Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I run a sudo command after binding my linux machine to an AD domain using samba/winbind, it takes anywhere between 10 seconds and 2 minutes to respond before prompting for my password.

I've checked my /etc/resolv.conf and DNS seems to be set up properly. Commands like dig run without a hitch so I am assuming the problem must not be related to DNS. As per other posts, I've also made sure both my hostname and FQDN are listed in /etc/hosts for loopback.

I set my winbind log level to 10 and checked the logs. I don't know what does and doesn't matter but some things I noticed in the logs:

[2013/06/05 10:05:19.481689,  1] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
   wbint_LookupName: struct wbint_LookupName
      in: struct wbint_LookupName
          domain                   : *
              domain                   : 'MYDOMAIN'
          name                     : *
              name                     : 'ROOT'
          flags                    : 0x00000008 (8)
[2013/06/05 10:05:19.481857,  1] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
   wbint_LookupName: struct wbint_LookupName
      out: struct wbint_LookupName
          type                     : *
              type                     : SID_NAME_USE_NONE (0)
          sid                      : *
              sid                      : S-0-0
          result                   : NT_STATUS_NONE_MAPPED
[2013/06/05 10:05:19.482076,  5] winbindd/winbindd_getgroups.c:186(winbindd_getgroups_recv)
  Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED
[2013/06/05 10:05:19.482121, 10] winbindd/winbindd.c:679(wb_request_done)
  wb_request_done[3787:GETGROUPS]: NT_STATUS_NONE_MAPPED

It seems to be trying to look up the user ROOT in the domain, which obviously shouldn't be happening... Could this be the root of the cause? If so, how can I fix this?

share|improve this question

3 Answers 3

It definitely would do that, Make sure you have

passwd       files ldap
group        files ldap
shadow       files ldap

in nsswitch.conf. Every system call that requires elevated privileges will otherwise be slow as molasses.

share|improve this answer
    
I was sure this would be it but no. My nsswitch.conf already has: passwd: files winbind shadow: files winbind group: files winbind –  Marty Jun 5 '13 at 19:16
    
Hmmm ... next thought: you have NSCD running, and it wasn't restarted after the change? –  tink Jun 5 '13 at 20:12

Not sure it will help, but do you have a username map file that contains:

root = administrator
nobody = guest

and a global parameter in smb.conf pointing to it, such as

username map = /etc/samba/smbusers

as well as the global parameter

map to guest = bad user?

share|improve this answer

Try adding

winbind enum users = no
winbind enum groups = no
winbind nested groups = false

to /etc/samba/smb.conf, in section [global]

Note: this disables nested groups

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.