/How to Clear Samba and Winbind Cache

How to Clear Samba and Winbind Cache

One user updated his Scientific Linux 7 recently. The version of Samba was upgraded from 4.4 to 4.8. The samba service was not running smoothly after that. One strange problem is that some people could access the samba share, but some could not. You can see the following messages in the log when you set the log level to 3:

[2019/03/11 12:26:12.597548, 3] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
get_user_from_kerberos_info: Username DOMAIN\user is invalid on this system
[2019/03/11 12:26:12.597583, 3] ../source3/auth/auth_generic.c:147(auth3_generate_session_info_pac)
auth3_generate_session_info_pac: Failed to map kerberos principal to system user (NT_STATUS_LOGON_FAILURE)
[2019/03/11 12:26:12.597649, 3] ../source3/smbd/smb2_server.c:3171(smbd_smb2_request_error_ex)
smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../source3/smbd/smb2_sesssetup.c:137
[2019/03/11 12:26:12.598658, 3] ../source3/smbd/server_exit.c:236(exit_server_common)

It took me a while to fix the problem. The problem is caused by bogus entries in samba and winbind’s cache. I found this article about clearing the cache. Our server is part of an AD domain, so there is one extra step to perform. That is rejoining the domain after cache is cleared. Here are all the commands that I ran:

service winbind stop service smb stop net cache flush rm -f /var/lib/samba/*.tdb rm -f /var/lib/samba/group_mapping.ldb net ads join -U Administrator service smb start service winbind start

Note that the net cache fulsh command could take a long time to finish. Just wait for a few minutes and it would finish eventually.