[CentOS] CentOS 5.3 samba: getent does not return data from the active directory (ads)

Rob Townley rob.townley at gmail.com
Wed Apr 8 16:35:14 UTC 2009


Have you browsed the LDAP entries in ActiveDirectory to see if they
match similar entries for working windows hosts.  Under the computer
entry, look carefully at dnsHostname and servicePrincipalName.  For a
server, there are many many entries for these two variables.  CIFS/x2,
HOSTx2, LDAPS?/, ..... and so on.

On 4/7/09, Jason Ellison <infotek at gmail.com> wrote:
> CentOS 5.3 getent does not return data from the active directory (ads)
>
>   I have installed and configured kerberos and samba so that the
> server can be a member of an existing Active Directory (AD).  Correct
> configuration of kerbos was verified using kinit and klist.  The samba
> configuration was verified by using "smbclient -k -L server".  winbind
> was verified by using "wbinfo -g".  The problem seems to be nsswitch
> accessing winbindd to get group information via the "getent group"
> command.  I added winbind to the /etc/nsswitch.conf file like so:
>
> [root at nagios ~]# grep winbind /etc/nsswitch.conf
> passwd:     files winbind
> shadow:     files winbind
> group:      files winbind
>
>    I verified that all dynamic libraries are being accessed correctly
> by using "strace getent group".
>
>   Below is the debug output of winbindd when issuing various commands
> that interact with it.  The commands are noted in (parenthesis).
>
> (winbindd -i -d 9)
>
>     00a0 status: NT_STATUS_OK
>
> ("getent group" command issued)
>
> accepted socket 17
> [17171]: request interface version
> [17171]: request location of privileged pipe
> accepted socket 18
> [17171]: setgrent
> [17171]: endgrent
>
> ("getent passwd" command issued)
>
> accepted socket 17
> [17172]: request interface version
> [17172]: request location of privileged pipe
> accepted socket 18
> [17172]: setpwent
> [17172]: endpwent
>
> (winbindd -i -d 9)
>
>     00a0 status: NT_STATUS_OK
>
> ("wbinfo -g" command issued)
>
> accepted socket 17
> [17158]: request interface version
> [17158]: request location of privileged pipe
> accepted socket 18
> [17158]: list groups
> get_sam_group_entries: BUILTIN or local domain; enumerating local groups as
> well
> Attempting to register passdb backend ldapsam
> Successfully added passdb backend 'ldapsam'
> Attempting to register passdb backend ldapsam_compat
> Successfully added passdb backend 'ldapsam_compat'
> Attempting to register passdb backend NDS_ldapsam
> Successfully added passdb backend 'NDS_ldapsam'
> Attempting to register passdb backend NDS_ldapsam_compat
> Successfully added passdb backend 'NDS_ldapsam_compat'
> Attempting to register passdb backend smbpasswd
> Successfully added passdb backend 'smbpasswd'
> Attempting to register passdb backend tdbsam
> Successfully added passdb backend 'tdbsam'
> Attempting to find an passdb backend to match tdbsam (tdbsam)
> Found pdb backend tdbsam
> pdb backend tdbsam has a valid init
> get_sam_group_entries: Returned 2 local groups
> get_sam_group_entries: BUILTIN or local domain; enumerating local groups as
> well
> get_sam_group_entries: Returned 0 local groups
> get_cache: Setting ADS methods for domain COMPANY
> ads: enum_dom_groups
>
>
> NOTES:
>
> [root at nagios ~]# uname -a
> Linux nagios.hq.company.local 2.6.18-128.1.6.el5xen #1 SMP Wed Apr 1
> 09:53:14 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
>
> [root at nagios ~]# rpm -qa samba krb* nss*
> nss_db-2.2-35.3
> nss_db-2.2-35.3
> krb5-libs-1.6.1-31.el5
> nss-tools-3.12.2.0-4.el5.centos
> nss_ldap-253-17.el5
> krb5-libs-1.6.1-31.el5
> samba-3.0.33-3.7.el5
> krb5-auth-dialog-0.7-1
> nss-3.12.2.0-4.el5.centos
> nss-3.12.2.0-4.el5.centos
> nss_ldap-253-17.el5
> krb5-workstation-1.6.1-31.el5
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>


More information about the CentOS mailing list