Gaiseric Vandal
2016-May-11 15:52 UTC
[Samba] Synology NAS Samba Upgrade breaks "Classic" domain membership
I have a Synology NAS array appliance. It is linux based and uses samba for file sharing. Normally the config is done via a gui interface but you can ssh to the array. The domain controllers are running Samba 3.6.x in classic domain mode. I have member servers running 3.6.x and 4.3.8. no problem. I recently updated the Synology "OS." The current version of samba is Version 4.1.20. I don't know what the previous version was. After the upgrade the NAS could not rejoin the domain. From the command line "net rpc join" failed with a SIG errror. The new version of samba defaulted to requiring client and server signing. This was easily fixed by updating the NAS smb.conf with client signing=disabled client ipc signing=disabled server signing=disabled The following also seemed legit client signing=default client ipc signing=default server signing=default If I deleted and recreated the machine account on the DC I could rejoin the domain. However testing the join fails. root at mynas:/# net rpc join -U "MYDOMAIN\Administrator" Joined domain MYDOMAIN. root at mynas:/#net rpc testjoin dcerpc_netr_LogonGetCapabilities_r_recv failed with NT_STATUS_INVALID_PARAMETER cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed with error NT_STATUS_INVALID_PARAMETER net_rpc_join_ok: failed to open schannel session on netlogon pipe to server MYPDC for domain MYDOMAIN. Error was NT_STATUS_INVALID_PARAMETER Join to domain 'MYDOMAIN' is not valid: NT_STATUS_INVALID_PARAMETER root at mynas:/# The \\netlogon share on the PDC is open to guest access. log files on the PDC show 192.168.x.x (192.168.x.x ) connect to service IPC$ initially as user smb_nobody (uid=90001, gid=90001) (pid 19408) ... [2016/05/11 11:46:22.733380, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: MYNAS$ [2016/05/11 11:46:22.738212, 2] passdb/pdb_ldap.c:2427(init_group_from_ldap) init_group_from_ldap: Entry found for group: 515 ... [2016/05/11 11:46:22.741400, 3] rpc_server/srv_pipe.c:339(check_bind_req) check_bind_req for \netlogon [2016/05/11 11:46:22.741423, 3] rpc_server/srv_pipe.c:346(check_bind_req) check_bind_req: \PIPE\netlogon -> \PIPE\netlogon [2016/05/11 11:46:22.741482, 3] ../libcli/auth/schannel_state_tdb.c:179(schannel_fetch_session_key_tdb) schannel_fetch_session_key_tdb: restored schannel info key SECRETS/SCHANNEL/MYNAS [2016/05/11 11:46:22.741539, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context) free_pipe_context: destroying talloc pool of size 23 [2016/05/11 11:46:22.743059, 3] smbd/process.c:1609(process_smb) Transaction 9 of length 328 (0 toread) [2016/05/11 11:46:22.743106, 3] smbd/process.c:1414(switch_message) switch message SMBtrans (pid 19408) conn 0x88830a8 [2016/05/11 11:46:22.743133, 3] smbd/ipc.c:560(handle_trans) trans <\PIPE\> data=240 params=0 setup=2 [2016/05/11 11:46:22.743164, 3] smbd/ipc.c:511(named_pipe) named pipe command on <> name [2016/05/11 11:46:22.743187, 3] smbd/ipc.c:475(api_fd_reply) Got API command 0x26 on pipe "netlogon" (pnum 281f) [2016/05/11 11:46:22.743235, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) api_rpcTNP: rpc command: NETR_LOGONGETCAPABILITIES [2016/05/11 11:46:22.743307, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context) free_pipe_context: destroying talloc pool of size 23 [2016/05/11 11:46:22.744850, 3] smbd/process.c:1609(process_smb) Transaction 10 of length 45 (0 toread) [2016/05/11 11:46:22.744896, 3] smbd/process.c:1414(switch_message) switch message SMBclose (pid 19408) conn 0x88830a8 [2016/05/11 11:46:22.744929, 3] smbd/reply.c:4860(reply_close) close fd=-1 fnum=10271 (numopen=2) [2016/05/11 11:46:22.746251, 3] smbd/process.c:1609(process_smb) Transaction 11 of length 45 (0 toread) [2016/05/11 11:46:22.746298, 3] smbd/process.c:1414(switch_message) switch message SMBclose (pid 19408) conn 0x88830a8 [2016/05/11 11:46:22.746322, 3] smbd/reply.c:4860(reply_close) close fd=-1 fnum=10270 (numopen=1) [2016/05/11 11:46:22.746790, 3] smbd/process.c:1609(process_smb) Transaction 12 of length 39 (0 toread) [2016/05/11 11:46:22.746841, 3] smbd/process.c:1414(switch_message) switch message SMBtdis (pid 19408) conn 0x88830a8 [2016/05/11 11:46:22.746879, 3] smbd/service.c:1378(close_cnum) 192.168.3.216 (192.168.3.216) closed connection to service IPC$ [2016/05/11 11:46:22.746906, 3] smbd/connection.c:35(yield_connection) Yielding connection to IPC$ [2016/05/11 11:46:22.747527, 3] smbd/server_exit.c:181(exit_server_common) Server exit (failed to receive smb request) So the NAS is authenticating to the domain controller. On the PDC (Samba 3.6.x) , testparm -v shows min protocol = CORE max protocol = NT1 On the NAS , testparm -v shows server min protocol = CORE client min protocol = CORE server max protocol = NT1 client max protocol = SMB3 client ipc signing = No (I have had problems with SMB2 even tho samba 3.6.x , Win 7 and Win 2008 shd support it.) On my working samba 4.x system (on fedora core 23), testparm -v shows server min protocol = LANMAN1 min protocol = LANMAN1 client min protocol = CORE client ipc max protocol = default client ipc min protocol = default client ipc signing = default Appreciate any advice. Thanks
henri transfert
2016-May-12 06:26 UTC
[Samba] Synology NAS Samba Upgrade breaks "Classic" domain membership
Hi, I am not sure it's the same issue, but I had a similar problem when upgrading from DSM 5.x to 6.0 : error after domain join : "Connection failed. Please check your network settings" . With the help of the (very efficient) Synology support, we solved the problem by uninstalling an old Cluster HA DSM package that was installed on the NAS but not used. Just in case it could help. Henri 2016-05-11 19:52 GMT+04:00 Gaiseric Vandal <gaiseric.vandal at gmail.com>:> I have a Synology NAS array appliance. It is linux based and uses samba > for file sharing. Normally the config is done via a gui interface but you > can ssh to the array. The domain controllers are running Samba 3.6.x in > classic domain mode. I have member servers running 3.6.x and 4.3.8. no > problem. > > > I recently updated the Synology "OS." The current version of samba is > Version 4.1.20. I don't know what the previous version was. After the > upgrade the NAS could not rejoin the domain. > > > From the command line "net rpc join" failed with a SIG errror. The new > version of samba defaulted to requiring client and server signing. This > was easily fixed by updating the NAS smb.conf with > > > > client signing=disabled > client ipc signing=disabled > > server signing=disabled > > > > The following also seemed legit > > client signing=default > client ipc signing=default > > server signing=default > > > > If I deleted and recreated the machine account on the DC I could rejoin > the domain. However testing the join fails. > > > > root at mynas:/# net rpc join -U "MYDOMAIN\Administrator" > Joined domain MYDOMAIN. > > > > root at mynas:/#net rpc testjoin > dcerpc_netr_LogonGetCapabilities_r_recv failed with > NT_STATUS_INVALID_PARAMETER > cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed > with error NT_STATUS_INVALID_PARAMETER > net_rpc_join_ok: failed to open schannel session on netlogon > pipe to server MYPDC for domain MYDOMAIN. Error was > NT_STATUS_INVALID_PARAMETER > Join to domain 'MYDOMAIN' is not valid: > NT_STATUS_INVALID_PARAMETER > root at mynas:/# > > > > The \\netlogon share on the PDC is open to guest access. > > > log files on the PDC show > > 192.168.x.x (192.168.x.x ) connect to service IPC$ initially as user > smb_nobody (uid=90001, gid=90001) (pid 19408) > > ... > > [2016/05/11 11:46:22.733380, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) > init_sam_from_ldap: Entry found for user: MYNAS$ > [2016/05/11 11:46:22.738212, 2] > passdb/pdb_ldap.c:2427(init_group_from_ldap) > init_group_from_ldap: Entry found for group: 515 > > ... > > [2016/05/11 11:46:22.741400, 3] rpc_server/srv_pipe.c:339(check_bind_req) > check_bind_req for \netlogon > [2016/05/11 11:46:22.741423, 3] rpc_server/srv_pipe.c:346(check_bind_req) > check_bind_req: \PIPE\netlogon -> \PIPE\netlogon > [2016/05/11 11:46:22.741482, 3] > ../libcli/auth/schannel_state_tdb.c:179(schannel_fetch_session_key_tdb) > schannel_fetch_session_key_tdb: restored schannel info key > SECRETS/SCHANNEL/MYNAS > [2016/05/11 11:46:22.741539, 3] > rpc_server/srv_pipe_hnd.c:121(free_pipe_context) > free_pipe_context: destroying talloc pool of size 23 > [2016/05/11 11:46:22.743059, 3] smbd/process.c:1609(process_smb) > Transaction 9 of length 328 (0 toread) > [2016/05/11 11:46:22.743106, 3] smbd/process.c:1414(switch_message) > switch message SMBtrans (pid 19408) conn 0x88830a8 > [2016/05/11 11:46:22.743133, 3] smbd/ipc.c:560(handle_trans) > trans <\PIPE\> data=240 params=0 setup=2 > [2016/05/11 11:46:22.743164, 3] smbd/ipc.c:511(named_pipe) > named pipe command on <> name > [2016/05/11 11:46:22.743187, 3] smbd/ipc.c:475(api_fd_reply) > Got API command 0x26 on pipe "netlogon" (pnum 281f) > [2016/05/11 11:46:22.743235, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) > api_rpcTNP: rpc command: NETR_LOGONGETCAPABILITIES > [2016/05/11 11:46:22.743307, 3] > rpc_server/srv_pipe_hnd.c:121(free_pipe_context) > free_pipe_context: destroying talloc pool of size 23 > [2016/05/11 11:46:22.744850, 3] smbd/process.c:1609(process_smb) > Transaction 10 of length 45 (0 toread) > [2016/05/11 11:46:22.744896, 3] smbd/process.c:1414(switch_message) > switch message SMBclose (pid 19408) conn 0x88830a8 > [2016/05/11 11:46:22.744929, 3] smbd/reply.c:4860(reply_close) > close fd=-1 fnum=10271 (numopen=2) > [2016/05/11 11:46:22.746251, 3] smbd/process.c:1609(process_smb) > Transaction 11 of length 45 (0 toread) > [2016/05/11 11:46:22.746298, 3] smbd/process.c:1414(switch_message) > switch message SMBclose (pid 19408) conn 0x88830a8 > [2016/05/11 11:46:22.746322, 3] smbd/reply.c:4860(reply_close) > close fd=-1 fnum=10270 (numopen=1) > [2016/05/11 11:46:22.746790, 3] smbd/process.c:1609(process_smb) > Transaction 12 of length 39 (0 toread) > [2016/05/11 11:46:22.746841, 3] smbd/process.c:1414(switch_message) > switch message SMBtdis (pid 19408) conn 0x88830a8 > [2016/05/11 11:46:22.746879, 3] smbd/service.c:1378(close_cnum) > 192.168.3.216 (192.168.3.216) closed connection to service IPC$ > [2016/05/11 11:46:22.746906, 3] smbd/connection.c:35(yield_connection) > Yielding connection to IPC$ > [2016/05/11 11:46:22.747527, 3] smbd/server_exit.c:181(exit_server_common) > Server exit (failed to receive smb request) > > > > So the NAS is authenticating to the domain controller. > > > > > On the PDC (Samba 3.6.x) , testparm -v shows > > min protocol = CORE > max protocol = NT1 > > On the NAS , testparm -v shows > > > server min protocol = CORE > client min protocol = CORE > server max protocol = NT1 > client max protocol = SMB3 > client ipc signing = No > > (I have had problems with SMB2 even tho samba 3.6.x , Win 7 and Win 2008 > shd support it.) > > > On my working samba 4.x system (on fedora core 23), testparm -v shows > > > server min protocol = LANMAN1 > min protocol = LANMAN1 > client min protocol = CORE > client ipc max protocol = default > client ipc min protocol = default > client ipc signing = default > > > > > Appreciate any advice. > > > Thanks > > > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >
Gaiseric Vandal
2016-May-13 13:11 UTC
[Samba] Synology NAS Samba Upgrade breaks "Classic" domain membership
I don't see any cluster packages listed under the web gui interface. Is this one of the packages that can only be managed via the command line ipkg command, which is not installed by default? thanks On 05/12/16 02:26, henri transfert wrote:> Hi, > > I am not sure it's the same issue, but I had a similar problem when > upgrading from DSM 5.x to 6.0 : error after domain join : "Connection > failed. Please check your network settings" . > > With the help of the (very efficient) Synology support, we solved the > problem by uninstalling an old Cluster HA DSM package that was installed on > the NAS but not used. > > Just in case it could help. > > Henri > > > 2016-05-11 19:52 GMT+04:00 Gaiseric Vandal <gaiseric.vandal at gmail.com>: > >> I have a Synology NAS array appliance. It is linux based and uses samba >> for file sharing. Normally the config is done via a gui interface but you >> can ssh to the array. The domain controllers are running Samba 3.6.x in >> classic domain mode. I have member servers running 3.6.x and 4.3.8. no >> problem. >> >> >> I recently updated the Synology "OS." The current version of samba is >> Version 4.1.20. I don't know what the previous version was. After the >> upgrade the NAS could not rejoin the domain. >> >> >> From the command line "net rpc join" failed with a SIG errror. The new >> version of samba defaulted to requiring client and server signing. This >> was easily fixed by updating the NAS smb.conf with >> >> >> >> client signing=disabled >> client ipc signing=disabled >> >> server signing=disabled >> >> >> >> The following also seemed legit >> >> client signing=default >> client ipc signing=default >> >> server signing=default >> >> >> >> If I deleted and recreated the machine account on the DC I could rejoin >> the domain. However testing the join fails. >> >> >> >> root at mynas:/# net rpc join -U "MYDOMAIN\Administrator" >> Joined domain MYDOMAIN. >> >> >> >> root at mynas:/#net rpc testjoin >> dcerpc_netr_LogonGetCapabilities_r_recv failed with >> NT_STATUS_INVALID_PARAMETER >> cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed >> with error NT_STATUS_INVALID_PARAMETER >> net_rpc_join_ok: failed to open schannel session on netlogon >> pipe to server MYPDC for domain MYDOMAIN. Error was >> NT_STATUS_INVALID_PARAMETER >> Join to domain 'MYDOMAIN' is not valid: >> NT_STATUS_INVALID_PARAMETER >> root at mynas:/# >> >> >> >> The \\netlogon share on the PDC is open to guest access. >> >> >> log files on the PDC show >> >> 192.168.x.x (192.168.x.x ) connect to service IPC$ initially as user >> smb_nobody (uid=90001, gid=90001) (pid 19408) >> >> ... >> >> [2016/05/11 11:46:22.733380, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) >> init_sam_from_ldap: Entry found for user: MYNAS$ >> [2016/05/11 11:46:22.738212, 2] >> passdb/pdb_ldap.c:2427(init_group_from_ldap) >> init_group_from_ldap: Entry found for group: 515 >> >> ... >> >> [2016/05/11 11:46:22.741400, 3] rpc_server/srv_pipe.c:339(check_bind_req) >> check_bind_req for \netlogon >> [2016/05/11 11:46:22.741423, 3] rpc_server/srv_pipe.c:346(check_bind_req) >> check_bind_req: \PIPE\netlogon -> \PIPE\netlogon >> [2016/05/11 11:46:22.741482, 3] >> ../libcli/auth/schannel_state_tdb.c:179(schannel_fetch_session_key_tdb) >> schannel_fetch_session_key_tdb: restored schannel info key >> SECRETS/SCHANNEL/MYNAS >> [2016/05/11 11:46:22.741539, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.743059, 3] smbd/process.c:1609(process_smb) >> Transaction 9 of length 328 (0 toread) >> [2016/05/11 11:46:22.743106, 3] smbd/process.c:1414(switch_message) >> switch message SMBtrans (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.743133, 3] smbd/ipc.c:560(handle_trans) >> trans <\PIPE\> data=240 params=0 setup=2 >> [2016/05/11 11:46:22.743164, 3] smbd/ipc.c:511(named_pipe) >> named pipe command on <> name >> [2016/05/11 11:46:22.743187, 3] smbd/ipc.c:475(api_fd_reply) >> Got API command 0x26 on pipe "netlogon" (pnum 281f) >> [2016/05/11 11:46:22.743235, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) >> api_rpcTNP: rpc command: NETR_LOGONGETCAPABILITIES >> [2016/05/11 11:46:22.743307, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.744850, 3] smbd/process.c:1609(process_smb) >> Transaction 10 of length 45 (0 toread) >> [2016/05/11 11:46:22.744896, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.744929, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10271 (numopen=2) >> [2016/05/11 11:46:22.746251, 3] smbd/process.c:1609(process_smb) >> Transaction 11 of length 45 (0 toread) >> [2016/05/11 11:46:22.746298, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746322, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10270 (numopen=1) >> [2016/05/11 11:46:22.746790, 3] smbd/process.c:1609(process_smb) >> Transaction 12 of length 39 (0 toread) >> [2016/05/11 11:46:22.746841, 3] smbd/process.c:1414(switch_message) >> switch message SMBtdis (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746879, 3] smbd/service.c:1378(close_cnum) >> 192.168.3.216 (192.168.3.216) closed connection to service IPC$ >> [2016/05/11 11:46:22.746906, 3] smbd/connection.c:35(yield_connection) >> Yielding connection to IPC$ >> [2016/05/11 11:46:22.747527, 3] smbd/server_exit.c:181(exit_server_common) >> Server exit (failed to receive smb request) >> >> >> >> So the NAS is authenticating to the domain controller. >> >> >> >> >> On the PDC (Samba 3.6.x) , testparm -v shows >> >> min protocol = CORE >> max protocol = NT1 >> >> On the NAS , testparm -v shows >> >> >> server min protocol = CORE >> client min protocol = CORE >> server max protocol = NT1 >> client max protocol = SMB3 >> client ipc signing = No >> >> (I have had problems with SMB2 even tho samba 3.6.x , Win 7 and Win 2008 >> shd support it.) >> >> >> On my working samba 4.x system (on fedora core 23), testparm -v shows >> >> >> server min protocol = LANMAN1 >> min protocol = LANMAN1 >> client min protocol = CORE >> client ipc max protocol = default >> client ipc min protocol = default >> client ipc signing = default >> >> >> >> >> Appreciate any advice. >> >> >> Thanks >> >> >> >> >> >> -- >> To unsubscribe from this list go to the following URL and read the >> instructions: https://lists.samba.org/mailman/options/samba >>
Gaiseric Vandal
2016-May-16 18:36 UTC
[Samba] Synology NAS Samba Upgrade breaks "Classic" domain membership
On both the synology (samba 4.1.20) and PDC (samba 3.6.25) testparm showed client schannel = Auto server schannel = Auto I don't know if the server even supports schannel. Maybe it doesn't any all the clients successfully negotiated not to use it. On the synology, I set client schannel = no This fixed my domain membership issue. Although possibly weakening security on the synology? Or possibly revealing a probably with schannel on my PDC. I realize both versions of Samba are end-of-life. On 05/12/16 02:26, henri transfert wrote:> Hi, > > I am not sure it's the same issue, but I had a similar problem when > upgrading from DSM 5.x to 6.0 : error after domain join : "Connection > failed. Please check your network settings" . > > With the help of the (very efficient) Synology support, we solved the > problem by uninstalling an old Cluster HA DSM package that was installed on > the NAS but not used. > > Just in case it could help. > > Henri > > > 2016-05-11 19:52 GMT+04:00 Gaiseric Vandal <gaiseric.vandal at gmail.com>: > >> I have a Synology NAS array appliance. It is linux based and uses samba >> for file sharing. Normally the config is done via a gui interface but you >> can ssh to the array. The domain controllers are running Samba 3.6.x in >> classic domain mode. I have member servers running 3.6.x and 4.3.8. no >> problem. >> >> >> I recently updated the Synology "OS." The current version of samba is >> Version 4.1.20. I don't know what the previous version was. After the >> upgrade the NAS could not rejoin the domain. >> >> >> From the command line "net rpc join" failed with a SIG errror. The new >> version of samba defaulted to requiring client and server signing. This >> was easily fixed by updating the NAS smb.conf with >> >> >> >> client signing=disabled >> client ipc signing=disabled >> >> server signing=disabled >> >> >> >> The following also seemed legit >> >> client signing=default >> client ipc signing=default >> >> server signing=default >> >> >> >> If I deleted and recreated the machine account on the DC I could rejoin >> the domain. However testing the join fails. >> >> >> >> root at mynas:/# net rpc join -U "MYDOMAIN\Administrator" >> Joined domain MYDOMAIN. >> >> >> >> root at mynas:/#net rpc testjoin >> dcerpc_netr_LogonGetCapabilities_r_recv failed with >> NT_STATUS_INVALID_PARAMETER >> cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed >> with error NT_STATUS_INVALID_PARAMETER >> net_rpc_join_ok: failed to open schannel session on netlogon >> pipe to server MYPDC for domain MYDOMAIN. Error was >> NT_STATUS_INVALID_PARAMETER >> Join to domain 'MYDOMAIN' is not valid: >> NT_STATUS_INVALID_PARAMETER >> root at mynas:/# >> >> >> >> The \\netlogon share on the PDC is open to guest access. >> >> >> log files on the PDC show >> >> 192.168.x.x (192.168.x.x ) connect to service IPC$ initially as user >> smb_nobody (uid=90001, gid=90001) (pid 19408) >> >> ... >> >> [2016/05/11 11:46:22.733380, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) >> init_sam_from_ldap: Entry found for user: MYNAS$ >> [2016/05/11 11:46:22.738212, 2] >> passdb/pdb_ldap.c:2427(init_group_from_ldap) >> init_group_from_ldap: Entry found for group: 515 >> >> ... >> >> [2016/05/11 11:46:22.741400, 3] rpc_server/srv_pipe.c:339(check_bind_req) >> check_bind_req for \netlogon >> [2016/05/11 11:46:22.741423, 3] rpc_server/srv_pipe.c:346(check_bind_req) >> check_bind_req: \PIPE\netlogon -> \PIPE\netlogon >> [2016/05/11 11:46:22.741482, 3] >> ../libcli/auth/schannel_state_tdb.c:179(schannel_fetch_session_key_tdb) >> schannel_fetch_session_key_tdb: restored schannel info key >> SECRETS/SCHANNEL/MYNAS >> [2016/05/11 11:46:22.741539, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.743059, 3] smbd/process.c:1609(process_smb) >> Transaction 9 of length 328 (0 toread) >> [2016/05/11 11:46:22.743106, 3] smbd/process.c:1414(switch_message) >> switch message SMBtrans (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.743133, 3] smbd/ipc.c:560(handle_trans) >> trans <\PIPE\> data=240 params=0 setup=2 >> [2016/05/11 11:46:22.743164, 3] smbd/ipc.c:511(named_pipe) >> named pipe command on <> name >> [2016/05/11 11:46:22.743187, 3] smbd/ipc.c:475(api_fd_reply) >> Got API command 0x26 on pipe "netlogon" (pnum 281f) >> [2016/05/11 11:46:22.743235, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) >> api_rpcTNP: rpc command: NETR_LOGONGETCAPABILITIES >> [2016/05/11 11:46:22.743307, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.744850, 3] smbd/process.c:1609(process_smb) >> Transaction 10 of length 45 (0 toread) >> [2016/05/11 11:46:22.744896, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.744929, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10271 (numopen=2) >> [2016/05/11 11:46:22.746251, 3] smbd/process.c:1609(process_smb) >> Transaction 11 of length 45 (0 toread) >> [2016/05/11 11:46:22.746298, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746322, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10270 (numopen=1) >> [2016/05/11 11:46:22.746790, 3] smbd/process.c:1609(process_smb) >> Transaction 12 of length 39 (0 toread) >> [2016/05/11 11:46:22.746841, 3] smbd/process.c:1414(switch_message) >> switch message SMBtdis (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746879, 3] smbd/service.c:1378(close_cnum) >> 192.168.3.216 (192.168.3.216) closed connection to service IPC$ >> [2016/05/11 11:46:22.746906, 3] smbd/connection.c:35(yield_connection) >> Yielding connection to IPC$ >> [2016/05/11 11:46:22.747527, 3] smbd/server_exit.c:181(exit_server_common) >> Server exit (failed to receive smb request) >> >> >> >> So the NAS is authenticating to the domain controller. >> >> >> >> >> On the PDC (Samba 3.6.x) , testparm -v shows >> >> min protocol = CORE >> max protocol = NT1 >> >> On the NAS , testparm -v shows >> >> >> server min protocol = CORE >> client min protocol = CORE >> server max protocol = NT1 >> client max protocol = SMB3 >> client ipc signing = No >> >> (I have had problems with SMB2 even tho samba 3.6.x , Win 7 and Win 2008 >> shd support it.) >> >> >> On my working samba 4.x system (on fedora core 23), testparm -v shows >> >> >> server min protocol = LANMAN1 >> min protocol = LANMAN1 >> client min protocol = CORE >> client ipc max protocol = default >> client ipc min protocol = default >> client ipc signing = default >> >> >> >> >> Appreciate any advice. >> >> >> Thanks >> >> >> >> >> >> -- >> To unsubscribe from this list go to the following URL and read the >> instructions: https://lists.samba.org/mailman/options/samba >>
Gaiseric Vandal
2016-May-27 16:30 UTC
[Samba] Synology NAS Samba Upgrade breaks "Classic" domain membership
I rolled my appliance back to DSM 6 (no updates) which resolved the issue. The BADLOCK update was applied in DSM 6u1. On 05/12/16 02:26, henri transfert wrote:> Hi, > > I am not sure it's the same issue, but I had a similar problem when > upgrading from DSM 5.x to 6.0 : error after domain join : "Connection > failed. Please check your network settings" . > > With the help of the (very efficient) Synology support, we solved the > problem by uninstalling an old Cluster HA DSM package that was installed on > the NAS but not used. > > Just in case it could help. > > Henri > > > 2016-05-11 19:52 GMT+04:00 Gaiseric Vandal <gaiseric.vandal at gmail.com>: > >> I have a Synology NAS array appliance. It is linux based and uses samba >> for file sharing. Normally the config is done via a gui interface but you >> can ssh to the array. The domain controllers are running Samba 3.6.x in >> classic domain mode. I have member servers running 3.6.x and 4.3.8. no >> problem. >> >> >> I recently updated the Synology "OS." The current version of samba is >> Version 4.1.20. I don't know what the previous version was. After the >> upgrade the NAS could not rejoin the domain. >> >> >> From the command line "net rpc join" failed with a SIG errror. The new >> version of samba defaulted to requiring client and server signing. This >> was easily fixed by updating the NAS smb.conf with >> >> >> >> client signing=disabled >> client ipc signing=disabled >> >> server signing=disabled >> >> >> >> The following also seemed legit >> >> client signing=default >> client ipc signing=default >> >> server signing=default >> >> >> >> If I deleted and recreated the machine account on the DC I could rejoin >> the domain. However testing the join fails. >> >> >> >> root at mynas:/# net rpc join -U "MYDOMAIN\Administrator" >> Joined domain MYDOMAIN. >> >> >> >> root at mynas:/#net rpc testjoin >> dcerpc_netr_LogonGetCapabilities_r_recv failed with >> NT_STATUS_INVALID_PARAMETER >> cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed >> with error NT_STATUS_INVALID_PARAMETER >> net_rpc_join_ok: failed to open schannel session on netlogon >> pipe to server MYPDC for domain MYDOMAIN. Error was >> NT_STATUS_INVALID_PARAMETER >> Join to domain 'MYDOMAIN' is not valid: >> NT_STATUS_INVALID_PARAMETER >> root at mynas:/# >> >> >> >> The \\netlogon share on the PDC is open to guest access. >> >> >> log files on the PDC show >> >> 192.168.x.x (192.168.x.x ) connect to service IPC$ initially as user >> smb_nobody (uid=90001, gid=90001) (pid 19408) >> >> ... >> >> [2016/05/11 11:46:22.733380, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap) >> init_sam_from_ldap: Entry found for user: MYNAS$ >> [2016/05/11 11:46:22.738212, 2] >> passdb/pdb_ldap.c:2427(init_group_from_ldap) >> init_group_from_ldap: Entry found for group: 515 >> >> ... >> >> [2016/05/11 11:46:22.741400, 3] rpc_server/srv_pipe.c:339(check_bind_req) >> check_bind_req for \netlogon >> [2016/05/11 11:46:22.741423, 3] rpc_server/srv_pipe.c:346(check_bind_req) >> check_bind_req: \PIPE\netlogon -> \PIPE\netlogon >> [2016/05/11 11:46:22.741482, 3] >> ../libcli/auth/schannel_state_tdb.c:179(schannel_fetch_session_key_tdb) >> schannel_fetch_session_key_tdb: restored schannel info key >> SECRETS/SCHANNEL/MYNAS >> [2016/05/11 11:46:22.741539, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.743059, 3] smbd/process.c:1609(process_smb) >> Transaction 9 of length 328 (0 toread) >> [2016/05/11 11:46:22.743106, 3] smbd/process.c:1414(switch_message) >> switch message SMBtrans (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.743133, 3] smbd/ipc.c:560(handle_trans) >> trans <\PIPE\> data=240 params=0 setup=2 >> [2016/05/11 11:46:22.743164, 3] smbd/ipc.c:511(named_pipe) >> named pipe command on <> name >> [2016/05/11 11:46:22.743187, 3] smbd/ipc.c:475(api_fd_reply) >> Got API command 0x26 on pipe "netlogon" (pnum 281f) >> [2016/05/11 11:46:22.743235, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP) >> api_rpcTNP: rpc command: NETR_LOGONGETCAPABILITIES >> [2016/05/11 11:46:22.743307, 3] >> rpc_server/srv_pipe_hnd.c:121(free_pipe_context) >> free_pipe_context: destroying talloc pool of size 23 >> [2016/05/11 11:46:22.744850, 3] smbd/process.c:1609(process_smb) >> Transaction 10 of length 45 (0 toread) >> [2016/05/11 11:46:22.744896, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.744929, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10271 (numopen=2) >> [2016/05/11 11:46:22.746251, 3] smbd/process.c:1609(process_smb) >> Transaction 11 of length 45 (0 toread) >> [2016/05/11 11:46:22.746298, 3] smbd/process.c:1414(switch_message) >> switch message SMBclose (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746322, 3] smbd/reply.c:4860(reply_close) >> close fd=-1 fnum=10270 (numopen=1) >> [2016/05/11 11:46:22.746790, 3] smbd/process.c:1609(process_smb) >> Transaction 12 of length 39 (0 toread) >> [2016/05/11 11:46:22.746841, 3] smbd/process.c:1414(switch_message) >> switch message SMBtdis (pid 19408) conn 0x88830a8 >> [2016/05/11 11:46:22.746879, 3] smbd/service.c:1378(close_cnum) >> 192.168.3.216 (192.168.3.216) closed connection to service IPC$ >> [2016/05/11 11:46:22.746906, 3] smbd/connection.c:35(yield_connection) >> Yielding connection to IPC$ >> [2016/05/11 11:46:22.747527, 3] smbd/server_exit.c:181(exit_server_common) >> Server exit (failed to receive smb request) >> >> >> >> So the NAS is authenticating to the domain controller. >> >> >> >> >> On the PDC (Samba 3.6.x) , testparm -v shows >> >> min protocol = CORE >> max protocol = NT1 >> >> On the NAS , testparm -v shows >> >> >> server min protocol = CORE >> client min protocol = CORE >> server max protocol = NT1 >> client max protocol = SMB3 >> client ipc signing = No >> >> (I have had problems with SMB2 even tho samba 3.6.x , Win 7 and Win 2008 >> shd support it.) >> >> >> On my working samba 4.x system (on fedora core 23), testparm -v shows >> >> >> server min protocol = LANMAN1 >> min protocol = LANMAN1 >> client min protocol = CORE >> client ipc max protocol = default >> client ipc min protocol = default >> client ipc signing = default >> >> >> >> >> Appreciate any advice. >> >> >> Thanks >> >> >> >> >> >> -- >> To unsubscribe from this list go to the following URL and read the >> instructions: https://lists.samba.org/mailman/options/samba >>