When I run a sudo command after binding my linux machine to an AD domain using samba/winbind, it takes anywhere between 10 seconds and 2 minutes to respond before prompting for my password.

I've checked my /etc/resolv.conf and DNS seems to be set up properly. Commands like dig run without a hitch so I am assuming the problem must not be related to DNS. As per other posts, I've also made sure both my hostname and FQDN are listed in /etc/hosts for loopback.

I set my winbind log level to 10 and checked the logs. I don't know what does and doesn't matter but some things I noticed in the logs:

[2013/06/05 10:05:19.481689,  1] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
   wbint_LookupName: struct wbint_LookupName
      in: struct wbint_LookupName
          domain                   : *
              domain                   : 'MYDOMAIN'
          name                     : *
              name                     : 'ROOT'
          flags                    : 0x00000008 (8)
[2013/06/05 10:05:19.481857,  1] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
   wbint_LookupName: struct wbint_LookupName
      out: struct wbint_LookupName
          type                     : *
              type                     : SID_NAME_USE_NONE (0)
          sid                      : *
              sid                      : S-0-0
          result                   : NT_STATUS_NONE_MAPPED
[2013/06/05 10:05:19.482076,  5] winbindd/winbindd_getgroups.c:186(winbindd_getgroups_recv)
  Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED
[2013/06/05 10:05:19.482121, 10] winbindd/winbindd.c:679(wb_request_done)
  wb_request_done[3787:GETGROUPS]: NT_STATUS_NONE_MAPPED

It seems to be trying to look up the user ROOT in the domain, which obviously shouldn't be happening... Could this be the root of the cause? If so, how can I fix this?


It definitely would do that, Make sure you have

passwd       files ldap
group        files ldap
shadow       files ldap

in nsswitch.conf. Every system call that requires elevated privileges will otherwise be slow as molasses.

  • I was sure this would be it but no. My nsswitch.conf already has: passwd: files winbind shadow: files winbind group: files winbind – Marty Jun 5 '13 at 19:16
  • Hmmm ... next thought: you have NSCD running, and it wasn't restarted after the change? – tink Jun 5 '13 at 20:12

Not sure it will help, but do you have a username map file that contains:

root = administrator
nobody = guest

and a global parameter in smb.conf pointing to it, such as

username map = /etc/samba/smbusers

as well as the global parameter

map to guest = bad user?


Try adding

winbind enum users = no
winbind enum groups = no
winbind nested groups = false

to /etc/samba/smb.conf, in section [global]

Note: this disables nested groups

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.