[Pkg-samba-maint] Bug#1068649: winbind: Should be wanted by and ordered before nss-user-lookup.target

[Michael Tokarev]

08.04.2024 17:27, Magnus Holmgren wrote:
> Package: winbind
> Version: 2:4.17.12+dfsg-0+deb12u1
> 
> I'm not entirely sure, but I think winbind.service should include
> 
> [Unit]
> Wants=nss-user-lookup.target
> Before=nss-user-lookup.target
> 
> systemd.special(7) says:
> 
> "All services which provide parts of the user/group database should be ordered
> before this target, and pull it in."
> 
> and winbind does provide parts of the user/group database (as long as it's
> mentioned in nsswitch.conf, but typically that's the point, isn't it?).

This is a grey area (to me anyway).  Myself, I tend to avoid this sort of dependencies
as much as possible.  Since winbind itself is ordered after network.target, we're
at risk to make login impossible until network is up, and network might not be up
until, say, wifi is running, etc.

> We've had trouble with cron not running some jobs for a good while, and I just
> now figured out that it's because we have some jobs configured to run as Samba
> users, and cron started before winbind on boot and complained about invalid
> users.

Please note how /etc/init.d/cron is set up: cron itself is ordered after winbindd.
Maybe this is not a nice as systemd variant which you outlined above, but in my
view it is more reliable.

Or maybe not, - cron often used to run @reboot jobs to start services...  which is
a bad idea anyway :)

But I dunno what to do here.

Thanks,

/mjt