#1012240 winbind does not return AD groups a user is a member of AT ALL, or only one

Package:
winbind
Source:
samba
Description:
service to resolve user and group information from Windows NT servers
Submitter:
Matthew Grant
Date:
2022-06-13 16:39:05 UTC
Severity:
important
#1012240#5
Date:
2022-06-02 04:48:33 UTC
From:
To:
Dear Maintainer,

I have rebuilt samba 4.16.1 packages as I am including a samba INTERNAL DNS
patch, bt I have not altered the packaging significantly other than this, and
have not touched winbind

I have been finding that when I login to the machine using a user from samba AD,with groups from samba AD, none of those AD groups that user is a member of
show up in the output from the 'groups' command.

Further more:

shalom: -root- [/home/admin]
# wbinfo -r grantma
failed to call wbcGetGroups: WBC_ERR_DOMAIN_NOT_FOUND
Could not get groups for user grantma

And in the samba logs:

[2022/06/02 16:30:45.687576,  0] ../../source3/winbindd/winbindd_samr.c:71(open_internal_samr_conn)
  open_internal_samr_conn: Could not connect to samr pipe: NT_STATUS_ACCESS_DENIED

The above works fine when the samba package is installed along with winbind.

After the call find that the following programs are running:

shalom: -root- [/home/admin]
# ps -ef | grep samba
root      139564       1  0 16:29 ?        00:00:00 /usr/libexec/samba/samba-dcerpcd --libexec-rpcds --ready-signal-fd=40 --np-helper --debuglevel=0
root      139574  139564  0 16:29 ?        00:00:00 /usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=4 --worker-index=5 --debuglevel=0
root      139576  139564  0 16:29 ?        00:00:00 /usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=4 --worker-index=6 --debuglevel=0
root      139578  139564  0 16:29 ?        00:00:00 /usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=4 --worker-index=7 --debuglevel=0
root      139580  139564  0 16:29 ?        00:00:00 /usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=4 --worker-index=8 --debuglevel=0
root      139583  136857  0 16:29 pts/5    00:00:00 grep samba

When the above binaries permisions are set by:

shalom: -root- [/home/admin]
# chmod 400 /usr/libexec/samba/samba-dcerpcd /usr/libexec/samba/rpcd_lsad

the following happens:

shalom: -root- [/home/admin]
# chmod 400 /usr/libexec/samba/samba-dcerpcd /usr/libexec/samba/rpcd_lsad

It appears that wind bind needs samba-dcerpcd and rpcd_lsad to function
correctly.  Could these binaries and dependent libraries be moved to the
winbind package please?

Thank you!

Matt Grant

#1012240#10
Date:
2022-06-02 07:38:30 UTC
From:
To:
Just make sure we don't get the opposite problem if smbd is installed
without winbindd.

(I've not checked the deps, but upstream you can still run smbd that
without winbindd for a standalone fileserver)

#1012240#15
Date:
2022-06-02 15:37:08 UTC
From:
To:
02.06.2022 10:38, Andrew Bartlett wrote:

Where does one can find some information about these new binaries,
how they're being used and by what?

For quite some time I had a standalone machine with smbd & nmbd running
(this is my primary work machine where I build samba and usually experiment
with the newly built binaries).  Usually, systemctl restart smbd nmbd has
been enough. But a few times already I've seen other binaries, something
from /usr/libexec/samba/ - like mentioned in this bugreport before.  I don't
know who started these and why, and why they're left running.

Thanks,

/mjt

#1012240#20
Date:
2022-06-02 16:06:30 UTC
From:
To:
Ask us really, particularly if there isn't a manpage.  This new DCE/RPC
server approach was mentioned in the WHATSNEW, but perhaps not to the
detail you need.

Andrew,

#1012240#25
Date:
2022-06-02 16:41:48 UTC
From:
To:
02.06.2022 19:06, Andrew Bartlett wrote:
..

Andrew, what's this new dce/rpc server processes, where/when they're being
used?  In particular, in context of this bug report, should we split out
some of the new servers into samba-common-bin package for example, so
that winbindd can run them too? (Probably not a good idea for smbclient
which depends on samba-common-bin too).  Also, should these processes
be now killed/restarted together with smbd/nmbd/winbindd?

See the first changelog entry for debian samba 4.16.0 package :)

Thank you!

/mjt

#1012240#30
Date:
2022-06-03 01:00:33 UTC
From:
To:
Hi!

May be best to move the contents of /usr/libexec/samba to samba-libs.

shalom: -admin- [/usr/libexec/samba]
$ dpkg -S `ldd samba-dcerpcd | grep samba |cut -f 1 -d ' '`  |cut -f 1 -d
':' | sort |uniq
libwbclient0
samba-libs

If you remove the uniq:

shalom: -admin- [/usr/libexec/samba]
$ dpkg -S `ldd samba-dcerpcd | grep samba |cut -f 1 -d ' '`  |cut -f 1 -d
':' | sort | grep samba-libs | wc -l
64

shalom: -admin- [/usr/libexec/samba]
$ dpkg -S `ldd samba-dcerpcd | grep samba |cut -f 1 -d ' '`  |cut -f 1 -d
':' | sort | grep libwbclient0 | wc -l
9

Probably the same for the rest of /usr/libexec/samba

Hope this helps.

Matt Grant
Debian Developer

PS: Have a good set up here at home for testing and development.  2 smbd
servers, witn 2 samba AD server kvm virtuals, and client kerberos
workstations, all mostly configured using ansible.  Also extensively uses
ZFS.  Mostly use all of this at my employer.

#1012240#35
Date:
2022-06-03 01:08:11 UTC
From:
To:
Or maybe even a new package to untangle dependencies on libwbclient0, named
'samba-libexec', moving the contents of /usr/libexec/samba to samba-libexec?

Otherwise, libwbclient0 ends up being installed when samba-lbs is installed
due to depending on samba-libs?

Or far simpler, combine libwbclient0 into samba-libs, and add contents of
/usr/libexec/samba.

Michael, you will have to see what works.

Regards,

Matt Grant

Debian Developer

#1012240#40
Date:
2022-06-03 02:31:49 UTC
From:
To:
libwbclient0 should not depend on anything else in Samba (due to
licence requirements) so if there is a linking reason for this we
should check into this.

There have been regressions in the past, so if only expressed in
packaging this might be historical.

#1012240#45
Date:
2022-06-03 08:10:19 UTC
From:
To:
03.06.2022 05:31, Andrew Bartlett wrote:

I read this like samba-libs uses libwbclient, not like libwbclient
uses samba-libs (would be wrong).

I did move one more library from samba-libs to libwbclient while
packaging 4.16 on debian.

Overall, this is the current content of libwbclient0.deb:

/usr/lib/x86_64-linux-gnu/libwbclient.so.0.15

/usr/lib/x86_64-linux-gnu/libsamba-util.so.0.0.1
/usr/lib/x86_64-linux-gnu/samba/libgenrand-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libiov-buf-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libreplace-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libsamba-debug-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libsocket-blocking-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libsys-rw-samba4.so.0
/usr/lib/x86_64-linux-gnu/samba/libtime-basic-samba4.so.0

Some of these has been there before. Some (I think it was
just one, can't remember which) were added by me during
4.16 packaging time. One of my todo items about samba states
to review which libs are actually used by which binary and
move them between packages - somewhat similar to how I moved
files between samba-libs and python3-samba packages.  When I
did 4.16 initially I didn't think much about that aspect, b/c
else we'd not have 4.16 now :)

Now when I looked at this, I don't see why libsamba-util.so is
in there at all.  Maybe in 4.13 there was a reason for that,
I don't know the reason for it to be there for 4.16.  The
rest (in /samba/) are ones used by libsamba-utils, it seems.

/mjt

#1012240#50
Date:
2022-06-03 08:12:20 UTC
From:
To:
03.06.2022 04:00, Matt Grant wrote:

No, definitely not. A library is a library, it is multiarch and different
arch must be co-installable.

It might be more appropriate to move these executables to samba-common-bin
as I already mentioned.

But before that I need to understand how/when they're used.  Maybe some day
I will find a time to dig into the code to understand this...

/mjt

#1012240#55
Date:
2022-06-13 07:46:59 UTC
From:
To:
Hi!

Please find attached the patch I made to fix this issue.

It moves the DCE RPC binaries in /usr/libexec/samba into their own package
along with required libs from the samba package creating the
samba-libexec-dcerpc package, and makes samba and winbind depend on it,
thus solving all the issues.

Michael, could you please incorporate this in the sid samba packages you
have created?

Kind Regards,

Matt Grant

#1012240#60
Date:
2022-06-13 07:49:58 UTC
From:
To:
FYI, Tested patch after merging Samba 2:4.16.1+dfsg-8 source build with my
work, so should apply directly to your current source Michael.

#1012240#65
Date:
2022-06-13 07:55:27 UTC
From:
To:
13.06.2022 10:46, Matt Grant wrote:

Thank you for the work Matt!

For the start I really want some comments from the samba folks about where/when these
binaries are supposed to be used.  I understand creating a new package might solve
the immediate issue, based on what we observe now. But without knowledge about how
it is supposed to work, it's difficult to verify if it's done correctly.

And once again, I already suggested moving these binaries to the already existing
samba-common-bin - this will definitely fix the issue too, without we waiting for
the debian NEW queue processing (there's a separate manual procedure in debian each
new binary package have to follow). I'm not convinced a separate binary package is
needed (based on what I observe), - yes, smbclient also uses samba-common-bin, but
so far it's not a problem, it seems.  I might be wrong though.

Thank you!

/mjt

#1012240#70
Date:
2022-06-13 08:18:37 UTC
From:
To:
13.06.2022 10:46, Matt Grant wrote:

Matt, how did you find out the 2 libs -- libRPC-SERVER-LOOP-samba4.so.0 &
libREG-FULL-samba4.so.0 - which can be moved to the new package too, out
of many other libraries in there?

Thanks!

/mjt

#1012240#75
Date:
2022-06-13 09:12:49 UTC
From:
To:
Hi Michael!

For the libraries to move from the samba package, just used the following
command on each rpcd binary in /usr/libexec/samba:

dpkg -S `ldd rpcd_epmapper | grep samba | cut -f 1 -d ' '`

You could put the contents of this new package ( ie
debian/samba-libexec-dcerpc.install) into the  samba-libs package, or
samba-common-bin...  Samba-libs was my first thought if not creating a new
package.

Adding the new samba-libexec-dcerpc package to the archive in my experience
is not much of a problem actually. When I have had to create a fresh
package as part of an already in archive source (no licensing evaluation
needed), the FTP Master team only took a few days to add the new package.
You can email ftpmaster@debian.org ahead of the upload to check how long it
will take them to get on to it, or you can put it through experimental?
Sid is 'unstable' for a reason.

Here is a good reason for the new package:  samba-dcerpcd and rpcd_* are
needed for support binaries for in-kernel ksmbd, though what that will need
exactly will require more fleshing out no doubt.  The new package is a
start. Check the samba-dcerpcd man page, it helped me work out what to put
in the new package, as samba-dcerpcd can call any of the
/usr/libexec/samba/rpcd_* binaries

Hope that all helps.

Matt Grant
Debian Developer



Best Regards,

Matt Grant
Debian Developer

#1012240#80
Date:
2022-06-13 09:14:08 UTC
From:
To:
PS: Also have tested new package and winbind now does work by itself for
getgroups(3) and initgroups(3), ie kerberos logins over ssh work again!

#1012240#85
Date:
2022-06-13 09:24:49 UTC
From:
To:
After thinking about it, Puting everything which s
in debian/samba-libexec-dcerpc.install into samba-common-bin would work.

Regards,

Matt Grant
Debian Developer

#1012240#90
Date:
2022-06-13 14:03:14 UTC
From:
To:
13.06.2022 12:12, Matt Grant wrote:

I suspected it was something like that.

The problem here is that the two libs you moved from
samba to the new dcerpc package, are also used by the
samba package itself.  By moving stuff like this, it
is too easy to create a circular dependency, which we
had quite a few in the past.  I placed libs into the
samba package (and to winbind package and some other
cases) *only* when those libs are used by those packages
and not by other packages. The rest of libraries -
the ones which are used by more than a single package -
goes to samba-libs.  Again, maybe I'm wrong there.

Just thought that these libs which are used by a single
package *now*, may be used by more than a single package
in the future, and I should have a way to check for that,
maybe similar to how I check for unneeded inter-package
deps in d/rules already, but for more packages.

BTW, you forgot the manpage for samba-dcerpcd.

For now I moved the executables into samba-common-bin
and the two libs into samba-libs. Let's see how it will
be, maybe we'll create a new package for it.

Thank you for the work and for the inspiration!

/mjt

#1012240#95
Date:
2022-06-13 15:36:27 UTC
From:
To:
Hi Michael!

OK, see what you are thinking.

Was planning to do just what you did.  Bins into samba-common-bin, libs
into samba-libs.

My bad about samba-dcerpcd.8 man page.

Maybe ksmbd support should be started with all needed bins in
samba-common-bin, and systemctl disabled ksmbd/samba-dcercpd service
file(s) in samba package or elsewhere.  Some smb.conf settings are
specially needed for ksmbd apparently (samba-dcerpcd.8 manpage)

Regards,

Matt Grant

#1012240#100
Date:
2022-06-13 16:36:53 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
samba, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1012240@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated samba package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 13 Jun 2022 19:08:44 +0300
Source: samba
Architecture: source
Version: 2:4.16.2+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Samba Maintainers <pkg-samba-maint@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 1012240
Changes:
 samba (2:4.16.2+dfsg-1) unstable; urgency=medium
 .
   * new upstream minor/bugfix release.
   * removed waf-add-support-for-GNU-kFreeBSD.patch (applied upstream)
   * new minor version of libldb
     (no code changes, just the build system update to support python 3.11)
   * move samba-dcerpcd from samba package to samba-common-bin due to winbind
     New in 4.16 samba-dcerpcd binary is used by smbd and winbind, so putting
     it to samba package makes winbind unable to run it without samba.
     For now, in order to fix this issue, move this binary from samba to
     samba-common-bin package. It might be worth creating its own package
     for this binary (or maybe some more binaries), once it is clear where
     upstream is going to.  Making this binary a part of samba-common-bin
     adds some more files to smbclient-only setup.
     (Closes: #1012240)
   * remove mksmbpasswd script and manpage: we have smbpasswd whcih can add
     entries to smbpasswd file if needed, and can handle other passwod storage
     formats too
Checksums-Sha1:
 4e3056181930c26bb4a26b9f6aeef9c5d8ea3402 4225 samba_4.16.2+dfsg-1.dsc
 dd63e81d77b138c2c422f7e6bc9c2a7ad3070823 18127992 samba_4.16.2+dfsg.orig.tar.xz
 927212574475e4e3981c0634bb26fcf0c5a4ba6c 263624 samba_4.16.2+dfsg-1.debian.tar.xz
 0edc98b74029f9ff5ad961ab4ae9e686ca843020 6046 samba_4.16.2+dfsg-1_source.buildinfo
Checksums-Sha256:
 d4932d187db8dfc94ea62b80d6e23f936971157f5d2c20b643badd9e26696dbb 4225 samba_4.16.2+dfsg-1.dsc
 102928de50a85107f174e18b3f6fffad96cbeb1b94896a66d9343fc8bf443861 18127992 samba_4.16.2+dfsg.orig.tar.xz
 6356cf93d5fddd68995b1a8bdd83d4b76d76a02bc93e07161cb85659265ff12a 263624 samba_4.16.2+dfsg-1.debian.tar.xz
 a4d5743a81ad4d7b59ddb712e631526ae3f25b46a10dff4df7e5bdd8e7d0abff 6046 samba_4.16.2+dfsg-1_source.buildinfo
Files:
 339b6899eb8df3a6b2041354f90ea908 4225 net optional samba_4.16.2+dfsg-1.dsc
 1ea495e129711482d20ec9829b494744 18127992 net optional samba_4.16.2+dfsg.orig.tar.xz
 9d13e31edbc06523cb415d5b87771936 263624 net optional samba_4.16.2+dfsg-1.debian.tar.xz
 5655286a09b12d4e2bdb08b04b6469f3 6046 net optional samba_4.16.2+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFDBAEBCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmKnYVYPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5ZmhkH/R2KeMYns8VqfMd/HHmxld4p4yv14tzKvuZ4
gsTfG5V724Vwcg74OfSAubWeYVUL7x5QmtuXFV9B7HO+xa8Q9iBNWHDFTZ7hpdRY
QVGyfAKUwPrgnODq5WieWxUTfk7w24ww+EbC7hSM8C/FIjEVqBzkg1wxfb5Ydnup
ir8kfAJx38HthlhNOkj6a6fLNd7OD4Ho0y4QKUkSq1uwrQxSifoDQRHos92Qcy0C
IRrtGQxemiyYHeez8gYBPE9fiISuZj+9ksf/bA4siTrG6+LKk+/pFwyoVwwtAo13
xCh5AKIzQ7FeBc9C0PkZ5Y/GWAS7f+/MhfGfgyWZ/lgQXZOIuGM=
=avq7
-----END PGP SIGNATURE-----