samba - Apr 2015 - samba 4.2 RDP problem

hi,

now i did some tests with the "auth methods" option.


"auth methods = sam, sam_ignoredomain, unix, winbind, wbc, trustdomain,
ntdomain, guest"
-> RDP works
-> smbclient -k does not work


"auth methods = sam, sam_ignoredomain, unix, winbind, wbc, trustdomain,
ntdomain, guest, samba4"
-> RDP hangs an the welcome-scrren
-> smbclient -k  works fine

 
it seems there ist some problem with the "auth methods = samba4"


regards,
heinz

Am Dienstag, 14. April 2015 11:42 CEST, Heinz H?lzl <heinz.hoelzl at
gvcc.net> schrieb:
 
> hi Louis,
> 
> same result: NT_STATUS_LOGON_FAILURE
> 
> heinz
> 
>  
> Am Dienstag, 14. April 2015 11:20 CEST, L.P.H. van Belle <belle at
bazuin.nl> schrieb:
>  
> > can you try : 
> > 
> > smbclient //SERVER.DOMAIN.TLD/netlogon -k  
> > 
> > bet that works.. 
> > 
> > Louis
> > 
> > 
> > >-----Oorspronkelijk bericht-----
> > >Van: heinz.hoelzl at gvcc.net 
> > >[mailto:samba-bounces at lists.samba.org] Namens Heinz H?lzl
> > >Verzonden: dinsdag 14 april 2015 10:55
> > >Aan: samba at lists.samba.org
> > >CC: pug at felsing.net; schnaggy at schnaggy.de
> > >Onderwerp: Re: [Samba] samba 4.2 RDP problem
> > >
> > >Hi, 
> > >
> > >thanx a lot!
> > >
> > >i can confirm,  this solution works also for me.
> > >
> > >
> > >but after setting "auth methods = sam, winbind, ntdomain, 
> > >ntdomain:winbind" smbclient -k does not work anymore:
> > >
> > >smbclient //SERVER/netlogon -k 
> > >session setup failed: NT_STATUS_LOGON_FAILURE
> > >
> > >
> > >in the log.smbd:
> > >../source3/auth/auth_domain.c:347(check_ntdomain_security)
> > >  check_ntdomain_security: Configuration error!  Cannot use 
> > >ntdomain auth method when not a member of a domain.
> > >
> > >
> > >regards,
> > >heinz
> > >
> > > 
> > >Am Dienstag, 14. April 2015 09:26 CEST, pug at felsing.net
schrieb:
> > > 
> > >> Hi schnaggy,
> > >> 
> > >> 
> > >> Zitat von schnaggy <schnaggy at schnaggy.de>:
> > >> >>    auth methods = sam, winbind, ntdomain,
ntdomain:winbind
> > >> >>    server services = s3fs, winbind, rpc, nbt, wrepl,
> > >cldap, ldap,  
> > >> >> kdc, drepl, ntp_signd, kcc, dnsupdate
> > >> >>    dcerpc endpoint servers = epmapper, wkssvc,
rpcecho, samr,
> > >> >> netlogon, lsarpc, spoolss, drsuapi, dssetup,
unixinfo, browser,
> > >> >> eventlog6, backupkey, dnsserver, remote, winreg,
srvsvc
> > >> 
> > >> this solution works also for me. In case Sambas internal DNS 
> > >ist used,  
> > >> server services should also include "dns" so DNS is
also started.
> > >> 
> > >> Christian
> > >> 
> > >> 
> > >> -- 
> > >> To unsubscribe from this list go to the following URL and
read the
> > >> instructions:  https://lists.samba.org/mailman/options/samba
> > > 
> > > 
> > >
> > >
> > >-- 
> > >To unsubscribe from this list go to the following URL and read the
> > >instructions:  https://lists.samba.org/mailman/options/samba
> > >
> > >
> > 
>  
>  
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On Tue, 2015-04-14 at 16:35 +0200, Heinz H?lzl wrote:
> hi,
> 
> now i did some tests with the "auth methods" option.
> 
> 
> "auth methods = sam, sam_ignoredomain, unix, winbind, wbc,
trustdomain, ntdomain, guest"
> -> RDP works
> -> smbclient -k does not work
> 
> 
> "auth methods = sam, sam_ignoredomain, unix, winbind, wbc,
trustdomain, ntdomain, guest, samba4"
> -> RDP hangs an the welcome-scrren
> -> smbclient -k  works fine
> 
>  
> it seems there ist some problem with the "auth methods = samba4"
Thanks for looking into this.  In general, please don't change 'auth
methods', as it is the auth methods override that changes the behaviour
of the authentication stack, both for NTLM and for Kerberos, to match
what is needed for the AD DC.  

Without it, we look in the wrong place when trying to decyrpt the
kerberos tickets, which explains the -k failures. 

I'm also surprised it helped, as I thought we were overriding it. 

That said, this is a very interesting debugging point.  

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Thanx for your answer!

Do you need additional informations? logs, tests, ecc.. ? 

Heinz
 
 
Am Mittwoch, 15. April 2015 02:28 CEST, Andrew Bartlett <abartlet at
samba.org> schrieb:
 
> On Tue, 2015-04-14 at 16:35 +0200, Heinz H?lzl wrote:
> > hi,
> > 
> > now i did some tests with the "auth methods" option.
> > 
> > 
> > "auth methods = sam, sam_ignoredomain, unix, winbind, wbc,
trustdomain, ntdomain, guest"
> > -> RDP works
> > -> smbclient -k does not work
> > 
> > 
> > "auth methods = sam, sam_ignoredomain, unix, winbind, wbc,
trustdomain, ntdomain, guest, samba4"
> > -> RDP hangs an the welcome-scrren
> > -> smbclient -k  works fine
> > 
> >  
> > it seems there ist some problem with the "auth methods =
samba4"
> 
> Thanks for looking into this.  In general, please don't change
'auth
> methods', as it is the auth methods override that changes the behaviour
> of the authentication stack, both for NTLM and for Kerberos, to match
> what is needed for the AD DC.  
> 
> Without it, we look in the wrong place when trying to decyrpt the
> kerberos tickets, which explains the -k failures. 
> 
> I'm also surprised it helped, as I thought we were overriding it. 
> 
> That said, this is a very interesting debugging point.  
> 
> Andrew Bartlett
> 
> -- 
> Andrew Bartlett
> http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba
> 
> 
> 
>