samba - Apr 2005 - Windows 2003 SP1 breaks kerberos on samba?

Hi All,

I am in no way a samba expert, but we recently joined a FC3 machine to a
windows 2003 domain using ADS. Kerberos worked perfectly in both
directions until we approved the windows 2003 server SP1 update.

After this, we could still use wbinfo -g, wbinfo -u, wbinfo -t etc, but
chowning files refused to work "invalid user". You also could not
authenticate against the samba shares on the machine. The log files showed
entries like this :

[2005/04/15 12:37:38, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(298)
  group Domain Admins in domain OURDOMAIN does not exist

NTLM auth continues to work (this is our squid proxy server), but all else
was quite broken. Is this something we did incorrectly or have others
experienced this? As soon as SP1 was rolled back on the server, things
became peachy again.

Any thoughts?

Cheers,
Stuart

On Fri, 2005-04-15 at 13:19 +1000, Stuart Westbury
wrote:
> Hi All,
> 
> I am in no way a samba expert, but we recently joined a FC3 machine to a
> windows 2003 domain using ADS. Kerberos worked perfectly in both
> directions until we approved the windows 2003 server SP1 update.
> NTLM auth continues to work (this is our squid proxy server), but all else
> was quite broken. Is this something we did incorrectly or have others
> experienced this? As soon as SP1 was rolled back on the server, things
> became peachy again.
Known issue.  We don't yet know what Microsoft changed, or why they did
it.  Those with MS support contracts could try and chase down answers, I
know we have put the question to the contacts we have.

There is a small workaround in the current code (the impending 3.0.14a
release, and the withdrawn 3.0.14 release) but this simply tells you to
set 'client schannel = no' until we figure out things further.  This is
not a good long-term solution however.

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.samba.org/archive/samba/attachments/20050415/a8750ab6/attachment.bin