Fails for domain users authenticated with samba winbind about dsbmd HOT 7 CLOSED

Could you please try to set the for()-loop's limit in dsbmd.c, line 446, from 16 to 3?:

for (i = 0; i < 3; i++) {
        if (pidfile_fileno(pfh) != i)
                (void)close(i);
}

from dsbmd.

Anything else I could add to help tracking down the problem? Other than digging into the source myself ;) (might do that as well, but I guess it's easier for someone already knowing the structure…)

from dsbmd.

Hi Felix,

thank you for the report. I haven't found the time to dig into this, yet. But I'm going work on it later.

from dsbmd.

Ok, that fixes the problem. So, does this happen after opening the socket to winbind? ;) Thanks so far!

from dsbmd.

Excellent :)

DSBMD itself doesn't open the winbind socket. I guess it is involved thru PAM when getpwnam() gets called before DSBMD opens the listening socket. PAM/winbind opens a file, then DSBMD closes all file descriptors except for the logfile if -f is not given. DSBMD opens its listening socket, which has the same number as the fd opened by PAM/winbind. Some time after the first call to accept(), PAM/winbind closes its fd, which is now DSBMD's listening socket, and therefore further calls to accept() will fail.

from dsbmd.

DSBMD itself doesn't open the winbind socket.

I know ;)

I guess it is involved thru PAM when getpwnam() gets called

Certainly! (well probably NSS in that case..)

I was just wondering why some "daemonizing" code gets executed after accepting a connection. Probably, just closing fds is somewhat unsafe ;) I never did that, only used /dev/null to replace the stdio streams (to not risk opening an fd 1 that's later confused for stdout, for example).

Well, thanks again, I'm happy I can use this tool now! :)

from dsbmd.

Certainly! (well probably NSS in that case..)

Ah, thanks.

I was just wondering why some "daemonizing" code gets executed after accepting a connection. Probably, just closing fds is somewhat unsafe ;) I never did that, only used /dev/null to replace the stdio streams (to not risk opening an fd 1 that's later confused for stdout, for example).

Yes.

Well, thanks again, I'm happy I can use this tool now! :)

Me too :)

from dsbmd.