Winbind\Samba

[Walt Dominick_2]

Hi all,

I am trying to get winbind working on HPUX 11.0. We are running Samba 3.0.7 with ADS authentication. Kerberos is configured and I can authenticate to ADS as long as the UNIX user id exists. We would like to avoid creating UNIX id's and use winbind to retrieve the UID/GID information. I can run the wbinfo -u, wbinfo -g, wbinfo -t, wbinfo -m and all looks great.

When connecting from a client that does not exist on the UNIX server I was getting the following message:
[2004/11/04 10:39:48, 1] smbd/sesssetup.c:reply_spnego_kerberos(250)
Username DOMAINNAME+username is invalid on this system

I then created the libnss_winbind.sl using "make nsswitch" while in the Samba source directory. I moved the libnss_winbind.sl file to /lib and created a symbolic link using "ln -s /lib/libnss_winbind.sl /lib/libnss_winbind.1".

I changed my nsswitch.conf file so it contains the entries below:
passwd: compat winbind
group: compat winbind

Then I tried to map a drive from a W2K client and I receive the following error in the client log file:
/usr/lib/dld.sl: Unresolved symbol: _nss_winbind_getpwnam_r (code) from /usr/lib/libnss_winbind.1

I have tried using the gcc 3.3.2 compiler and the HP ANSI C compiler when running the configure and make commands and still have the same result. I have done the make distclean prior to rerunning the configure and make commands.

When running "ldd -r /lib/libnss_winbind.1" I receive the following output:
symbol not found: free (/lib/libnss_winbind.1)
symbol not found: getpid (/lib/libnss_winbind.1)
symbol not found: close (/lib/libnss_winbind.1)
symbol not found: fcntl (/lib/libnss_winbind.1)
symbol not found: lstat (/lib/libnss_winbind.1)
symbol not found: geteuid (/lib/libnss_winbind.1)
symbol not found: strncpy (/lib/libnss_winbind.1)
symbol not found: strlen (/lib/libnss_winbind.1)
symbol not found: strncat (/lib/libnss_winbind.1)
symbol not found: memset (/lib/libnss_winbind.1)
symbol not found: socket (/lib/libnss_winbind.1)
symbol not found: connect (/lib/libnss_winbind.1)
symbol not found: select (/lib/libnss_winbind.1)
symbol not found: getsockopt (/lib/libnss_winbind.1)
symbol not found: rand (/lib/libnss_winbind.1)
symbol not found: sleep (/lib/libnss_winbind.1)
symbol not found: write (/lib/libnss_winbind.1)
symbol not found: read (/lib/libnss_winbind.1)
symbol not found: malloc (/lib/libnss_winbind.1)
symbol not found: getenv (/lib/libnss_winbind.1)
symbol not found: atoi (/lib/libnss_winbind.1)
symbol not found: putenv (/lib/libnss_winbind.1)
symbol not found: __SB_masks (/lib/libnss_winbind.1)
symbol not found: _isdigit (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_setpwent (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_endpwent (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getpwent_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getpwnam_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getpwuid_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_setgrent (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_endgrent (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getgrent_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getgrnam_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_getgrgid_r (/lib/libnss_winbind.1)
symbol not found: _nss_winbind_initgroups_dyn (/lib/libnss_winbind.1)
symbol not found: __sys_atexit (/usr/ccs/lib/lddstub)

Does this work on the HPUX 11.0 platform at all? Is there something I'm missing on the HPUX server that allows this work?

Any help would be greatly appreciated.

If more information is needed, please let me know. I will be happy to pass it along.

Thanks in advance,
Walt

[Zygmunt Krawczyk]

HP offers HP-UX supported version of Samba, called CIFS.

HP CIFS Server 2.2k based on Samba version 2.2.12 for HP-UX 11.0, 11i v1 and 11i v2
http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B8725AA

HP CIFS Server 3 Technology Preview (unsupported)based on Samba version 3.0.5 for HP-UX 11i v1 and 11i v2
http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=CIFSTP3

Consider upgrading HP-UX to version 11i v1 (11.11) and use HP CIFS Server 3

Regards,
Zygmunt

[Steven E. Protter]

I believe HP's CIFS based on Samba 2.2 will work with every aspect of your setup except for ADS.

To work with ADS, the technology preview based on Samba 3.07 is the way to go.

A production version based on Samba 3.0.x was promised at HP World and is a bit past due.

Going with HP ported depots is often a better idea than compiling yourself, as fun as that is.

SEP

[Zygmunt Krawczyk]

Today HP had released HP CIFS Server 3 Technology Preview based on Samba 3.0.7.
It is available free from:
http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=CIFSTP3

Zygmunt

[Geoff Wild]

I just got this working like so:


Windbind - only works in Samba 3 and up.

For HP-UX - currently, must install CIFS Technology Preview.

First, backup old files:

cp -p /etc/opt/samba/smb.conf /etc/opt/samba/smb.conf.bak
cp -p /etc/opt/samba/username.map /etc/opt/samba/username.map.bak

Remove old CIFS:

swlist |grep CIFS
B8725AA A.01.11.03 HP CIFS Server

swremove B8725AA

Interactivley install new Samba (disable KEON just in case as we add LDAP patch):


swinstall -s mydepotserver:/var/software/hp/samba3 @`hostname`

Select all software...then install.


Verify it is installed:

swlist |grep CIFS
CIFSTP3 T.30.PV.02 HP CIFS Server Technology Preview


Add to windbind to /etc/nsswitch.conf:

passwd: files winbind
group: files winbind

Add or change /etc/opt/samba/smb.conf

security = DOMAIN

idmap uid = 10000-20000
idmap gid = 10000-20000
template primary group = users
winbind separator = +

as well as valid users, example:

valid users = $NTDOM+Groupid, bb, oracle, $NTDOM+user1

then, for each share, set the valid users as well, example:

[src]
path = /usr/local/src
valid users = bb, $NTDOM+Groupid, $NTDOM+user1
force user = bb

Note: force user sets the Unix permissions to the uid of that user - so it must be a Unix id.

zero out the username.map file - no longer needed.

May or may not need to re-join the $NTDOM domain:

/opt/samba/bin/net rpc join -U ntadmin

Start Samba and windbind from either SWAT ( http://server:901 ) or command line:

/opt/samba/bin/startsmb
/opt/samba/bin/winbindd


Rgds...Geoff

[Geoff Wild]

Forgot, you need this in the depot:

CIFSTP3 -> T.30.PV.02 HP CIFS Server Technolog

J4269AA -> B.03.30 LDAP-UX Integration

PHSS_29486 -> 1.0 KRB5-Client Version 1.0

Rgds...Geoff

[Walt Dominick_2]

First, I would like to thank everyone who responded to this post. I really do appreciate the help and ideas. I posted this same message to the Samba mailing list three times and received no response. Thank you very much for the replies.

I agree that HP CIFS version 3 is the way to go, but I was told that our HPUX 11i upgrade is still months away and we needed the ADS authentication. Once we are at 11i, I will be going to HP CIFS version 3 (Although, I will miss the fun of compiling Samba. Not!).

I was able to get Samba 3.0.7 to retrieve the UID/GID from our ADS DC's using winbind. I had to use the libnss_winbind.1 file from the samba-3.0.5-11.11.depot from the Samba site.

Thanks again for the help,
Walt

[Walt Dominick_2]

See previous response!