Victor Buciuc
2017-May-25 00:02 UTC
[Samba] Windows 2012 s4u2self followed by s4u2proxy fails against samba
Hi, I hit the issue described in this thread https://groups.google.com/forum/#!topic/linux.samba/VfjW9Af92Wg while testing out s4u2self and s4u2proxy in a windows service, so I wanted to share my setup. So I wrote a small windows service that's running as a local system account to impersonate an user via s4u2self (using LsaLogonUser in win32 api than calling ImpersonateLoggedOnUser) and then access a file on a shared disk. The file access fails with an "The user name or password is incorrect." exception in samba log I get: [2017/05/24 22:07:39.010245, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper) Kerberos: Failed to decrypt enc-authorization-data looking at wireshark captures I can see the s4u2proxy request failing S4U2Self Request Frame 55: 1415 bytes on wire (11320 bits), 1415 bytes captured (11320 bits) on interface 0 Interface id: 0 (\Device\NPF_{9B09F445-BC1D-4740-B31B-2DB084D5FEBD}) Encapsulation type: Ethernet (1) Arrival Time: May 24, 2017 23:21:29.206358000 Coordinated Universal Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1495668089.206358000 seconds [Time delta from previous captured frame: 0.000053000 seconds] [Time delta from previous displayed frame: 0.000053000 seconds] [Time since reference or first frame: 4.793855000 seconds] Frame Number: 55 Frame Length: 1415 bytes (11320 bits) Capture Length: 1415 bytes (11320 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:kerberos] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: PcsCompu_d8:25:31 (08:00:27:d8:25:31), Dst: RealtekU_12:35:02 (52:54:00:12:35:02) Destination: RealtekU_12:35:02 (52:54:00:12:35:02) Address: RealtekU_12:35:02 (52:54:00:12:35:02) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Address: PcsCompu_d8:25:31 (08:00:27:d8:25:31) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 10.0.2.15, Dst: 192.168.50.4 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1401 Identification: 0x0483 (1155) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (6) Header checksum: 0x0000 [validation disabled] [Header checksum status: Unverified] Source: 10.0.2.15 Destination: 192.168.50.4 [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: 50602, Dst Port: 88, Seq: 1, Ack: 1, Len: 1361 Source Port: 50602 Destination Port: 88 [Stream index: 4] [TCP Segment Len: 1361] Sequence number: 1 (relative sequence number) [Next sequence number: 1362 (relative sequence number)] Acknowledgment number: 1 (relative ack number) Header Length: 20 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 64240 [Calculated window size: 64240] [Window size scaling factor: -2 (no window scaling used)] Checksum: 0x0427 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 [SEQ/ACK analysis] [iRTT: 0.000305000 seconds] [Bytes in flight: 1361] [Bytes sent since last PSH flag: 1361] [PDU Size: 1361] Kerberos Record Mark: 1357 bytes 0... .... .... .... .... .... .... .... = Reserved: Not set .000 0000 0000 0000 0000 0101 0100 1101 = Record Length: 1357 tgs-req pvno: 5 msg-type: krb-tgs-req (12) padata: 2 items PA-DATA PA-TGS-REQ padata-type: kRB5-PADATA-TGS-REQ (1) padata-value: 6e8204603082045ca003020105a10302010ea20703050000... ap-req pvno: 5 msg-type: krb-ap-req (14) Padding: 0 ap-options: 00000000 0... .... = reserved: False .0.. .... = use-session-key: False ..0. .... = mutual-required: False ticket tkt-vno: 5 realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-SRV-INST (2) sname-string: 2 items SNameString: krbtgt SNameString: TESTDOMAIN.LAN enc-part etype: eTYPE-AES256-CTS-HMAC-SHA1-96 (18) kvno: 1 cipher: 133e0664961c5a187dc796b60203ab38d8049d5346a6e477... authenticator etype: eTYPE-ARCFOUR-HMAC-MD5 (23) cipher: 9e090b164f219fca6776b32ea7b815944521218daf5b4879... PA-DATA PA-FOR-USER padata-type: kRB5-PADATA-S4U2SELF (129) padata-value: 3052a0143012a00302010aa10b30091b0776627563697563... name name-type: kRB5-NT-ENTERPRISE-PRINCIPAL (10) name-string: 1 item KerberosString: vbuciuc realm: TESTDOMAIN.LAN cksum cksumtype: cKSUMTYPE-HMAC-MD5 (-138) checksum: f38a86cc453a82891d7c3a8e73906873 auth: Kerberos req-body Padding: 0 kdc-options: 40810000 (forwardable, renewable, canonicalize) 0... .... = reserved: False .1.. .... = forwardable: True ..0. .... = forwarded: False ...0 .... = proxiable: False .... 0... = proxy: False .... .0.. = allow-postdate: False .... ..0. = postdated: False .... ...0 = unused7: False 1... .... = renewable: True .0.. .... = unused9: False ..0. .... = unused10: False ...0 .... = opt-hardware-auth: False .... ..0. = request-anonymous: False .... ...1 = canonicalize: True 0... .... = constrained-delegation: False ..0. .... = disable-transited-check: False ...0 .... = renewable-ok: False .... 0... = enc-tkt-in-skey: False .... ..0. = renew: False .... ...0 = validate: False realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-PRINCIPAL (1) sname-string: 1 item SNameString: client$ till: 2017-05-24 23:36:29 (UTC) nonce: 2037634744 etype: 3 items ENCTYPE: eTYPE-ARCFOUR-HMAC-MD5 (23) ENCTYPE: eTYPE-ARCFOUR-HMAC-MD5-56 (24) ENCTYPE: eTYPE-ARCFOUR-HMAC-OLD-EXP (-135) Response: Frame 57: 1308 bytes on wire (10464 bits), 1308 bytes captured (10464 bits) on interface 0 Interface id: 0 (\Device\NPF_{9B09F445-BC1D-4740-B31B-2DB084D5FEBD}) Encapsulation type: Ethernet (1) Arrival Time: May 24, 2017 23:21:29.212039000 Coordinated Universal Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1495668089.212039000 seconds [Time delta from previous captured frame: 0.005593000 seconds] [Time delta from previous displayed frame: 0.005593000 seconds] [Time since reference or first frame: 4.799536000 seconds] Frame Number: 57 Frame Length: 1308 bytes (10464 bits) Capture Length: 1308 bytes (10464 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:kerberos] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: RealtekU_12:35:02 (52:54:00:12:35:02), Dst: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Destination: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Address: PcsCompu_d8:25:31 (08:00:27:d8:25:31) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: RealtekU_12:35:02 (52:54:00:12:35:02) Address: RealtekU_12:35:02 (52:54:00:12:35:02) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.50.4, Dst: 10.0.2.15 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1294 Identification: 0x48a8 (18600) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x2e87 [validation disabled] [Header checksum status: Unverified] Source: 192.168.50.4 Destination: 10.0.2.15 [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: 88, Dst Port: 50602, Seq: 1, Ack: 1362, Len: 1254 Source Port: 88 Destination Port: 50602 [Stream index: 4] [TCP Segment Len: 1254] Sequence number: 1 (relative sequence number) [Next sequence number: 1255 (relative sequence number)] Acknowledgment number: 1362 (relative ack number) Header Length: 20 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 65535 [Calculated window size: 65535] [Window size scaling factor: -2 (no window scaling used)] Checksum: 0xd5d8 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 [SEQ/ACK analysis] [iRTT: 0.000305000 seconds] [Bytes in flight: 1254] [Bytes sent since last PSH flag: 1254] [PDU Size: 1254] Kerberos Record Mark: 1250 bytes 0... .... .... .... .... .... .... .... = Reserved: Not set .000 0000 0000 0000 0000 0100 1110 0010 = Record Length: 1250 tgs-rep pvno: 5 msg-type: krb-tgs-rep (13) crealm: TESTDOMAIN.LAN cname name-type: kRB5-NT-ENTERPRISE-PRINCIPAL (10) cname-string: 1 item CNameString: vbuciuc ticket tkt-vno: 5 realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-PRINCIPAL (1) sname-string: 1 item SNameString: client$ enc-part etype: eTYPE-ARCFOUR-HMAC-MD5 (23) kvno: 2 cipher: c0143bc2bc8b66aad128b507dee2ecf0f550179d65db208d... enc-part etype: eTYPE-ARCFOUR-HMAC-MD5 (23) cipher: 8db3b981ecf31105c05a8e687d6b23572a91295e2133c43d... Proxy request: Frame 65: 2456 bytes on wire (19648 bits), 2456 bytes captured (19648 bits) on interface 0 Interface id: 0 (\Device\NPF_{9B09F445-BC1D-4740-B31B-2DB084D5FEBD}) Encapsulation type: Ethernet (1) Arrival Time: May 24, 2017 23:21:29.251646000 Coordinated Universal Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1495668089.251646000 seconds [Time delta from previous captured frame: 0.000054000 seconds] [Time delta from previous displayed frame: 0.000054000 seconds] [Time since reference or first frame: 4.839143000 seconds] Frame Number: 65 Frame Length: 2456 bytes (19648 bits) Capture Length: 2456 bytes (19648 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:kerberos] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: PcsCompu_d8:25:31 (08:00:27:d8:25:31), Dst: RealtekU_12:35:02 (52:54:00:12:35:02) Destination: RealtekU_12:35:02 (52:54:00:12:35:02) Address: RealtekU_12:35:02 (52:54:00:12:35:02) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Address: PcsCompu_d8:25:31 (08:00:27:d8:25:31) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 10.0.2.15, Dst: 192.168.50.4 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 2442 Identification: 0x0488 (1160) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (6) Header checksum: 0x0000 [validation disabled] [Header checksum status: Unverified] Source: 10.0.2.15 Destination: 192.168.50.4 [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: 50603, Dst Port: 88, Seq: 1, Ack: 1, Len: 2402 Source Port: 50603 Destination Port: 88 [Stream index: 5] [TCP Segment Len: 2402] Sequence number: 1 (relative sequence number) [Next sequence number: 2403 (relative sequence number)] Acknowledgment number: 1 (relative ack number) Header Length: 20 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 64240 [Calculated window size: 64240] [Window size scaling factor: -2 (no window scaling used)] Checksum: 0xfec1 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 [SEQ/ACK analysis] [iRTT: 0.000360000 seconds] [Bytes in flight: 2402] [Bytes sent since last PSH flag: 2402] [PDU Size: 2402] Kerberos Record Mark: 2398 bytes 0... .... .... .... .... .... .... .... = Reserved: Not set .000 0000 0000 0000 0000 1001 0101 1110 = Record Length: 2398 tgs-req pvno: 5 msg-type: krb-tgs-req (12) padata: 2 items PA-DATA PA-TGS-REQ padata-type: kRB5-PADATA-TGS-REQ (1) padata-value: 6e8204603082045ca003020105a10302010ea20703050000... ap-req pvno: 5 msg-type: krb-ap-req (14) Padding: 0 ap-options: 00000000 0... .... = reserved: False .0.. .... = use-session-key: False ..0. .... = mutual-required: False ticket tkt-vno: 5 realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-SRV-INST (2) sname-string: 2 items SNameString: krbtgt SNameString: TESTDOMAIN.LAN enc-part etype: eTYPE-AES256-CTS-HMAC-SHA1-96 (18) kvno: 1 cipher: 133e0664961c5a187dc796b60203ab38d8049d5346a6e477... authenticator etype: eTYPE-ARCFOUR-HMAC-MD5 (23) cipher: 5b3b67f7ec0fab232a37a0041d6a0df24aa92f8a186c726a... PA-DATA Unknown:167 padata-type: Unknown (167) padata-value: 3009a00703050010000000 req-body Padding: 0 kdc-options: 40830000 (forwardable, renewable, request-anonymous, canonicalize) 0... .... = reserved: False .1.. .... = forwardable: True ..0. .... = forwarded: False ...0 .... = proxiable: False .... 0... = proxy: False .... .0.. = allow-postdate: False .... ..0. = postdated: False .... ...0 = unused7: False 1... .... = renewable: True .0.. .... = unused9: False ..0. .... = unused10: False ...0 .... = opt-hardware-auth: False .... ..1. = request-anonymous: True .... ...1 = canonicalize: True 0... .... = constrained-delegation: False ..0. .... = disable-transited-check: False ...0 .... = renewable-ok: False .... 0... = enc-tkt-in-skey: False .... ..0. = renew: False .... ...0 = validate: False realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-SRV-INST (2) sname-string: 2 items SNameString: cifs SNameString: share till: 2017-05-24 23:36:29 (UTC) nonce: 2038090178 etype: 3 items ENCTYPE: eTYPE-ARCFOUR-HMAC-MD5 (23) ENCTYPE: eTYPE-ARCFOUR-HMAC-MD5-56 (24) ENCTYPE: eTYPE-ARCFOUR-HMAC-OLD-EXP (-135) enc-authorization-data etype: eTYPE-ARCFOUR-HMAC-MD5 (23) cipher: 01353b269f83c12d7f8bce1caeac238b6ef8daf6970ba2b9... additional-tickets: 1 item Ticket tkt-vno: 5 realm: TESTDOMAIN.LAN sname name-type: kRB5-NT-PRINCIPAL (1) sname-string: 1 item SNameString: client$ enc-part etype: eTYPE-ARCFOUR-HMAC-MD5 (23) kvno: 2 cipher: c0143bc2bc8b66aad128b507dee2ecf0f550179d65db208d... Response: Frame 68: 164 bytes on wire (1312 bits), 164 bytes captured (1312 bits) on interface 0 Interface id: 0 (\Device\NPF_{9B09F445-BC1D-4740-B31B-2DB084D5FEBD}) Encapsulation type: Ethernet (1) Arrival Time: May 24, 2017 23:21:29.253054000 Coordinated Universal Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1495668089.253054000 seconds [Time delta from previous captured frame: 0.001327000 seconds] [Time delta from previous displayed frame: 0.001327000 seconds] [Time since reference or first frame: 4.840551000 seconds] Frame Number: 68 Frame Length: 164 bytes (1312 bits) Capture Length: 164 bytes (1312 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:kerberos] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: RealtekU_12:35:02 (52:54:00:12:35:02), Dst: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Destination: PcsCompu_d8:25:31 (08:00:27:d8:25:31) Address: PcsCompu_d8:25:31 (08:00:27:d8:25:31) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: RealtekU_12:35:02 (52:54:00:12:35:02) Address: RealtekU_12:35:02 (52:54:00:12:35:02) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.50.4, Dst: 10.0.2.15 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 150 Identification: 0x48ae (18606) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x32f9 [validation disabled] [Header checksum status: Unverified] Source: 192.168.50.4 Destination: 10.0.2.15 [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: 88, Dst Port: 50603, Seq: 1, Ack: 2403, Len: 110 Source Port: 88 Destination Port: 50603 [Stream index: 5] [TCP Segment Len: 110] Sequence number: 1 (relative sequence number) [Next sequence number: 111 (relative sequence number)] Acknowledgment number: 2403 (relative ack number) Header Length: 20 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 65535 [Calculated window size: 65535] [Window size scaling factor: -2 (no window scaling used)] Checksum: 0xc1ad [unverified] [Checksum Status: Unverified] Urgent pointer: 0 [SEQ/ACK analysis] [iRTT: 0.000360000 seconds] [Bytes in flight: 110] [Bytes sent since last PSH flag: 110] [PDU Size: 110] Kerberos Record Mark: 106 bytes 0... .... .... .... .... .... .... .... = Reserved: Not set .000 0000 0000 0000 0000 0000 0110 1010 = Record Length: 106 krb-error pvno: 5 msg-type: krb-error (30) ctime: 2017-05-24 23:21:29 (UTC) cusec: 550 stime: 2017-05-24 23:21:36 (UTC) susec: 951725 error-code: eRR-BAD-INTEGRITY (31) realm: <unspecified realm> sname name-type: kRB5-NT-UNKNOWN (0) sname-string: 0 items Regards, Victor Buciuc
Seemingly Similar Threads
- kerberos issue (SPN not found) with windows Hyper-V ( samba 4.5.3 AD)
- kerberos issue (SPN not found) with windows Hyper-V ( samba 4.5.3 AD)
- Domain trust and browsing users and groups problem
- kerberos issue (SPN not found) with windows Hyper-V ( samba 4.5.3 AD)
- kerberos issue (SPN not found) with windows Hyper-V (samba 4.5.3 AD)