Josh Kelley's questions

On one of our Ubuntu 14.04 servers, running Winbind 4.1.6+dfsg-1ubuntu2.14.04.9, Winbind periodically forgets who I am, resulting in strange errors like ssh aborting with an "unknown uid" error whenever I try to run it.

Whenever the system is in this state, getent passwd works just fine; it correctly lists every user in the domain, and it fixes Winbind's forgetfulness so that user resolution works again.

The problem is very sporadic (maybe once a week?) and only seems to affect one of our Linux servers.

Winbind's log files aren't much help (using a log level of 2). The problem most recently occurred this morning, but the last log message is from a couple of days ago:

[2015/12/14 07:14:04.576645, 0] ../source3/rpc_client/cli_netlogon.c:462(rpccli_netlogon_sam_network_logon) rpccli_netlogon_sam_network_logon: credentials chain check failed

Since upgrading our old Debian Lenny server to Ubuntu 12.04, we've noticed intermittent slow or failed access to Apache. Many or most web requests work fine, but occasionally, a Subversion client will effectively lock up while waiting on a reply, Firefox will load for a long time then re-request a password, etc.

This is very noticeable when using Subversion clients, presumably because of all of the WebDAV requests that a Subversion client issues, but it occasionally happens with access to other pages hosted by the web server.

It's a standard Apache + mod_auth_pam setup:

<Location /software>
  AuthType Basic
  AuthName "Subversion"
  AuthBasicAuthoritative off
  AuthPam_Enabled on
  require group engineering
</Location>

It's a standard PAM and Winbind setup. I've added www-data to the winbindd_priv group since (as far as I can tell) this helps Apache do Winbind authentication.

We haven't seen any other Winbind problems; for example, SSH logins work just fine (although, since we often use public key authentication, maybe we just haven't run into the problem).

Turning up the log levels in Winbind and Apache reveals some occasional trouble communicating, but no explanation as to why:

/var/log/samba/log.winbindd:

[2014/04/02 11:41:36.837645,  3] winbindd/winbindd_misc.c:384(winbindd_interface_version)
  [32654]: request interface version
[2014/04/02 11:41:36.837720,  2] winbindd/winbindd.c:732(winbind_client_response_written)
  Could not write response[32654:INTERFACE_VERSION] to client: Broken pipe
[2014/04/02 11:41:36.837789,  3] winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send)
  getpwnam jkelley
[2014/04/02 11:41:36.837984,  3] winbindd/winbindd_misc.c:384(winbindd_interface_version)
  [32655]: request interface version
[2014/04/02 11:41:36.838057,  2] winbindd/winbindd.c:732(winbind_client_response_written)
  Could not write response[32655:INTERFACE_VERSION] to client: Broken pipe

/var/log/apache2/error.log:

[Wed Apr 02 11:41:38 2014] [error] [client 10.75.20.168] PAM: user 'jkelley' - not authenticated: Authentication failure
[Wed Apr 02 11:41:38 2014] [error] [client 10.75.20.168] PAM: user 'jkelley' - not authenticated: Authentication failure

Any ideas as to what's wrong? Any suggestions for where to troubleshoot next?

I'm trying to troubleshoot an obscure authentication error and need some background information.

• Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and [email protected]?

• What are the proper terms for these two username formats?

• Edit: In particular, are there any differences in how Windows authenticates the two username formats?

How can I set up my Linux box so that, if the Active Directory domain controller is down, I can still log in as root, without any timeouts or delays?

Following the example of most of the documentation out there, I've listed pam_winbind.so before pam_unix.so in my /etc/pam.d configurations. I believe that this is the cause of the problem. I remember seeing alternate /etc/pam.d setups that change the order and maybe add either pam_localuser or pam_succeed_if (to see if the uid is less than 500), but I can't find any specifics now (and I'm not enough of an expert in PAM to quickly and easily come up with a robust configuration on my own).

What is the recommended setup for PAM with Winbind to avoid timeouts and delays if Active Directory is unavailable?