samba - Feb 2017 - samba-tool domain classicupgrade smb_krb5_context_init_basic failed (Invalid argument)

Hi,

I'm having trouble with the classic upgrade. We have three samba servers:

Server1: CentOS 5/Samba 3.6 (with smbldap-tools)
Server2: CentOS 6/Samba Version 4.2.14-SerNet-RedHat-23.el6
Server3: CentOS 7/Samba Version 4.2.14-SerNet-RedHat-23.el7

Server 1: CentOS 5/Samba 3.6 (with smbldap-tools)
Serves our OpenLDAP backend for centralised authentication (LDAP replicated to
two other servers for
redundancy) and hosts all our Shares.

Server 2: CentOS 6/Samba Version 4.2.14-SerNet-RedHat-23.el6
Provisioned as an AD domain (samba-tool domain provision). This was not done as
a classicupgrade but
was meant to eventually take over the roll of the Server1. Currently it serves
our DNS using the
BIND9_DLZ plugin.

Server3: CentOS 7/Samba Version 4.2.14-SerNet-RedHat-23.el7
We're now looking to move to a domain and I thought I may as well test the
classicupgrade on CentOS
using the same version of sernet as on Server 2 but there's an issue.

# samba-tool domain classicupgrade --debuglevel=3 --dbdir
/var/lib/samba/bentley/ --use-xattrs=yes
--realm=mrc.motec.com.au --dns-backend=BIND9_DLZ /etc/samba/smb.bentley.conf
Reading smb.conf
lp_load_ex: refreshing parameters
Initialising global parameters
...
---8<---
...
Next rid = 13001
krb5_init_context failed (Invalid argument)
smb_krb5_context_init_basic failed (Invalid argument)
#

Is this a CentOS 6/7 difference issue or is the classicupgrade broken for Samba
Version
4.2.14-SerNet? Any help is appreciated.

Kind regards,
Tom

-- 

Tom Robinson
IT Manager/System Administrator

MoTeC Pty Ltd

121 Merrindale Drive
Croydon South
3136 Victoria
Australia

T: +61 3 9761 5050
F: +61 3 9761 5051   
E: tom.robinson at motec.com.au


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20170207/439160a8/signature.sig>

On Tue, 2017-02-07 at 15:58 +1100, Tom Robinson via samba
wrote:
> Hi,
> \
> Next rid = 13001
> krb5_init_context failed (Invalid argument)
> smb_krb5_context_init_basic failed (Invalid argument)
> #
> 
> Is this a CentOS 6/7 difference issue or is the classicupgrade broken
> for Samba Version
> 4.2.14-SerNet? Any help is appreciated.
Remove the include lines from the krb5.conf, our internal Heimdal
doesn't understand them.

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

On 07/02/17 17:01, Andrew Bartlett via samba wrote:
> On Tue, 2017-02-07 at 15:58 +1100, Tom Robinson via samba wrote:
>> Hi,
>> \
>> Next rid = 13001
>> krb5_init_context failed (Invalid argument)
>> smb_krb5_context_init_basic failed (Invalid argument)
>> #
>>
>> Is this a CentOS 6/7 difference issue or is the classicupgrade broken
>> for Samba Version
>> 4.2.14-SerNet? Any help is appreciated.
> 
> Remove the include lines from the krb5.conf, our internal Heimdal
> doesn't understand them.
> 
Thanks Andrew. I've taken that line out but now I just get Segmentation
fault. :-/

I also took a more extreme step of moving /etc/krb5.conf and
/etc/krb5.conf.d out of /etc but samba-tool still seg faults.

Is it anything to do with the groups it's complaining about below?

# samba-tool domain classicupgrade --debuglevel=0 --dbdir
/var/lib/samba/bentley/ --use-xattrs=yes --realm=mrc.motec.com.au
--dns-backend=BIND9_DLZ /etc/samba/smb.bentley.conf
Reading smb.conf
Unknown parameter encountered: "share modes"
Ignoring unknown parameter "share modes"
Provisioning
Exporting account policy
Exporting groups
Ignoring group 'Administrators' S-1-5-32-544 listed but then not found:
Unable to enumerate members for alias, (-1073741487,The specified local
group does not exist.)
Ignoring group 'Account Operators' S-1-5-32-548 listed but then not
found: Unable to enumerate members for alias, (-1073741487,The specified
local group does not exist.)
Ignoring group 'Print Operators' S-1-5-32-550 listed but then not found:
Unable to enumerate members for alias, (-1073741487,The specified local
group does not exist.)
Ignoring group 'Backup Operators' S-1-5-32-551 listed but then not
found: Unable to enumerate members for alias, (-1073741487,The specified
local group does not exist.)
Ignoring group 'Replicators' S-1-5-32-552 listed but then not found:
Unable to enumerate members for alias, (-1073741487,The specified local
group does not exist.)
Exporting users
  Skipping wellknown rid=500 (for username=root)
Next rid = 13001
Segmentation fault

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20170207/281c0f0c/signature.sig>