method=128
conn=42 op=0 RESULT tag=97 err=0 text=
deferring operation
conn=42 op=1 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=tester1)) "
conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=42 op=2 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixGroup)(|(memberUid=tes ter1)(uniqueMember=uid=tester1,ou=users,dc=io,dc=d e)))"
conn=42 op=2 SRCH attr=gidNumber
conn=42 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=39 op=7 SRCH base="ou=Groups,dc=ioconn=40 op=4 SRCH attr=gidNumber
conn=40 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text=
conn=39 op=6 SRCH base="dc=io,dc=de" scope=2 filter="(&(uid=tester1)(objectClass=sambaSamAccoun t))"
conn=39 op=6 SRCH attr=uid uidNumber gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn displayName sambaHomeDrive sambaHomePath sambaLogonScript sambaProfilePath description sambaUserWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount sambaBadPasswordTime sambaPasswordHistory modifyTimestamp sambaLogonHours modifyTimestamp
conn=39 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=40 op=5 UNBIND
conn=40 fd=15 closed
conn=41 fd=15 ACCEPT from IP=192.168.1.3:32969 (IP=0.0.0.0:389)
conn=41 op=0 BIND dn="" method=128
conn=41 op=0 RESULT tag=97 err=0 text=
deferring operation
conn=41 op=1 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=tester1)) "
conn=41 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
conn=41 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=41 op=2 UNBIND
conn=41 fd=15 closed
conn=42 fd=15 ACCEPT from IP=192.168.1.3:32970 (IP=0.0.0.0:389)
conn=42 op=0 BIND dn="" method=128
conn=42 op=0 RESULT tag=97 err=0 text=
deferring operation
conn=42 op=1 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=tester1)) "
conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=42 op=2 SRCH base="dc=io,dc=de" scope=2 filter="(&(objectClass=posixGroup)(|(memberUid=tes ter1)(uniqueMember=uid=tester1,ou=users,dc=io,dc=d e)))"
conn=42 op=2 SRCH attr=gidNumber
conn=42 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=39 op=7 SRCH base="ou=Groups,dc=io,dc=de" scope=2 filter="(&(objectClass=sambaGroupMapping)(gidNumbe r=513))"
conn=39 op=7 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass
conn=39 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text=
,dc=de" scope=2 filter="(&(objectClass=sambaGroupMapping)(gidNumbe r=513))"
conn=39 op=7 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass
conn=39 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text=

Das sieht, denke ich mals soweit ganz gut aus. Bin mir aber nicht sicher!
Denke der Fehler müsste irgendwo bei Samba liegen...

Hier meine smb.conf:

[global]
workgroup = NETWORK
netbios name = tslinux
server string = Samba-LDAP PDC-Server
encrypt passwords = yes
passwd program = /usr/sbin/smbldap-passwd -o %u
passwd chat = *new*password* %n\n *new*password* %n\n *successfully*
unix password sync = yes
hostname lookups = yes

log file = /var/log/samba/%m.log
log level = 10
max log size = 50

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 SO_KEEPALIVE IPTOS_LOWDELAY

domain logons = yes
os level = 66
preferred master = yes
domain master = yes

dns proxy = no
wins support = yes
#wins server = yes

ldap suffix = dc=io,dc=de
ldap machine suffix = ou=computers
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
#ldap idmap suffix = ou=Idmap
#idmap uid = 10000-20000
#idmap gid = 10000-20000
ldap admin dn = cn=Manager,dc=io,dc=de
#ldap admin dn = cn=samba,ou=DSA,dc=io,dc=de
ldap ssl = no
ldap delete dn = yes
ldap passwd sync = yes
#ldap server = 192.168.1.6
#ldap port = 389
passdb backend = ldapsam:ldap://192.168.1.6

add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
add user to group script= /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script= /usr/sbin/smbldap-usermod -g "%g" "%u"


Denke das müsste auch alles passen, oder?
Direkte Fehlermeldungen bekomme ich eigentlich nicht. Ich weiß jetzt auch überhautp nicht mehr wo ich noch nachschauen sollte/kann.

Vielleicht kann jemand helfen....

Danke und viele Grüße
oafish

[Simcemilia]

Hallo,

das Log vom LDAP sieht so weit ich das sehen kann ganz gut aus.

Das Log vom Samba wäre jetzt interressant.


MfG
Simcemilia

[oafish]

Hier noch die Logs von Samba, zuerst die des Clientrechners:


[2005/01/07 12:27:38, 3] smbd/process.c:switch_message(886)
switch message SMBtdis (pid 339) conn 0x83a8740
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 3] smbd/service.c:close_cnum(836)
apfelbaum (192.168.1.249) closed connection to service IPC$
[2005/01/07 12:27:38, 3] smbd/connection.c:yield_connection(69)
Yielding connection to IPC$
[2005/01/07 12:27:38, 4] smbd/vfs.c:vfs_ChDir(654)
vfs_ChDir to /
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 5] lib/util.c:show_msg(464)
[2005/01/07 12:27:38, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=11008
smt_wct=0
smb_bcc=0
[2005/01/07 12:27:38, 6] lib/util_sock.c:write_socket(449)
write_socket(22,39)
[2005/01/07 12:27:38, 6] lib/util_sock.c:write_socket(452)
write_socket(22,39) wrote 39


die vom smbd:


[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_context_list(763)
Trying to load: ldapsam:ldap://192.168.1.6
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend ldapsam
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'ldapsam'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend ldapsam_compat
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'ldapsam_compat'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend smbpasswd
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'smbpasswd'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend tdbsam
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'tdbsam'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend guest
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'guest'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(648)
Attempting to find an passdb backend to match ldapsam:ldap://192.168.1.6 (ldapsam)
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(669)
Found pdb backend ldapsam
[2005/01/07 12:26:27, 2] lib/smbldap.c:smbldap_search_domain_info(1373)
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=NETWOR K))]
[2005/01/07 12:26:27, 5] lib/smbldap.c:smbldap_search(1017)
smbldap_search: base => [dc=io,dc=de], filter => [(&(objectClass=sambaDomain)(sambaDomainName=NETWOR K))], scope => [2]
[2005/01/07 12:26:27, 10] lib/smbldap.c:smbldap_open_connection(596)
smbldap_open_connection: ldap://192.168.1.6
[2005/01/07 12:26:27, 2] lib/smbldap.c:smbldap_open_connection(692)
smbldap_open_connection: connection opened
[2005/01/07 12:26:27, 10] lib/smbldap.c:smbldap_connect_system(823)
ldap_connect_system: Binding to ldap server ldap://192.168.1.6 as "cn=samba,ou=DSA,dc=io,dc=de"
[2005/01/07 12:26:27, 3] lib/smbldap.c:smbldap_connect_system(858)
ldap_connect_system: succesful connection to the LDAP server
[2005/01/07 12:26:27, 4] lib/smbldap.c:smbldap_open(909)
The LDAP server is succesfully connected
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(672)
pdb backend ldapsam:ldap://192.168.1.6 has a valid init
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(648)
Attempting to find an passdb backend to match guest (guest)
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(669)
Found pdb backend guest
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(672)
pdb backend guest has a valid init


die vom nmbd:
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:dump_workgroups(284)
dump_workgroups()
dump workgroup on subnet UNICAST_SUBNET: netmask= 192.168.1.3:
NETWORK(1) current master browser = UNKNOWN
TSLINUX 40099b0b (Samba-LDAP PDC-Server)
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:find_workgroup_on_subnet(173)
find_workgroup_on_subnet: workgroup search for NETWORK on subnet UNICAST_SUBNET: found.
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:find_workgroup_on_subnet(173)
find_workgroup_on_subnet: workgroup search for NETWORK on subnet UNICAST_SUBNET: found.


Soweit ich das beurteilen kann sieht es eigentlich auch ganz gut aus.

oafish

[oafish]

Hier noch die Logs von Samba, zuerst die des Clientrechners:


[2005/01/07 12:27:38, 3] smbd/process.c:switch_message(886)
switch message SMBtdis (pid 339) conn 0x83a8740
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 3] smbd/service.c:close_cnum(836)
apfelbaum (192.168.1.249) closed connection to service IPC$
[2005/01/07 12:27:38, 3] smbd/connection.c:yield_connection(69)
Yielding connection to IPC$
[2005/01/07 12:27:38, 4] smbd/vfs.c:vfs_ChDir(654)
vfs_ChDir to /
[2005/01/07 12:27:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_nt_user_token(486)
NT user token: (NULL)
[2005/01/07 12:27:38, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2005/01/07 12:27:38, 5] smbd/uid.c:change_to_root_user(296)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2005/01/07 12:27:38, 5] lib/util.c:show_msg(464)
[2005/01/07 12:27:38, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x71
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=11008
smt_wct=0
smb_bcc=0
[2005/01/07 12:27:38, 6] lib/util_sock.c:write_socket(449)
write_socket(22,39)
[2005/01/07 12:27:38, 6] lib/util_sock.c:write_socket(452)
write_socket(22,39) wrote 39


die vom smbd:


[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_context_list(763)
Trying to load: ldapsam:ldap://192.168.1.6
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend ldapsam
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'ldapsam'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend ldapsam_compat
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'ldapsam_compat'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend smbpasswd
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'smbpasswd'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend tdbsam
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'tdbsam'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(93)
Attempting to register passdb backend guest
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:smb_register_passdb(106)
Successfully added passdb backend 'guest'
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(648)
Attempting to find an passdb backend to match ldapsam:ldap://192.168.1.6 (ldapsam)
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(669)
Found pdb backend ldapsam
[2005/01/07 12:26:27, 2] lib/smbldap.c:smbldap_search_domain_info(1373)
Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=NETWOR K))]
[2005/01/07 12:26:27, 5] lib/smbldap.c:smbldap_search(1017)
smbldap_search: base => [dc=io,dc=de], filter => [(&(objectClass=sambaDomain)(sambaDomainName=NETWOR K))], scope => [2]
[2005/01/07 12:26:27, 10] lib/smbldap.c:smbldap_open_connection(596)
smbldap_open_connection: ldap://192.168.1.6
[2005/01/07 12:26:27, 2] lib/smbldap.c:smbldap_open_connection(692)
smbldap_open_connection: connection opened
[2005/01/07 12:26:27, 10] lib/smbldap.c:smbldap_connect_system(823)
ldap_connect_system: Binding to ldap server ldap://192.168.1.6 as "cn=samba,ou=DSA,dc=io,dc=de"
[2005/01/07 12:26:27, 3] lib/smbldap.c:smbldap_connect_system(858)
ldap_connect_system: succesful connection to the LDAP server
[2005/01/07 12:26:27, 4] lib/smbldap.c:smbldap_open(909)
The LDAP server is succesfully connected
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(672)
pdb backend ldapsam:ldap://192.168.1.6 has a valid init
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(648)
Attempting to find an passdb backend to match guest (guest)
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(669)
Found pdb backend guest
[2005/01/07 12:26:27, 5] passdb/pdb_interface.c:make_pdb_methods_name(672)
pdb backend guest has a valid init


die vom nmbd:
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:dump_workgroups(284)
dump_workgroups()
dump workgroup on subnet UNICAST_SUBNET: netmask= 192.168.1.3:
NETWORK(1) current master browser = UNKNOWN
TSLINUX 40099b0b (Samba-LDAP PDC-Server)
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:find_workgroup_on_subnet(173)
find_workgroup_on_subnet: workgroup search for NETWORK on subnet UNICAST_SUBNET: found.
[2005/01/07 12:39:32, 4] nmbd/nmbd_workgroupdb.c:find_workgroup_on_subnet(173)
find_workgroup_on_subnet: workgroup search for NETWORK on subnet UNICAST_SUBNET: found.


Soweit ich das beurteilen kann sieht es eigentlich auch ganz gut aus.

oafish

[oafish]

Muss man eigentlich irgendwas besonderes an den Windows-Maschinen einstellen? Langsam glaube ich, es liegt nicht an Samba/Ldap sondern an Windows. Habe zwar das RequireSignOrSeal auf 0 gesetzt aber das hat nichts gebracht!

oafish