samba - Apr 2005 - Problems with ADS membership in win2k domain

I'm having problems with ADS membership for samba.  I had a
"mostly"
working version with RHES v2.1, krb5 v1.2, samba v3.0.5.

I knew to get to a fully functioning version I would need krb5 v1.3
or later.  So finally I had an opertunity to junk RH's crufty krb5
and build from scratch with:

RHES v2.1
MIT krb5 v1.4
samba v3.0.13

This works fine on another server.  Now to the problem:

smbclient works flawlessly.  kinit(1) works fine.  However on
another I try from a win2k client I get the authentication 
dialog box and keep getting the dreaded in log.w.x.y.z:

[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [18] failed to decrypt with error Bad
encryption type
[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [17] failed to decrypt with error Bad
encryption type
[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [16] failed to decrypt with error Bad
encryption type
[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [23] failed to decrypt with error Bad encr
yption type
[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [1] failed to decrypt with error Bad
encryption type
[2005/04/16 00:56:10, 3] libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [3] failed to decrypt with error Decrypt
integrity check failed
[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
  ads_secrets_verify_ticket: enc type [2] failed to decrypt with error Bad
encryption type
[2005/04/16 00:56:10, 10] passdb/secrets.c:secrets_named_mutex_release(714)
  secrets_named_mutex: released mutex for replay cache mutex
[2005/04/16 00:56:10, 3] libads/kerberos_verify.c:ads_verify_ticket(346)
  ads_verify_ticket: krb5_rd_req with auth failed (Unknown code 0)

...and of course the fun part is we DO NOT have a win2k3 ADS; we have
win2k ADS.  So I decided to try samba v3.0.14a since it just came out.

However, I still have the same issue.

krb5 v1.4 built with:

./configure  --prefix=/usr/local
make
make check (all tests pass)
sudo make install

/etc/krb5.conf:
| [libdefaults]
|  default_realm = US1.FOO.COM
| 
| [realms]
|  US1.FOO.COM = {
|   kdc = dc1.us1.foo.com
|  }
| 
| [domain_realm]
|  .dc1.us1.foo.com = US1.FOO.COM

samba 3.0.14a built with:

./configure --prefix=/usr/local --with-krb5=/usr/local
make
sudo make install

/usr/local/lib/smb.conf:
| [global]
| workgroup = DOMAINM2CRO
| netbios name = TOKEN
| 
| log file = /usr/local/var/log.%m
| 
| realm = US1.FOO.COM
| security = ads
| password server = dc1.us1.foo.com dc2.us1.foo.com
| 
| idmap uid = 15000-20000
| idmap gid = 15000-20000
| winbind separator = +
| winbind enum users = true
| winbind enum groups = true
| winbind cache time = 10
| 
| load printers = no
| domain master = no
| 
| hosts deny = ALL
| hosts allow = 192.168.0.0/16 127.
| interfaces = eth1 lo
| bind interfaces only = yes
| 
| [tmp]
|         comment = tmp files
|         path = /tmp
|         read only = yes

To me this seems like it shouldn't be rocket science.  I did the
same configuration on a sister system running RHES v2.1, krb5 v1.4,
etc (same right down to the RPM verions reported by "rpm -q -a")
and it worked flawlessly.

I've even tried the binaries that "work" from the sister machine
on the problematic machine to no avail.

I'm out of ideas of where to look next for additional debug.  Hints?
Ideas?  Is it time to break out the sniffer and MD5 all the libraries
and executables?

Eric S. Hvozda wrote:
>[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
>  ads_secrets_verify_ticket: enc type [23] failed to decrypt with error Bad
encr
>yption type
>  
>
ENCTYPE_ARCFOUR_HMAC    0x0017
This is the encryption type of choice used by MS AD.  It's not being 
used.  Probably what you want, but the kdc isn't using it.
>[2005/04/16 00:56:10, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
>  ads_secrets_verify_ticket: enc type [1] failed to decrypt with error Bad
encryption type
>  
>
ENCTYPE_DES_CBC_CRC     0x0001  /* DES cbc mode with CRC-32 */
>[2005/04/16 00:56:10, 3]
libads/kerberos_verify.c:ads_secrets_verify_ticket(233)
>  ads_secrets_verify_ticket: enc type [3] failed to decrypt with error
Decrypt integrity check failed
>  
>
ENCTYPE_DES_CBC_MD5     0x0003  /* DES cbc mode with RSA-MD5 */

This is what's being used, and the integrety check is failing.  "In 
general, this means that the encryption key stored in a keytab doesn't 
match the key stored in the KDC for a particular principal."

The windows kdc only issues this enctype if userAccountControl in the 
computer's AD account has the flag for UF_USE_DES_KEY_ONLY.  Samba only 
sets this flag if the kerberos detected by configure doesn't have rc4-hmac
userAccountControl: 0x211000 = ( UF_WORKSTATION_TRUST_ACCOUNT | 
UF_DONT_EXPIRE_PASSWD | UF_USE_DES_KEY_ONLY );
It looks like you had previously added this computer to the domain while 
you were running an older version of Kerberos.
If that's the case, subtract 0x200000 or 2097152 decimal. from 
userAccountControl or delete the account in AD and rejoin using the new 
samba that has rc4-hmac support.

And you must be using ktpass.exe on the windows kdc to generate the host 
key because I don't see the "use kerberos keytab" option in
smb.conf.
Could be some glitch between when it was cut on the kdc and installed on 
the the linux box.  In this instance, the user account that was used to 
map the key would be flagged for des only.

Regards, Doug