Not sure but it seems you have two realms: Kerberos realm
PRIVATE.AAA.PRIVATE.DOM + AD realm AAA.PRIVATE.DOM.
Client has default realm set to PRIVATE.AAA.PRIVATE.DOM which is not your
AD's realm and so you get:
gss_init_sec_context failed with [Unspecified GSS failure. Minor code may
provide more information: Server
cifs/swir.private.aaa.private.dom at PRIVATE.AAA.PRIVATE.DOM not found in
Kerberos
Just a lead, not I'm a kerberos expert and I'm not sure to have really
undestood you (I'm not a foreign language expert too :p)
Hoping this helps anyway,
mathias
2016-06-08 17:40 GMT+02:00 lejeczek <peljasz at yahoo.co.uk>:
> hi users
>
> a novice here hoping to grasp fundamentals soon
> I have a samba+sssd as a client to an AD - I have all the keytabs for a
> host(I think) but I noticed weird(to me at least) smbclient behavior.
> when I do:
> $ smbclient -L swir -U me at AAA.PRIVATE.DOM -k
> all works, clients sees local samba's shares, when I do:
> $ smbclient -L swir.private.aaa.private.dom -U pe243 at AAA.PRIVATE.DOM -k
> gss_init_sec_context failed with [Unspecified GSS failure. Minor code may
> provide more information: Server
> cifs/swir.private.aaa.private.dom at PRIVATE.AAA.PRIVATE.DOM not found in
> Kerberos database]
> SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed: NT_STATUS_INTERNAL_ERROR
> Failed to setup SPNEGO negTokenInit request: NT_STATUS_INTERNAL_ERROR
> session setup failed: NT_STATUS_INTERNAL_ERROR
>
> and to verify:
> $ klist -k /etc/krb5.swir.keytab -e
> Keytab name: FILE:/etc/krb5.swir.keytab
> KVNO Principal
> ----
> --------------------------------------------------------------------------
> 4 host/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (des-cbc-crc)
> 4 host/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (des-cbc-md5)
> 4 host/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (arcfour-hmac)
> 4 host/swir.private.aaa.private.dom at AAA.PRIVATE.DOM
> (aes256-cts-hmac-sha1-96)
> 4 host/swir.private.aaa.private.dom at AAA.PRIVATE.DOM
> (aes128-cts-hmac-sha1-96)
> 4 CIFS/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (des-cbc-crc)
> 4 CIFS/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (des-cbc-md5)
> 4 CIFS/swir.private.aaa.private.dom at AAA.PRIVATE.DOM (arcfour-hmac)
> 4 CIFS/swir.private.aaa.private.dom at AAA.PRIVATE.DOM
> (aes256-cts-hmac-sha1-96)
> 4 CIFS/swir.private.aaa.private.dom at AAA.PRIVATE.DOM
> (aes128-cts-hmac-sha1-96)
>
> and above keytab file samba uses in its config, and that keytab was
> generated on AD DS,
> What you can notice when I smbclient with FQDN(it's all one local host,
> smbclient is trying itself) is this:
>
> gss_init_sec_context failed with [Unspecified GSS failure. Minor code may
> provide more information: Server
> cifs/swir.private.aaa.private.dom at PRIVATE.AAA.PRIVATE.DOM not found in
> Kerberos
>
> @PRIVATE.AAA.PRIVATE.DOM # this part, I thought it should be AD domain,
> like: @AAA.PRIVATE.DOM
>
> why smbclient uses it's own realm?
> I should also say that, this linux is a client of two realms: first
it's a
> freeIPA server that runs locally on this box and second, its local samba is
> a client of AD(win2k14)
> And my krb5.conf looks like this:
> --------------------------
> [libdefaults]
> default_realm = PRIVATE.AAA.PRIVATE.DOM
> dns_lookup_realm = true
> dns_lookup_kdc = true
> rdns = false
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = yes
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
> [realms]
> PRIVATE.AAA.PRIVATE.DOM = {
> kdc = swir.private.aaa.private.dom:88
> master_kdc = swir.private.aaa.private.dom:88
> admin_server = swir.private.aaa.private.dom:749
> default_domain = private.aaa.private.dom
> pkinit_anchors = FILE:/etc/ipa/ca.crt
> }
> AAA.PRIVATE.DOM = {
> kdc = win-srv.aaa.private.dom:88
> domain_server = wins-rv1.aaa.private.dom:749
> admin_server = win-srv1.private.aaa.private.dom
> }
>
> [domain_realm]
> .private.aaa.private.dom = PRIVATE.AAA.PRIVATE.DOM
> private.aaa.private.dom = PRIVATE.AAA.PRIVATE.DOM
>
> aaa.private.dom = AAA.PRIVATE.DOM
> .aaa.private.dom = AAA.PRIVATE.DOM
> --------------------
> so PRIVATE.AAA.PRIVATE.DOM is own local freeIPA domain and AAA.PRIVATE.DOM
> is AD domain
> Also you can see dns-wise it is like this:
> IPA server(samba) is: swir.private.aaa.private.dom
> and AD with it's server is: win-srv.aaa.private.dom
>
> there is something mis-configured or/and I am confusing fundamentals. What
> am I doing wrong?
> many thanks
> L.
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>