Samba 4 64-bit requires 32-bit libs for full AD functionality

[davefinster]

When joining Samba 4 to a domain, a user would typically utilise winbind to inject the directory user accounts/groups into the wider system so that permissions make sense and authentication works as expected. This is typically done by configuring winbind via smb.conf and joining the machine to the domain. The administrator would then alter nsswitch.conf and add 'winbind' as a database for passwd and groups.

This functionality is delivered through the use of libnss_windbind.so (the name it gets when compiled, on SmartOS this has to be changed to nss_winbind.so.1). This can be tested through the use of 'getent passwd' or 'getent groups', which should return a list of both local and domain based users/groups. libnss_winbind.so provides this data by opening a privileged pipe to winbindd.

An issue arises on 64-bit zones whereby certain parts of the system rely on 32-bit libraries to be available, such as getent and anything that relies upon it. Since these pieces can't load 64-bit libraries (which is all that will ship on a 64-bit zone package), the loading of domain based user/group information fails.

A workaround is to inject the 32-bit versions of the following libs into the system:

libintl.so.8
libwinbind-client-samba4.so
libiconv.so.2
libreplace-samba4.so
nss_winbind.so.1 (previously libnss_windbind.so)

Ideally if users are pursuing a simple experience around joining zones to AD/directories, it would be good to have some way of shipping these 32-bit libs. There are other changes that have to be made to ensure the nsswitch.conf changes are effective, which I document here:

TritonDataCenter/smartos-live#383 (comment)

Potentially this could be a separate package that simply contains the libs. I don't forsee this being an issue on 32-bit systems.

P.S. I did the testing of Samba 4 using a modified version of the Samba 4 source from @sjorge here: http://pkg.blackdot.be

[sjorge]

Wrong issue?

~ sjorge

On 2015-10-05 14:30, Jonathan Perkin wrote:

Closed #274 [1] via 3e0e2a8 [2].

Reply to this email directly or view it on GitHub [3].

Links:

[1] TritonDataCenter/pkgsrc#274
[2]
TritonDataCenter/pkgsrc@3e0e2a8
[3] TritonDataCenter/pkgsrc#274 (comment)

[mamash]

That's Github auto-closing logic that can't be turned off.

[JeremyEinfeld]

Not a solution to this issue, but it would be worth expanding on the work-around for those seeking one.

Here is a one-liner to install 32-bit libraries into a 64-bit zone, using the pkgsrc settings with i386 substituted for x86_64:

env $(sed -n 's/x86_64/i386/p' /opt/local/etc/pkg_install.conf) pkg_add -I -m i386 -P /opt/i386 samba

Linking the respective libnss_windbind.so files:

ln -s libnss_winbind.so /opt/local/lib/nss_winbind.so.1
ln -s libnss_winbind.so /opt/i386/opt/local/lib/nss_winbind.so.1

Adding the necessary ld.config paths for those libraries:

crle -c /var/ld/ld.config -l /opt/i386/opt/local/lib:/opt/i386/opt/local/lib/samba/private -u
crle -64 -c /var/ld/64/ld.config -l /opt/local/lib -u

Pulled from https://github.com/Faithlife/BasicWinbind/blob/master/setup.sh