Bug 1018856 - upgrade to samba-winbind-clients-4.0.9-2.fc19, missing pam_winbind, can no longer login
upgrade to samba-winbind-clients-4.0.9-2.fc19, missing pam_winbind, can no lo...
Product: Fedora
Classification: Fedora
Component: samba (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Guenther Deschner
Fedora Extras Quality Assurance
: 1020890 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2013-10-14 10:25 EDT by Rex Dieter
Modified: 2013-11-10 02:35 EST (History)
10 users (show)

See Also:
Fixed In Version: samba-4.1.0-2.fc20
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-10-20 20:58:46 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Rex Dieter 2013-10-14 10:25:27 EDT
Seems the introduction of a -winbind-modules subpkg fixes bug #1010722 .  yay!

But, previously working f19 boxes that upgrade to samba-4.0.9-2.fc19 end up without any pam_winbind installed, and our network users can no longer login. Boo!

*Usually* to handle upgrade paths like this you'd want to add something to the new -winbind-modules subpkg like:
Obsoletes: %{name}-winbind-clients < %{?epoch:%{epoch}:}4.0.9-3
Requires:  %{name}-winbind-clients = %{samba_depver}

So that *both* -winbind-modules and -winbind-clients get pulled in on upgrades (and not just the latter).  Unfortunately, that means that -winbind-modules now depends on -winbind-clients

Another option that gets around that problem is making yet another subpkg containing no files but has:
Obsoletes: %{name}-winbind-clients < %{?epoch:%{epoch}:}4.0.9-3
Requires:  %{name}-winbind-clients = %{samba_depver}
Requires:  %{name}-winbind-modules = %{samba_depver}
Comment 1 Rex Dieter 2013-10-14 10:28:38 EDT
I suspect this same upgrade path issue exists with the f20 version of these updates too.
Comment 2 Andreas Schneider 2013-10-14 10:41:13 EDT
We split out that module, so that you can install the i686 package on x86_64, cause the pam module and nss modules might be needed by 32bit applications. If I add "Requires:  %{name}-winbind-clients" then we would again run into bug #1010722
Comment 3 Andreas Schneider 2013-10-14 10:43:37 EDT
So I don't see a way how to solve this without running into the old problem. Cause of this I would vote to close this bug as WONTFIX.
Comment 4 Andreas Schneider 2013-10-14 10:45:01 EDT
Well to fix this issue, we would need the baselibs concept SUSE is using.
Comment 5 Rex Dieter 2013-10-14 10:55:34 EDT
Note the the dep I suggested on winbind-clients is not arch'd, it would only pull in the native one.

Either approach I mentioned should work, but please don't WONTFIX this... like I said, you'll break every existing install that uses pam_winbind if you do. :(
Comment 6 Milan Kerslager 2013-10-14 11:14:21 EDT
winbind-clients may require winbind-modules. This missing requires is what probably breaks your setup. As old boxes has winbind-clients as for-winbind-to-work-set, this Requires should preserve working setup during upgrade.


This is because winbind-modules contain library which should be possible to install separately (binaries are unmixable in 32/64bit mixed environment).
Comment 7 Andreas Schneider 2013-10-14 11:28:45 EDT
samba-winbind-modules doesn't require samba-winbind-clients. To correctly function they need samba-winbind but not necessarily. pam_winbind talks to winbind using a protocol over a unix socket. If we add a require then yum will probably try to install samba-winbind.x86_64 and samba-winbind.i686 and we will run into a conflict again.
Comment 8 Andreas Schneider 2013-10-14 11:45:40 EDT
The only fix I can see is to add a requirement to the modules in the samba-winbind package. Then they would be always installed with samba-winbind but could be installed without it too.
Comment 9 Andreas Schneider 2013-10-15 06:13:21 EDT
Do you agree with adding:

Requires: samba-winbind-modules

in the samba-winbind package? Does it make sense?
Comment 10 Sumit Bose 2013-10-15 06:32:57 EDT
I would say yes since samba-winbind-clients require samba-winbind of the same version. So if samba-winbind-clients is updated, samba-winbind will be updated as well and will pull samba-winbind-modules in.
Comment 11 David Woodhouse 2013-10-15 07:33:57 EDT
Do we have a fix for this? My users are gathering outside the door with pitchforks.... I'd like to use the same fix that's going into Fedora for real, and get it into our own internal repository ASAP since this is a fairly catastrophic regression...
Comment 12 David Woodhouse 2013-10-15 10:16:43 EDT
I've just realised that as a temporary workaround I can add samba-winbind-modules to the requirements of my internal $COMPANY-user-setup package so I don't need to mess around with shipping a fixed Samba package.

I'm not sure if that'll be enough to get them to put their pitchforks down though. When they upgrade to the *current* package, pam_winbind.conf is 'saved':

warning: /etc/security/pam_winbind.conf saved as /etc/security/pam_winbind.conf.rpmsave

And then when the samba-winbind-modules package gets installed again, it isn't configured correctly. Why in $DEITY's name is krb5_auth off by default anyway; does anyone *not* want cached_login, krb5_auth, and krb5_ccache_type=FILE?
Comment 13 David Woodhouse 2013-10-15 10:33:45 EDT
I filed bug 1019354 against rpm for the fact that a config file marked %config(noreplace) is getting replaced.

We might want to find a workaround for this, this time. It's bad enough that the upgrade removed the modules, without the configuration file getting eaten too. Perhaps when we install the newly-fixed package, it could look for a .rpmsave file and move that into place? Or something...
Comment 14 Andreas Schneider 2013-10-15 11:17:57 EDT
I have to leave, packages will be available tomorrow morning (CEST).
Comment 15 Milan Kerslager 2013-10-16 02:33:00 EDT
How to fix after update:

yum install samba-winbind-modules
mv /etc/security/pam_winbind.conf.rpmsave /etc/security/pam_winbind.conf

How to make Adobe Reader work on 64bit system:

yum install samba-winbind-modules.i686

How to downgrade:

yum downgrade samba\* libwbclient libsmbclient

How then exclude Samba update:

echo "exclude=perl*" >> /etc/yum.conf
Comment 16 Fedora Update System 2013-10-16 03:04:55 EDT
samba-4.1.0-2.fc20 has been submitted as an update for Fedora 20.
Comment 17 Milan Kerslager 2013-10-16 03:36:42 EDT
The last line in comment #15 should be:

echo "exclude=samba* libwbclient libsmbclient" >> /etc/yum.conf
Comment 18 Fedora Update System 2013-10-16 03:39:19 EDT
samba-4.0.9-3.fc19 has been submitted as an update for Fedora 19.
Comment 19 Andreas Schneider 2013-10-17 11:24:50 EDT
Please give karma if the new build works for you!
Comment 20 Fedora Update System 2013-10-17 16:28:15 EDT
Package samba-4.1.0-2.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing samba-4.1.0-2.fc20'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 21 Alexander Bokovoy 2013-10-18 09:12:41 EDT
*** Bug 1020890 has been marked as a duplicate of this bug. ***
Comment 22 Fedora Update System 2013-10-20 20:58:46 EDT
samba-4.0.9-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 23 Fedora Update System 2013-11-10 02:35:14 EST
samba-4.1.0-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.