home :: technology :: linux :: SambaSchannelFix.txt

Aug 01, 2005

Samba Not Authenticating to Windows Domain?

I've been bashing my head against the keyboard for a few days at work wondering why our intranet, which is running samba to serve files and to check usernames/passwords against the Active Directory server, suddenly stopped working. I'd figured this out a few weeks back, so having it just break suddenly and not cooperate when I did the "fix" again and again was trying to say the least.

Today, I finally stumbled upon the actual culprit. There is some incompatibility between Windows 2000 SP4 SR1 and the newer builds of Samba.

If you've found this article, chances are you were running wbinfo -u and got the error "Error looking up users". If you turn the debugging level on winbind up, which I did, perhaps a bit clumsily, by editing /etc/init.d/winbind, and changing

daemon winbindd "$WINBINDOPITONS"
to
daemon winbindd "-d 100"
you'll find the error NT_INSUFFICIENT_RESOURCES

Although I'm not exactly certain of the cause of this, it seems that the samba daemon is somehow confusing the SP4 SR1 windows box, which summarily closes its doors for a bit.

Luckily there's an easy fix. Simply set

client schannel = no
in the global section of smb.conf

Link to the forum where I found this fix. Many thanks to Gerald (Jerry) Carter <jerry <at> samba.org>, for the excellent tip!