Самба с LDAP auth перестала работать при обновлении Xenial до Fossa

Мы запустили открытое программное приложение Java, которое предоставляет пользователям доступ к файлам Windows, чтобы загрузить много больших файлов. Когда новое добавляется учетная запись пользователя, веб-приложение записывает запись пользователя в локальную папку пощечина, с схемой Samba и паролем пользователя. Пользователи знакомятся с системой через NSS, и самба-сервер настроен на предоставление жилья для этих пользователей. Это сработало с десяти лет, но после того, как я обновил Ubuntu 16 LTS до 20 LTS, некоторые пользователи не могут подключить на свою долю, в то время как другие могут. (версия для самбы. 4.3.9-Ubuntu → версия 4.11.6-Ubuntu) Похоже на пользователей , которые никогда не подключались. раньше не могли подключиться, в то время как пользователи, которые подключались до обновления, все еще могут,, но я догадываюсь здесь.

Проблема воспроизводима при использовании smbclient (так что это не о настройках Windows):

Один пользователь может успешно войти:

root@the-server:# smbclient \\\\localhost\\user.ok -U user.ok
WARNING: The "encrypt passwords" option is deprecated
Enter MYAPP\user.ok's password:
Try "help" to get a list of possible commands.
smb: \> exit

Другой пользователь не может:

root@the-server:# smbclient \\\\localhost\\failing.user -U failing.user
WARNING: The "encrypt passwords" option is deprecated
Enter MYAPP\failing.user's password:
session setup failed: NT_STATUS_LOGON_FAILURE

(Конечно, я использую правильный пароль)

То, что я пытался найти:

• Я добавил ReadWritePaths в smbd.service и nmbd.service, потому что демоны жаловались на то, что не могут открыть свои лог-файлы для записи. Здесь я также добавил директории, которые я нашел с именем samba/, а также домашнюю директорию пользователя:
• я попробовал установить клиент , используя spnego = no или client ntlmv2 auth = no или как в smb.conf, так и в , каждый раз перезапускали дьямоны. Это не исправит.
• Я также пытаюсь установить клиент ntlmv2 auth = yes, потому что я прочитал , что это Вид аутентификации основан на NTLM хэше пароля. Не исправлю.
• Я создал нового пользователя в веб-приложении. Новый пользователь не может войти в систему.
• Я удалил работающего пользователя и воссоздал его с тем же именем пользователя, но... другой (ранее никогда не использовавшийся) номер пользователя. Пользователь все еще может войти в систему.
• Я пытался установить протокол min клиента = NT1 и протокол min сервера = NT1, просто пытался. Это не исправит.
• Я пытался установить каталог контейнеров домов пользователей. (/usr/local/myapp/users ) для группировки sambashare и разрешений 1770. Не будет исправь это.

Что может вызвать такое поведение?

Конфигурационные файлы и log

smbd.service:

[Unit]
Description=Samba SMB Daemon
Documentation=man:smbd(8) man:samba(7) man:smb.conf(5)
Wants=network-online.target
After=network.target network-online.target nmbd.service winbind.service

[Service]
Type=notify
NotifyAccess=all
PIDFile=/run/samba/smbd.pid
LimitNOFILE=16384
EnvironmentFile=-/etc/default/samba
ExecStartPre=/usr/share/samba/update-apparmor-samba-profile
ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS
ExecReload=/bin/kill -HUP $MAINPID
LimitCORE=infinity
ReadWritePaths=/var/log/samba/
ReadWritePaths=/var/cache/samba/
ReadWritePaths=/var/spool/samba/
ReadWritePaths=/usr/local/myapp/users/

[Install]
WantedBy=multi-user.target

smb.conf:

[global]
log level = 4
log file = /var/log/samba/log.%m
workgroup = MYAPP
unix extensions = no
wide links = yes
load printers = no
security = user
invalid users = root
encrypt passwords = yes
passdb backend = ldapsam:ldap://127.0.0.1
ldap suffix = dc=nodomain
ldap user suffix = ou=users
ldap group suffix = ou=groups
ldap admin dn = cn=admin,dc=nodomain
ldap ssl = no
ldap passwd sync = yes
ldap delete dn = no

[homes]
comment = Home Directories
path = /usr/local/myapp/users/%U
read only = no
browseable = no
valid users = %S
guest ok = no
inherit permissions = yes

nssswitch.conf:

passwd:         compat systemd ldap
group:          compat systemd
shadow:         compat
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

записи пользователей из slapcat:

dn: cn=ok.user,ou=users,dc=nodomain
sambaLMPassword: CAA85EBCA5013DA4E39701B5DB7D953C
sambaPrimaryGroupSID: S-1-5-21-2939508899-399288318-4273609636-100
displayName: User who can log in
sambaLogonScript: _ok.user.bat
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
userPassword:: e01ENX1oQ1MyYlRpZnl3eVlBdXhvSmdxc1N3PT0=
uid: ok.user
cn: ok.user
sambaPwdLastSet: 1590661108
loginShell: loginShell
sambaAcctFlags: [U          ]
gidNumber: 100
sambaPwdMustChange: 2147483647
sambaNTPassword: 76E562A44397461C150C451A0A97D45E
gecos: gecos
sambaSID: S-1-5-21-2939508899-399288318-4273609636-3017
description: description
homeDirectory: /usr/local/myapp/users/ok.user
sambaKickoffTime: 0
sn: ok.user
sambaPasswordHistory: 00000000000000000000000000000000000000
structuralObjectClass: inetOrgPerson
entryUUID: 51216ed8-3518-103a-9360-e9248c519c0b
creatorsName: cn=admin,dc=nodomain
createTimestamp: 20200528101828Z
uidNumber: 1007
sambaLogonHours: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
entryCSN: 20210204063107.618683Z#000000#000#000000
modifiersName: cn=admin,dc=nodomain
modifyTimestamp: 20210204063107Z

dn: cn=failing.user,ou=users,dc=nodomain
sambaPrimaryGroupSID: S-1-5-21-2939508899-399288318-4273609636-100
displayName: User who cannot log in
sambaLogonScript: _failing.user.bat
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
uidNumber: 1010
uid: failing.user
cn: failing.user
loginShell: loginShell
sambaAcctFlags: [U          ]
gidNumber: 100
sambaPwdMustChange: 2147483647
gecos: gecos
sambaSID: S-1-5-21-2939508899-399288318-4273609636-3021
description: description
homeDirectory: /usr/local/myapp/users/failing.user
sambaKickoffTime: 0
sn: failing.user
sambaPasswordHistory: 00000000000000000000000000000000000000
structuralObjectClass: inetOrgPerson
entryUUID: c65fc8da-4e3f-103a-9362-e9248c519c0b
creatorsName: cn=admin,dc=nodomain
createTimestamp: 20200629103354Z
userPassword:: e01ENX1PM0FNYzBuWW9UYlFqY1FUbVVGLy93PT0=
sambaLMPassword: 5EB9213C5086DC258401FE06348FE504
sambaNTPassword: B918CFBDEC4953CF990B0BE1F7682F3B
sambaPwdLastSet: 1601620989
sambaLogonHours: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
entryCSN: 20210204065218.718848Z#000000#000#000000
modifiersName: cn=admin,dc=nodomain
modifyTimestamp: 20210204065218Z

пользователи, отображающиеся в getent passwd:

ok.user:x:1007:100:gecos:/usr/local/myapp/users/ok.user:loginShell
failing.user:x:1010:100:gecos:/usr/local/myapp/users/failing.user:loginShell

log.127. .0.0.1 успешного входа:

[2021/02/11 07:35:45.410237,  4] ../../libcli/auth/ntlm_check.c:363(ntlm_password_check)
  ntlm_password_check: Checking NTLMv2 password with domain [MYAPP]
[2021/02/11 07:35:45.410294,  4] ../../source3/auth/check_samsec.c:183(sam_account_ok)
  sam_account_ok: Checking SMB password for user ok.user
  
[…]

[2021/02/11 07:35:45.413121,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [SMB2,(null)] user [MYAPP]\[ok.user] at [Do, 11 Feb 2021 07:35:45.413088 UTC] with [NTLMv2] status [NT_STATUS_OK] workstation [THE-SERVER] remote host [ipv4:127.0.0.1:55130] became [THE-SERVER]\[ok.user] [S-1-5-21-2939508899-399288318-4273609636-3027]. local host [ipv4:127.0.0.1:445] 
  {"timestamp": "2021-02-11T07:35:45.413267+0000", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "0", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": "ipv4:127.0.0.1:445", "remoteAddress": "ipv4:127.0.0.1:55130", "serviceDescription": "SMB2", "authDescription": null, "clientDomain": "MYAPP", "clientAccount": "ok.user", "workstation": "THE-SERVER", "becameAccount": "ok.user", "becameDomain": "THE-SERVER", "becameSid": "S-1-5-21-2939508899-399288318-4273609636-3027", "mappedAccount": "ok.user", "mappedDomain": "MYAPP", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "NTLMv2", "duration": 10517}}
[2021/02/11 07:35:45.413355,  2] ../../source3/auth/auth.c:322(auth_check_ntlm_password)
  check_ntlm_password:  authentication for user [ok.user] -> [ok.user] -> [ok.user] succeeded

[…]

[2021/02/11 07:35:45.425097,  4] ../../auth/auth_log.c:740(log_successful_authz_event_human_readable)
  Successful AuthZ: [SMB2,NTLMSSP] user [THE-SERVER]\[ok.user] [S-1-5-21-2939508899-399288318-4273609636-3027] at [Do, 11 Feb 2021 07:35:45.425081 UTC] Remote host [ipv4:127.0.0.1:55130] local host [ipv4:127.0.0.1:445]
  {"timestamp": "2021-02-11T07:35:45.425151+0000", "type": "Authorization", "Authorization": {"version": {"major": 1, "minor": 1}, "localAddress": "ipv4:127.0.0.1:445", "remoteAddress": "ipv4:127.0.0.1:55130", "serviceDescription": "SMB2", "authType": "NTLMSSP", "domain": "THE-SERVER", "account": "ok.user", "sid": "S-1-5-21-2939508899-399288318-4273609636-3027", "sessionId": "1e59857a-7fca-47ba-8e02-c7bb512caf81", "logonServer": "THE-SERVER", "transportProtection": "SMB", "accountFlags": "0x00000010"}}
[2021/02/11 07:35:45.425290,  3] ../../source3/smbd/password.c:139(register_homes_share)
  Adding homes service for user 'ok.user' using home directory: '/usr/local/myapp/users/ok.user'
[2021/02/11 07:35:45.425356,  3] ../../source3/param/loadparm.c:1572(lp_add_home)
  adding home's share [ok.user] for user 'ok.user' at '/usr/local/myapp/users/%U'

log.127.0.0.1 неудачного входа:

[2021/02/11 07:37:46.762028,  4] ../../libcli/auth/ntlm_check.c:363(ntlm_password_check)
  ntlm_password_check: Checking NTLMv2 password with domain [MYAPP]
[2021/02/11 07:37:46.762080,  4] ../../libcli/auth/ntlm_check.c:377(ntlm_password_check)
  ntlm_password_check: Checking NTLMv2 password with uppercased version of domain [MYAPP]
[2021/02/11 07:37:46.762118,  4] ../../libcli/auth/ntlm_check.c:391(ntlm_password_check)
  ntlm_password_check: Checking NTLMv2 password without a domain
[2021/02/11 07:37:46.762154,  3] ../../libcli/auth/ntlm_check.c:403(ntlm_password_check)
  ntlm_password_check: NTLMv2 password check failed
[2021/02/11 07:37:46.762178,  3] ../../libcli/auth/ntlm_check.c:448(ntlm_password_check)
  ntlm_password_check: Lanman passwords NOT PERMITTED for user failing.user
[2021/02/11 07:37:46.762213,  4] ../../libcli/auth/ntlm_check.c:485(ntlm_password_check)
  ntlm_password_check: Checking LMv2 password with domain MYAPP
[2021/02/11 07:37:46.762249,  4] ../../libcli/auth/ntlm_check.c:514(ntlm_password_check)
  ntlm_password_check: Checking LMv2 password with upper-cased version of domain MYAPP
[2021/02/11 07:37:46.762283,  4] ../../libcli/auth/ntlm_check.c:543(ntlm_password_check)
  ntlm_password_check: Checking LMv2 password without a domain
[2021/02/11 07:37:46.762317,  4] ../../libcli/auth/ntlm_check.c:574(ntlm_password_check)
  ntlm_password_check: Checking NT MD4 password in LM field
[2021/02/11 07:37:46.762425,  3] ../../libcli/auth/ntlm_check.c:595(ntlm_password_check)
  ntlm_password_check: LM password and LMv2 failed for user failing.user, and NT MD4 password in LM field not permitted
[2021/02/11 07:37:46.762483,  4] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.762510,  4] ../../source3/smbd/uid.c:575(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
[2021/02/11 07:37:46.762534,  4] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.762595,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2021/02/11 07:37:46.762627,  4] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.762652,  4] ../../source3/smbd/uid.c:575(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
[2021/02/11 07:37:46.762675,  4] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.762713,  4] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3
[2021/02/11 07:37:46.762738,  4] ../../source3/smbd/uid.c:575(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 2
[2021/02/11 07:37:46.762762,  4] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3
[2021/02/11 07:37:46.763220,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.763268,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2021/02/11 07:37:46.763297,  4] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.763323,  4] ../../source3/smbd/uid.c:575(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
[2021/02/11 07:37:46.763347,  4] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2021/02/11 07:37:46.763392,  4] ../../source3/passdb/pdb_ldap.c:1975(ldapsam_update_sam_account)
  ldapsam_update_sam_account: user failing.user to be modified has dn: cn=failing.user,ou=users,dc=nodomain
[2021/02/11 07:37:46.763419,  2] ../../source3/passdb/pdb_ldap.c:1168(init_ldap_from_sam)
  init_ldap_from_sam: Setting entry for user: failing.user
[2021/02/11 07:37:46.763448,  4] ../../source3/passdb/pdb_ldap.c:1988(ldapsam_update_sam_account)
  ldapsam_update_sam_account: mods is empty: nothing to update for user: failing.user
[2021/02/11 07:37:46.763484,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2021/02/11 07:37:46.763515,  2] ../../source3/auth/auth.c:343(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [failing.user] -> [failing.user] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1
[2021/02/11 07:37:46.763596,  2] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [SMB2,(null)] user [MYAPP]\[failing.user] at [Do, 11 Feb 2021 07:37:46.763566 UTC] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation [THE-SERVER] remote host [ipv4:127.0.0.1:55160] mapped to [MYAPP]\[failing.user]. local host [ipv4:127.0.0.1:445] 
  {"timestamp": "2021-02-11T07:37:46.763720+0000", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4625, "logonId": "0", "logonType": 3, "status": "NT_STATUS_WRONG_PASSWORD", "localAddress": "ipv4:127.0.0.1:445", "remoteAddress": "ipv4:127.0.0.1:55160", "serviceDescription": "SMB2", "authDescription": null, "clientDomain": "MYAPP", "clientAccount": "failing.user", "workstation": "THE-SERVER", "becameAccount": null, "becameDomain": null, "becameSid": null, "mappedAccount": "failing.user", "mappedDomain": "MYAPP", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "NTLMv2", "duration": 9134}}
[2021/02/11 07:37:46.763836,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2021/02/11 07:37:46.763882,  3] ../../auth/gensec/spnego.c:1442(gensec_spnego_server_negTokenTarg_step)
  gensec_spnego_server_negTokenTarg_step: SPNEGO(ntlmssp) login failed: NT_STATUS_WRONG_PASSWORD
[2021/02/11 07:37:46.763916,  4] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2021/02/11 07:37:46.763943,  4] ../../source3/smbd/uid.c:575(push_conn_ctx)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2021/02/11 07:37:46.763966,  4] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2021/02/11 07:37:46.764015,  4] ../../source3/smbd/sec_ctx.c:437(pop_sec_ctx)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2021/02/11 07:37:46.764055,  3] ../../source3/smbd/smb2_server.c:3254(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_erro