<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Tahoma">
<DIV> </DIV>
<DIV> </DIV>
<DIV>Guy Lessard<BR>Professeur CÉGEP de l'Outaouais<BR>Québec, Canada>>> Matt Oquist <moquist@majen.net> 2006-09-26 16:55:35 >>><BR></DIV>
<DIV style="COLOR: #000000">> Date: Tue, 26 Sep 2006 12:31:13 +0000<BR>> From: sonjag@comcast.net<BR>> Subject: [K12OSN] Bad magic on Winbind authentication<BR>> <BR>> I am running Ubuntu with LTSP authenticating to ADS on a Windows 2003 server SP1. My windows side of the network is running fine. The Linux terminals are not able to login all users... weirdly, some can, some can't. In my log.winbindd-idmap file, I get a slew of entries similar to this:<BR>> <BR>> [2006/09/25 22:54:21, 0] tdb/tdbutil.c:tdb_log(772)<BR>> tdb(/var/lib/samba/winbindd_idmap.tdb): rec_free_read bad magic 0x42424242 at offset=17476<BR>> <BR>> I have tried to add a user to the Linux machine and the new Linux users can't login either. I'm not sure if they should-- maybe Linux can only see its admin and ADS users. <BR>> <BR>> wbinfo -u gives me a list of all of my users, including those who can and can't login.<BR>> <BR>> Solutions I've seen around are deleting files in /var/lib/samba and restarting Winbind. Tried that, still not working. Any suggestions?<BR><BR>Winbind is built on reverse-engineering magic, so it's not surprising<BR>to me that some of the magic is bad sometimes... nothing obvious is<BR>coming to mind ATM.<BR><BR>Have you seen this?<BR><A href="http://lists.samba.org/archive/samba/2005-October/113181.html">http://lists.samba.org/archive/samba/2005-October/113181.html</A><BR>Unfortunately, it's one of those cases where I'm finding several<BR>people who say "I have this problem!" and nobody who's saying "Here's<BR>how to fix it..."<BR><BR>On a very related note, has anybody tried using Microsoft's Windows<BR>Services for UNIX? As I understand it, MS has provided a solution for<BR>this entire problem, and we seem to be studiously avoiding it in favor<BR>of winbind, which seems to be a half-solution (when it works well).<BR><BR>I look at winbind like dual-booting -- it's much harder than just<BR>switching to Linux authentication entirely, and yet newbies<BR>(individuals or districts) feel compelled to use it because they<BR>aren't ready to switch completely to Linux. Then it breaks or just<BR>plain doesn't work, and it leaves a bad taste if you've been the one<BR>gnashing your teeth on it.<BR><BR>If you're a seasoned Linux pro then it's no problem to fix<BR>a bootloader or hack away at winbind until it behaves, but if you're<BR>a seasoned Linux pro then it's less likely that you're dual booting or<BR>using Windows ADS in the first place...<BR><BR></rant></ramble><BR><BR>--matt<BR><BR>--<BR>Open Source Software Engineering Consultant<BR><A href="http://majen.net/">http://majen.net/</A><BR></DIV>
<DIV style="COLOR: #000000">
<DIV>But besides windbind and Microsoft's Windows Services for UNIX, is there other ways of authenticating to ADS? I'm going to be stuck with this problem soon.</DIV>
<DIV> </DIV></DIV></BODY></HTML>