[Samba] Interdomain Trust, wbinfo works on both servers,getent doesn't work on one server

Hi

I have a problem with an interdomain trust where on the PDC for DomainA,
everything works perfectly. getent returns local and DomainB usernames.

On the PDC for DomainB, it's DomainB works fine, but getent only returns
local usernames and groups, it doesn't return the usernames or groups for
DomainA. wbinfo -u and wbinfo -g work fine and return all DomainA's
usernames and groups.

This means that I can set permissions for DomainB staff on DomainA, and they
can successfully map shares and access files on DomainA.

I can't set permissions for DomainA staff on DomainB, and DomainA staff
cannot access DomainB using their own username and password :-(

I initially tried with a single WINS server on PDCA, then local WINS servers
with static pointers to the other Domain and PDC. The behaviour was the
same as above for both configurations of WINS.

Given that wbinfo is working, is there a misconfiguration or a corrupted
database somewhere that is stopping getent working?


ServerA (PDC for DomainA)

Ubuntu 6.06 LTS

/etc/samba/smb.conf
#======================= Global Settings =======================
[global]
workgroup = DOMAINA
wins support = yes
netbios name = SERVERA
host msdfs = yes
time server = yes

#### Networking ####
interfaces = 127.0.0.0/8 192.168.2.1
bind interfaces only = true
name resolve order = wins bcast hosts
####### Authentication #######
; security = user
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
########## Domains ###########
domain logons = yes
logon drive = M:
logon path = \\%N\profiles\%U
logon script = %U.cmd
domain master = yes
preferred master = yes

enable privileges = yes

#
# Winbind
#
idmap uid = 10000-20000
idmap gid = 10000-20000
template shell = /bin/bash


ServerB (PDC for DomainB)

Ubuntu 8.04 LTS

#======================= Global Settings =======================
[global]
workgroup = DOMAINB
time server = yes
netbios name = SERVERB
#### Networking ####
interfaces = 127.0.0.0/8 192.168.3.0/24
bind interfaces only = true
wins support = no
wins server = 192.168.2.1
name resolve order = wins bcast hosts

####### Authentication #######
; security = user
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
########## Domains ###########
domain logons = yes
logon drive = M:
logon path = \\%N\profiles\%U
logon script = %U.cmd
domain master = yes
preferred master = yes

enable privileges = yes

host msdfs = yes

# Winbind
#
idmap uid = 30000-40000
idmap gid = 30000-40000
template shell = /bin/bash
winbind enum users = yes
winbind enum groups = yes


ServerB's /var/log/samba/log.winbindd log shows

[2008/07/17 12:12:18, 3] nsswitch/winbindd_misc.c:winbindd_ping(470)
[10049]: ping
[2008/07/17 12:15:44, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(491)
[10059]: request interface version
[2008/07/17 12:15:44, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)
[10059]: request location of privileged pipe
[2008/07/17 12:15:44, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1273)
[10059]: getgroups root
[2008/07/17 12:15:44, 3] nsswitch/winbindd_sid.c:winbindd_gid_to_sid(477)
[ 6180]: gid to sid 0
[2008/07/17 12:15:45, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(491)
[10061]: request interface version
[2008/07/17 12:15:45, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)
[10061]: request location of privileged pipe
[2008/07/17 12:15:45, 3] nsswitch/winbindd_group.c:winbindd_getgroups(1273)
[10061]: getgroups root
[2008/07/17 12:16:09, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(491)
[10075]: request interface version
[2008/07/17 12:16:09, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)
[10075]: request location of privileged pipe
[2008/07/17 12:16:09, 3]
nsswitch/winbindd_user.c:winbindd_setpwent_internal(445)
[10075]: setpwent
[2008/07/17 12:16:09, 3] nsswitch/winbindd_user.c:winbindd_getpwent(636)
[10075]: getpwent
[2008/07/17 12:16:09, 3] nsswitch/winbindd_rpc.c:query_user_list(46)
rpc: query_user_list
[2008/07/17 12:16:10, 1] nsswitch/winbindd_user.c:winbindd_fill_pwent(85)
error getting user id for sid
S-1-5-21-2824201121-3407686785-855272569-1010
[2008/07/17 12:16:10, 1] nsswitch/winbindd_user.c:winbindd_getpwent(728)
could not lookup domain user user1
[2008/07/17 12:16:10, 1] nsswitch/winbindd_user.c:winbindd_fill_pwent(85)
error getting user id for sid S-1-5-21-2824201121-3407686785-855272569-501
[2008/07/17 12:16:10, 1] nsswitch/winbindd_user.c:winbindd_getpwent(728)
could not lookup domain user user2
etc etc through all the users

There are quite a few of these as I suppose individual DomainA users try to
access ServerB:

[20557]: getpwnam user3
[2008/07/16 11:54:09, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20557]: getpwnam USER3
[2008/07/16 11:54:09, 3] nsswitch/winbindd_misc.c:winbindd_ping(470)
[20557]: ping
[2008/07/16 11:54:10, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(491)
[20558]: request interface version
[2008/07/16 11:54:10, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)
[20558]: request location of privileged pipe
[2008/07/16 11:54:10, 3]
nsswitch/winbindd_pam.c:winbindd_pam_auth_crap(1685)
[20558]: pam auth crap domain: [DOMAINA] user: user3
[2008/07/16 11:54:10, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(491)
[20558]: request interface version
[2008/07/16 11:54:10, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(524)
[20558]: request location of privileged pipe
[2008/07/16 11:54:10, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20558]: getpwnam domaina\user3
[2008/07/16 11:54:10, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20558]: getpwnam DOMAINA\user3
[2008/07/16 11:54:10, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20558]: getpwnam DOMAINA\USER3
[2008/07/16 11:54:10, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20558]: getpwnam user3
[2008/07/16 11:54:10, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(346)
[20558]: getpwnam USER3


I can supply any other logs if required

Thanks for any help or pointers.
Rob
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba