Arch Linux

Also, for samba_dnsupdate to start working again python-dnspython package must be downgraded to 1.16.0-1. Without the downgrade, samba_dnsupdate fails with "ModuleNotFoundError: No module named 'dns'".

There is a patch proposed upstream at https://bugzilla.samba.org/show_bug.cgi?id=14209 that has to be tested. @tpowa @nafets227 : please test if you can and let the upstream maintainer know. Unfortunately I cannot test the patch myself until later this month, my development/test system is not available and it will take time for me to rebuild it.

I tried the patch linked in that thread for samba-4.10.10, compiles but does not work:


# samba-tool
ERROR(<class 'SystemError'>): uncaught exception - bad call flags
File "/usr/bin/samba-tool", line 44, in <module>
retval = cmd._run("samba-tool", subcommand, *args)
File "/usr/lib/python3.8/site-packages/samba/netcmd/__init__.py", line 255, in _run
cmd = self.subcommands[cmd_name]
File "/usr/lib/python3.8/site-packages/samba/netcmd/main.py", line 35, in __getitem__
self[attr] = getattr(__import__('samba.netcmd.%s' % package,
File "/usr/lib/python3.8/site-packages/samba/netcmd/domain.py", line 44, in <module>
from samba.join import join_RODC, join_DC, join_subdomain
File "/usr/lib/python3.8/site-packages/samba/join.py", line 24, in <module>
from samba import gensec, Ldb, drs_utils, arcfour_encrypt, string_to_byte_array

Please try this additional patch for pygensec.c (taken from/fix for samba 4.11.2-x)

I applied both patches.
compiles, samba-tool does not complain, but I can't provision a new domain yet:

INFO 2019-12-12 10:48:39,936 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2088: Looking up IPv4 addresses
WARNING 2019-12-12 10:48:39,937 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2093: More than one IPv4 address found. Using 172.17.0.1
INFO 2019-12-12 10:48:39,938 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2105: Looking up IPv6 addresses
INFO 2019-12-12 10:48:41,561 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2278: Setting up share.ldb
INFO 2019-12-12 10:48:44,639 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2282: Setting up secrets.ldb
INFO 2019-12-12 10:48:46,279 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2288: Setting up the registry
INFO 2019-12-12 10:48:54,920 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2291: Setting up the privileges database
INFO 2019-12-12 10:48:58,876 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2294: Setting up idmap db
INFO 2019-12-12 10:49:01,510 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #2301: Setting up SAM db
INFO 2019-12-12 10:49:01,846 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #882: Setting up sam.ldb partitions and settings
INFO 2019-12-12 10:49:01,847 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #894: Setting up sam.ldb rootDSE
INFO 2019-12-12 10:49:02,279 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1302: Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

INFO 2019-12-12 10:49:03,488 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1379: Adding DomainDN: DC=test,DC=xyz
INFO 2019-12-12 10:49:03,883 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1411: Adding configuration container
INFO 2019-12-12 10:49:04,244 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1426: Setting up sam.ldb schema
INFO 2019-12-12 10:49:08,374 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1444: Setting up sam.ldb configuration data
INFO 2019-12-12 10:49:08,684 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1485: Setting up display specifiers
INFO 2019-12-12 10:49:11,750 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1493: Modifying display specifiers and extended rights
INFO 2019-12-12 10:49:11,821 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1500: Adding users container
INFO 2019-12-12 10:49:11,824 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1506: Modifying users container
INFO 2019-12-12 10:49:11,826 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1509: Adding computers container
INFO 2019-12-12 10:49:11,829 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1515: Modifying computers container
INFO 2019-12-12 10:49:11,831 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1519: Setting up sam.ldb data
INFO 2019-12-12 10:49:12,135 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1549: Setting up well known security principals
INFO 2019-12-12 10:49:12,198 pid:25850 /usr/lib/python3.8/site-packages/samba/provision/__init__.py #1563: Setting up sam.ldb users and groups
===============================================================
INTERNAL ERROR: Signal 11 in pid 25850 (4.10.10)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
===============================================================
smb_panic_default: PANIC (pid 25850): internal error
BACKTRACE: 0 stack frames:
Aborted (core dumped)

don't know if it is related or not though

[ doubple post, sry ]

looks like this was a samba bug which is about to be fixed:

https://bugzilla.samba.org/show_bug.cgi?id=14209

The upstream samba bug is now marked as resolved/fixed. Somebody should probably incorporate the patches from bugzilla into the Arch package.

Unfortunately, the proposed patches fixing Samba bug #14209 were not included into Samba 4.10.12 and Samba 4.11.5 that were released earlier today. The Samba Release Planning page at https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.10 says that the planned release date for Samba 4.10.13 is Thursday, January 23 2020. Hopefully 4.10.13 will not be another security-only release and hopefully it will include the patches fixing Samba bug #14209.

Release notes for 4.10.13 say,  bug 14209  was fixed in that release:

...

===============================
Release Notes for Samba 4.10.13
January 23, 2020
===============================

...
Changes since 4.10.12
----------------------
o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* BUG 14209: pygpo: Use correct method flags.

Can also confirm this bug for samba 4.10.10-2 on armv7l.
Testing with samba 4.11.6 on x86_64 seems to fixed this.

Is there a chance to get 4.10.13 whilst 4.11 still in testing?

you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...

you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...

you can do that on your own - it's easy:

- install pbget from AUR
- get the base structure of the samba package using pbget
- configure PKGBUILD:
you only need to change the version to 4.10.13 (pkgver=4.10.13)
and the md5sums at the end of PKGBUILD (you get them with makepkg -g)
- makepkg -si

I'm not sure why nobody does that in the official repo...

Hi Klaus,

thank you for the answer(s).
I know, that I can build it myself, and I already did.
But I don't really understand why I have to and the package remains in a broken state for weeks.

KR
Robert

Hi Robert,
I was wondering about that too and therefore asked a question in the Arch forum whether it might be possible to get a timeline, when the problem will be fixed.
Apart from a relatively unfriendly answer, nothing came of it - that's why I built the package myself...

I saw this morning samba 4.11.3-3 pushed on extra. It is still broken. Is this a mistake?

This bug was fixed in samba 4.11.6, released on January 28, 2020. It is #14209 in the Samba Bugzilla, see https://www.samba.org/samba/history/samba-4.11.6.html

What is being published here, I mean version 4.11.3, is more than 4 months old version. 4.11.3 was released on December 10, 2019. I really would like to know why 4.11.3 is here instead of a more recent version. It makes no sense to me.

I don't understand, why a package such as samba which sees a broad utilization all over different distributions won't see any updates for like 4 months. And when it get's updates, it's a version which over 4 months old. The bug, still isn't resolved and the package version is outdated for quite a while now. Is there any reason for that?

There is also an opened thread on archlinux forum: https://bbs.archlinux.org/viewtopic.php?pid=1894667#p1894667

Archlinux really needs to update to Samba 4.12.0 in order to get back working shares.

Archlinux maintenance has become somewhat obscure lately.
I just tried to build Samba 4.12.0 on a test system ... just to see if there are problems (that might explain why it is not in the repo).

It fails with:
ERROR: System library tdb of version 1.4.3 not found

In fact - there seems to be no version 1.4.3 of tdb:

pacman -Ss tdb
extra/tdb 1.3.18-4 [Installiert]
A Trivial Database similar to GDBM but allows simultaneous commits

... but when you look at https://www.archlinux.org/packages ...
What a surprise - there we find tdb 1.4.3-2

I quit at this point and return back to samba 4.10.13. This version has a fix for 14209 also ...

I compiled samba 4.11.7 on x86_64 and armv7l and don't have these problems.
Already provided my patches here.
https://bugs.archlinux.org/task/62521

Don't know some maintainers reading here. But why now 4.12.0 is in testing, wait for first bugfix release!

And please remove the experimental and insecure feature that was introduced in this commit.
https://git.archlinux.org/svntogit/packages.git/commit/trunk?h=packages/samba&id=b5ffb98d77dad1dd2454d01a836096b803ef5e17

@telsch This experimental and insecure feature cannot be removed. It is required for printing to shared printers with GSSAPI authentication. See https://bugs.archlinux.org/task/62727

@patrakov what about the functionality lost if running as a DC? Primarily Group Policies.
https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC#Known_Limitations_of_MIT_Kerberos_Support_in_Samba

Samba DCs with MIT Kerberos KDC currently do not support:

PKINIT support required for using smart cards
Service for User to Self-service (S4U2self)
Service for User to Proxy (S4U2proxy)
Running as a Read only domain controller (RODC)
Authentication Audit logging
Computer GPO's are not applied, see Bug 13516

I guess this calls for two variants of the samba package.

I can't find that someone says using GSSAPI authentication and samba in ad mode.
My setup is in ad mode and i could print. But my client doesn't join the domain. Just enter a valid user and password.

So.. I assume this could be closed now?

yes, you can close this.
The underlying problem of this topic (python 3.8) is fixed since samba 4.11.7. We now have 4.12.2 in extra (stable).

MIT KDC is topic of another task:  FS#66023  - [samba] and MIT KDC

Although it is understandable that some people need GSSAPI printing, MIT kerberos breaks many AD installations and is *not supported* by the samba team. Such things should not be put in the mainline - this is at most a topic for testing. But - as mentioned - this is discussed in  FS#66023 .