[Pkg-samba-maint] Bug#709613: printing does not work after squeeze->wheezy upgrade

[Michael Tokarev]

Package: samba
Version: 2:3.6.6-6
Severity: important

After upgrading a system from squeeze to wheezy yesterday, printing
as ordinary user stopped working.

When trying to submit a print job (using smbclient for simplicity),
"access denied" error is being returned from the server, like this:

$ smbclient //localhost/lexmark
Enter mjt's password: [...]
Domain=[TLS] OS=[Unix] Server=[Samba 3.6.6]
smb: \> print /dev/null
NT_STATUS_ACCESS_DENIED opening remote file null-21366
smb: \> _

On the server side, at the same time, the smbd process creates
a temporary file in the spool directory (named smbprn.XXXXX),
looks up the user in /etc/passwd, does several lookups to
registry.tdb, closes that temporary file and returns the
"access denied" error back to the client, without removing
the temp file.

As a result, there are several 10000s of zero-length files
accumulated in our spool directory within just half a day,
from users trying to print.

I can, however, print as a domain administrator (a user who
is able to edit printers and install printer drivers on the
server, among other things) -- that user can print fine, so
generally printing works.

The only thing changed in config is the upgrade from squeeze
to wheezy, without changing smb.conf.

I tried adding `public = yes' parameter to the printer share
in question, but that didn't change anything.

The problem becomes worse since it isn't easy anymore to
roll back to the squeeze version of samba, due to changes
in the way samba handles registry.  And with printing not
working for any user in the domain, it is obviously at least
"important".

FWIW, it is not our first upgrade of samba (from squeeze to
wheezy), we tested the upgrade first, and did another production
upgrade a few days ago in another office -- that one went fine,
including printing.  But somehow this machine does not let us
do the printing anymore.

As a somewhat-related note, after upgrade, there's another error
message being printed in logs many times, like this:

[2013/05/24 00:06:34.814001,  0] rpc_server/srv_pipe.c:500(pipe_schannel_auth_bind)
  pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2
[2013/05/24 00:06:34.928239,  0] rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client WW machine account WW$
[2013/05/24 14:35:44.558308,  0] rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client WW machine account WW$
[2013/05/24 14:39:13.020672,  0] rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client WW machine account WW$

It is not related to the printing issue we have, because
that very machine can print fine from an administrative
account as noted before.  But I've no idea why the auth
fails starting from the upgrade, and it fails for _all_
machines in the network at once.

I tried re-joining one machine to the domain and it
helped, but I'd rather not repeat the same for all
other machines.

But this appears to be something else, and as someone
said in #samba at freenode, this is some phantom issue which
pops up from time to time, but with which it's difficult
to deal, because it happens when upgrading some ancient
version to an old version, both are unsupported already.

In some previous versions, there was a way to fix almost
all printer-related problems simply by re-creating
ntprinters.tdb file (which was done by removing that file
and re-starting samba).  Now apparently that file isn't
used anymore, and we're basically stuck.

Thanks,

/mjt

-- System Information:
Debian Release: 7.0
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'stable-updates'), (500, 'oldstable'), (90, 'testing')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-amd64 (SMP w/8 CPU cores)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages samba depends on:
ii  adduser                3.113+nmu3
ii  debconf [debconf-2.0]  1.5.49
ii  dpkg                   1.16.10
ii  libacl1                2.2.51-8
ii  libattr1               1:2.4.46-8
ii  libc6                  2.13-38
ii  libcap2                1:2.22-1.2
ii  libcomerr2             1.42.5-1.1
ii  libcups2               1.5.3-5
ii  libgssapi-krb5-2       1.10.1+dfsg-5
ii  libk5crypto3           1.10.1+dfsg-5
ii  libkrb5-3              1.10.1+dfsg-5
ii  libldap-2.4-2          2.4.31-1+nmu2
ii  libpam-modules         1.1.3-7.1
ii  libpam-runtime         1.1.3-7.1
ii  libpam0g               1.1.3-7.1
ii  libpopt0               1.16-7
ii  libtalloc2             2.0.7+git20120207-1
ii  libtdb1                1.2.10-2
ii  libwbclient0           2:3.6.6-6
ii  lsb-base               4.1+Debian8
ii  procps                 1:3.3.3-3
ii  samba-common           2:3.6.6-6
ii  update-inetd           4.43
ii  zlib1g                 1:1.2.7.dfsg-13

Versions of packages samba recommends:
ii  logrotate  3.8.1-4
ii  tdb-tools  1.2.10-2

Versions of packages samba suggests:
pn  ctdb                              <none>
pn  ldb-tools                         <none>
ii  openbsd-inetd [inet-superserver]  0.20091229-2
pn  smbldap-tools                     <none>

-- debconf-show failed