samba - Nov 2016 - smbclient and Kerberos

Hi All

Is this behaviour expected in smbclient:

I have a kerberized Samba server and a share that works as expected on desktop
clients, but when I use smbclient with a valid ticket with the -k flag I get a
KDC lookup failure

kev at client:/home/testuser$ smbclient -k -L //fileserver
gss_init_sec_context failed with [ Miscellaneous failure (see text): unable to
reach any KDC in realm LAN]
SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed: NT_STATUS_INTERNAL_ERROR
session setup failed: NT_STATUS_INTERNAL_ERROR

I've noticed that if I configure the KDC server in the [realm] section of my
/etc/krb5.conf everything works fine.

Does smbclient not use the DNS for KDC lookup?

I am using version Version 4.3.11-Ubuntu on Ubuntu 16.04.1

Thanks



Kevin Ratcliffe

Sent from [ProtonMail](https://protonmail.ch)

Mine seem to work fine also using Ubuntu 16.04.1 on the servers and a
separate workstation client.  My /etc/krb5.conf files on the servers and
clients are all simply:

[libdefaults]
        default_realm = REALM.EXAMPLE.COM
        dns_lookup_realm = false
        dns_lookup_kdc = true

Mike E.


On Fri, Nov 4, 2016 at 4:10 PM, Kevr via samba <samba at lists.samba.org>
wrote:
> Hi All
>
> Is this behaviour expected in smbclient:
>
> I have a kerberized Samba server and a share that works as expected on
> desktop clients, but when I use smbclient with a valid ticket with the -k
> flag I get a KDC lookup failure
>
> kev at client:/home/testuser$ smbclient -k -L //fileserver
> gss_init_sec_context failed with [ Miscellaneous failure (see text):
> unable to reach any KDC in realm LAN]
> SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed: NT_STATUS_INTERNAL_ERROR
> session setup failed: NT_STATUS_INTERNAL_ERROR
>
> I've noticed that if I configure the KDC server in the [realm] section
of
> my /etc/krb5.conf everything works fine.
>
> Does smbclient not use the DNS for KDC lookup?
>
> I am using version Version 4.3.11-Ubuntu on Ubuntu 16.04.1
>
> Thanks
>
>
>
> Kevin Ratcliffe
>
> Sent from [ProtonMail](https://protonmail.ch)
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

The defaults for dns_lookup_realm and dns_lookup_kdc should be false and
true respectively, but the samba team recommends using them explicitly, so
that's what I do.  My /etc/krb5.conf file doesn't include any of the
stock
lines included with the package from Ubuntu (which I believe is based on
the MIT version of kerberos).  My file includes the four lines in the
previous message and only those four lines.  Maybe something in the stock
file causes the problem you're seeing.?

Mike E.


On Fri, Nov 4, 2016 at 5:01 PM, Kevr <kevr at protonmail.com> wrote:
> Hmmmm. I'm using the stock krb5.conf installed by apt-get. So basically
> all I have is the default_realm set to my realm in [libdefaults]. I was
> under the impression that dns_lookup_kdc was true by default. Am I wrong?
>
> Kevin Ratcliffe
>
> Sent from ProtonMail <https://protonmail.ch>
>
>
> -------- Original Message --------
> Subject: Re: [Samba] smbclient and Kerberos
> Local Time: 4 November 2016 8:48 PM
> UTC Time: 4 November 2016 20:48
> From: samba at lists.samba.org
> To: Kevr <kevr at protonmail.com>
> samba at lists.samba.org <samba at lists.samba.org>
>
> Mine seem to work fine also using Ubuntu 16.04.1 on the servers and a
> separate workstation client. My /etc/krb5.conf files on the servers and
> clients are all simply:
>
> [libdefaults]
> default_realm = REALM.EXAMPLE.COM
> dns_lookup_realm = false
> dns_lookup_kdc = true
>
> Mike E.
>
>
> On Fri, Nov 4, 2016 at 4:10 PM, Kevr via samba <samba at
lists.samba.org>
> wrote:
>
> > Hi All
> >
> > Is this behaviour expected in smbclient:
> >
> > I have a kerberized Samba server and a share that works as expected on
> > desktop clients, but when I use smbclient with a valid ticket with the
-k
> > flag I get a KDC lookup failure
> >
> > kev at client:/home/testuser$ smbclient -k -L //fileserver
> > gss_init_sec_context failed with [ Miscellaneous failure (see text):
> > unable to reach any KDC in realm LAN]
> > SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed:
NT_STATUS_INTERNAL_ERROR
> > session setup failed: NT_STATUS_INTERNAL_ERROR
> >
> > I've noticed that if I configure the KDC server in the [realm]
section of
> > my /etc/krb5.conf everything works fine.
> >
> > Does smbclient not use the DNS for KDC lookup?
> >
> > I am using version Version 4.3.11-Ubuntu on Ubuntu 16.04.1
> >
> > Thanks
> >
> >
> >
> > Kevin Ratcliffe
> >
> > Sent from [ProtonMail](https://protonmail.ch)
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions: https://lists.samba.org/mailman/options/samba
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
>
>

I'm finding this a little odd as kinit seems to find the kdc okay, just
smbclient fails.

host -t srv _kerberos._udp.lan resolves okay too. Could it be that my realm is
simply LAN and dns suffix is lan be an issue? This is just a test set up in
virtual box for a writeup I'm doing, hence the nonstandard suffixes.



Kevin Ratcliffe

Sent from [ProtonMail](https://protonmail.ch)



-------- Original Message --------
Subject: Re: [Samba] smbclient and Kerberos
Local Time: 4 November 2016 9:11 PM
UTC Time: 4 November 2016 21:11
From: mike at datacontrolsystems.com
To: Kevr <kevr at protonmail.com>
samba at lists.samba.org


The defaults for dns_lookup_realm and dns_lookup_kdc should be false and true
respectively, but the samba team recommends using them explicitly, so that's
what I do. My /etc/krb5.conf file doesn't include any of the stock lines
included with the package from Ubuntu (which I believe is based on the MIT
version of kerberos). My file includes the four lines in the previous message
and only those four lines. Maybe something in the stock file causes the problem
you're seeing.?





Mike E.



On Fri, Nov 4, 2016 at 5:01 PM, Kevr <kevr at protonmail.com> wrote:

Hmmmm. I'm using the stock krb5.conf installed by apt-get. So basically all
I have is the default_realm set to my realm in [libdefaults]. I was under the
impression that dns_lookup_kdc was true by default. Am I wrong?




Kevin Ratcliffe

Sent from [ProtonMail](https://protonmail.ch)




-------- Original Message --------
Subject: Re: [Samba] smbclient and Kerberos
Local Time: 4 November 2016 8:48 PM
UTC Time: 4 November 2016 20:48
From: samba at lists.samba.org
To: Kevr <kevr at protonmail.com>
samba at lists.samba.org <samba at lists.samba.org>

Mine seem to work fine also using Ubuntu 16.04.1 on the servers and a
separate workstation client. My /etc/krb5.conf files on the servers and
clients are all simply:

[libdefaults]
default_realm = REALM.EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = true

Mike E.


On Fri, Nov 4, 2016 at 4:10 PM, Kevr via samba <samba at lists.samba.org>
wrote:
> Hi All
>
> Is this behaviour expected in smbclient:
>
> I have a kerberized Samba server and a share that works as expected on
> desktop clients, but when I use smbclient with a valid ticket with the -k
> flag I get a KDC lookup failure
>
> kev at client:/home/testuser$ smbclient -k -L //fileserver
> gss_init_sec_context failed with [ Miscellaneous failure (see text):
> unable to reach any KDC in realm LAN]
> SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed: NT_STATUS_INTERNAL_ERROR
> session setup failed: NT_STATUS_INTERNAL_ERROR
>
> I've noticed that if I configure the KDC server in the [realm] section
of
> my /etc/krb5.conf everything works fine.
>
> Does smbclient not use the DNS for KDC lookup?
>
> I am using version Version 4.3.11-Ubuntu on Ubuntu 16.04.1
>
> Thanks
>
>
>
> Kevin Ratcliffe
>
> Sent from [ProtonMail](https://protonmail.ch)
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba