search for: gssapi_helper

...6(stream_terminate_connection) if i try to browse dns from a window2012 dns management utility in log.samba i got the following message: [2016/04/16 09:44:43.000863, 3] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/04/16 09:44:43.019898, 1] ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/04/16 09:44:43.019958, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pd...

...n the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller). ---- On Samba side with log level 10 I get the following errors: ---- [2016/08/03 13:12:41.571366, 1] ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 13:12:41.571495, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,da...

Hello Louis, Thanks for your reply. > No, your output is not good. So let's have a look. > >C:\Temp>netdom verify cyb64w10-monster > >The format of the specified computer name is invalid. > Thats not good. Well, it quite clearly states the format is invalid. If I use the the FQDN of the AD domain it works fine. The DNS search is also including the AD domain as

...Directory Replication Latency (an account created on another > domain > controller has not replicated to the current domain controller). > ---- > > > On Samba side with log level 10 I get the following errors: > ---- > [2016/08/03 13:12:41.571366, 1] > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 13:12:41.571495, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet...

...6(stream_terminate_connection) if i try to browse dns from a window2012 dns management utility in log.samba i got the following message: [2016/04/16 09:44:43.000863, 3] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/04/16 09:44:43.019898, 1] ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/04/16 09:44:43.019958, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pd...

...results in "Failed update of 26 entries", all with NOTAUTH(BADSIG) errors (also TSIG errors, but I understand that's to be expected as the internal dns server doesn't support TSIG). The log on the original DC shows these errors: [2018/02/26 21:08:10.634806, 1] ../auth/kerberos/gssapi_helper.c:388(gssapi_check_packet) GSS VerifyMic failed: A token had an invalid MIC: unknown mech-code 2529638943 for mech 1 2 840 113554 1 2 2 [2018/02/26 21:08:10.634820, 0] ../source4/auth/gensec/gensec_gssapi.c:1344(gensec_gssapi_check_packet) gssapi_check_packet(hdr_signing=0,sig_size=28,data=17...

...> > installation). Though the klist purge and gpupdate run. Unfortunately > > gpupdate > > immediately showed the same errors again while Samba printing the same > > errors in > > its log: > > > > [2016/08/03 17:48:48.064741, 1] > > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) > > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown > mech- > > code 0 > > for mech 1 2 840 113554 1 2 2 > > [2016/08/03 17:48:48.064868, 0] > > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet...

...> > Unfortunately this didn't change anything. I am still getting the same > errors > from gpupdate.exe (with the same errors logged to event log) claiming name > resolution failure while samba logs report: > > [2016/08/03 15:17:45.609250,  1] > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) >    gss_unwrap_iov failed:  Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 15:17:45.609387,  0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) >    gssapi_unseal_...

...exist as GPO has never been synced on this machine (fresh Win 10 Pro 1607 installation). Though the klist purge and gpupdate run. Unfortunately gpupdate immediately showed the same errors again while Samba printing the same errors in its log: [2016/08/03 17:48:48.064741, 1] ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 17:48:48.064868, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,da...

I am also seeing this in smbd.log: [2020/07/03 09:20:18.211558, 1] ../../auth/kerberos/gssapi_helper.c:391(gssapi_check_packet) GSS VerifyMic failed: A token had an invalid MIC: unknown mech-code 2529638943 for mech 1 2 840 113554 1 2 2 [2020/07/03 09:20:18.211625, 0] ../../source4/auth/gensec/gensec_gssapi.c:1347(gensec_gssapi_check_packet) gssapi_check_packet(hdr_signing=0,sig_size=28,data...

...h = no to my smb.conf and re-started Samba. Unfortunately this didn't change anything. I am still getting the same errors from gpupdate.exe (with the same errors logged to event log) claiming name resolution failure while samba logs report: [2016/08/03 15:17:45.609250, 1] ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 15:17:45.609387, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,da...

...nsec_gssapi_update) > gensec_gssapi: NO credentials were delegated > [2016/08/04 10:44:54.789373, 5] > ../source4/auth/gensec/gensec_gssapi.c:514(gensec_gssapi_update) > GSSAPI Connection will be cryptographically sealed > [2016/08/04 10:44:54.806151, 1] > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/04 10:44:54.806331, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet...

...on this machine (fresh Win 10 Pro 1607 > installation). Though the klist purge and gpupdate run. Unfortunately > gpupdate > immediately showed the same errors again while Samba printing the same > errors in > its log: > > [2016/08/03 17:48:48.064741, 1] > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 17:48:48.064868, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet...

...disabled IPv6 on the server temporary as well as I > removed the second IPv4 address from the interface. > > Unfortunately this didn't do any change to the result. > > Still getting the same errors in Samba log. > > [2016/08/04 11:49:23.546473, 1] > ../auth/kerberos/gssapi_helper.c:291(gssapi_unseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown > mech-code 0 for mech 1 2 840 113554 1 2 2 > [2016/08/04 11:49:23.546602, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet(hdr_...

Ok. I've done the following, any samba dev, please read below. Looks to me some bug in librpc/ndr/ndr.c But im not a coder.. so please have a look.     Environment. Debian Jessie, samba 4.2.10 (debian)   I remove my proxy2 server from the domain, cleared up the AD. Removed all content from /var/(lib/cache)/samba Removed all other unnneeded services for this test. Removed all