thr3ads.net - samba - [Samba] Problems with Windind Authentication [Jun 2017]

If this information is useful, please help other people find it:
Share via:

Marcio Demetrio Bacci

2017-Jun-13 04:11 UTC

[Samba] Problems with Windind Authentication

Hi,

I have a File Server as Domain Member and it was working properly.

Recently I changed my DCs and after I am not getting authenticate users
with winbind.

I'm using Samba 4.6.3 as DC and Samba 4.1.17 as File Server.

When I restart Samba Service, this message appears:

root at dc1:/root# /etc/init.d/samba4 status
● samba4.service - LSB: start Samba4 daemons
   Loaded: loaded (/etc/init.d/samba4)
   Active: active (running) since Ter 2017-06-13 00:27:08 -03; 22min ago
  Process: 587 ExecStop=/etc/init.d/samba4 stop (code=exited,
status=0/SUCCESS)
  Process: 596 ExecStart=/etc/init.d/samba4 start (code=exited,
status=0/SUCCESS)
   CGroup: /system.slice/samba4.service
           ├─601 /usr/local/samba/sbin/samba -D
           ├─626 /usr/local/samba/sbin/samba -D
           ├─627 /usr/local/samba/sbin/samba -D
           ├─628 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─629 /usr/local/samba/sbin/samba -D
           ├─630 /usr/local/samba/sbin/samba -D
           ├─631 /usr/local/samba/sbin/samba -D
           ├─632 /usr/local/samba/sbin/samba -D
           ├─633 /usr/local/samba/sbin/samba -D
           ├─634 /usr/local/samba/sbin/samba -D
           ├─635 /usr/local/samba/sbin/samba -D
           ├─636 /usr/local/samba/sbin/samba -D
           ├─637 /usr/local/samba/sbin/samba -D
           ├─638 /usr/local/samba/sbin/samba -D
           ├─639 /usr/local/samba/sbin/samba -D
           ├─640 /usr/local/samba/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           ├─643 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─644 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─645 /usr/local/samba/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           ├─647 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─674 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─675 /usr/local/samba/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           ├─677 /usr/local/samba/sbin/samba -D
           ├─751 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           └─753 /usr/local/samba/sbin/samba -D

Jun 13 00:27:08 dc1 samba[601]: [2017/06/13 00:27:08.916883,  0]
../source4/smbd/server.c:487(binary_smbd_main)
Jun 13 00:27:08 dc1 samba[601]: samba: using 'standard' process model
Jun 13 00:27:08 dc1 samba[601]: [2017/06/13 00:27:08.932572,  0]
../lib/util/become_daemon.c:124(daemon_ready)
Jun 13 00:27:08 dc1 samba[601]: STATUS=daemon 'samba' finished starting
up
and ready to serve connections
Jun 13 00:27:08 dc1 winbindd[640]: [2017/06/13 00:27:08.995026,  0]
../source3/winbindd/winbindd_cache.c:3171(initialize_winbindd_cache)
Jun 13 00:27:08 dc1 winbindd[640]: initialize_winbindd_cache: clearing
cache and re-creating with version number 2
Jun 13 00:27:09 dc1 winbindd[640]: [2017/06/13 00:27:09.356050,  0]
../lib/util/become_daemon.c:124(daemon_ready)
Jun 13 00:27:09 dc1 winbindd[640]: STATUS=daemon 'winbindd' finished
starting up and ready to serve connections
Jun 13 00:27:09 dc1 smbd[628]: [2017/06/13 00:27:09.396000,  0]
../lib/util/become_daemon.c:124(daemon_ready)
Jun 13 00:27:09 dc1 smbd[628]: STATUS=daemon 'smbd' finished starting up
and ready to serve connections

Is it a problem?

Regards,

Márcio Bacci

Rowland Penny

2017-Jun-13 09:06 UTC

head link

[Samba] Problems with Windind Authentication

On Tue, 13 Jun 2017 01:11:04 -0300
Marcio Demetrio Bacci via samba <samba at lists.samba.org> wrote:
> Hi,
> 
> I have a File Server as Domain Member and it was working properly.
> 
> Recently I changed my DCs and after I am not getting authenticate
> users with winbind.
> 
> I'm using Samba 4.6.3 as DC and Samba 4.1.17 as File Server.
> 
> When I restart Samba Service, this message appears:
> 
> root at dc1:/root# /etc/init.d/samba4 status
> ● samba4.service - LSB: start Samba4 daemons
>    Loaded: loaded (/etc/init.d/samba4)
>    Active: active (running) since Ter 2017-06-13 00:27:08 -03; 22min
> ago Process: 587 ExecStop=/etc/init.d/samba4 stop (code=exited,
> status=0/SUCCESS)
>   Process: 596 ExecStart=/etc/init.d/samba4 start (code=exited,
> status=0/SUCCESS)
>    CGroup: /system.slice/samba4.service
>            ├─601 /usr/local/samba/sbin/samba -D
>            ├─626 /usr/local/samba/sbin/samba -D
>            ├─627 /usr/local/samba/sbin/samba -D
>            ├─628 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            ├─629 /usr/local/samba/sbin/samba -D
>            ├─630 /usr/local/samba/sbin/samba -D
>            ├─631 /usr/local/samba/sbin/samba -D
>            ├─632 /usr/local/samba/sbin/samba -D
>            ├─633 /usr/local/samba/sbin/samba -D
>            ├─634 /usr/local/samba/sbin/samba -D
>            ├─635 /usr/local/samba/sbin/samba -D
>            ├─636 /usr/local/samba/sbin/samba -D
>            ├─637 /usr/local/samba/sbin/samba -D
>            ├─638 /usr/local/samba/sbin/samba -D
>            ├─639 /usr/local/samba/sbin/samba -D
>            ├─640 /usr/local/samba/sbin/winbindd -D --option=server
> role check:inhibit=yes --foreground
>            ├─643 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            ├─644 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            ├─645 /usr/local/samba/sbin/winbindd -D --option=server
> role check:inhibit=yes --foreground
>            ├─647 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            ├─674 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            ├─675 /usr/local/samba/sbin/winbindd -D --option=server
> role check:inhibit=yes --foreground
>            ├─677 /usr/local/samba/sbin/samba -D
>            ├─751 /usr/local/samba/sbin/smbd -D --option=server role
> check:inhibit=yes --foreground
>            └─753 /usr/local/samba/sbin/samba -D
> 
> Jun 13 00:27:08 dc1 samba[601]: [2017/06/13 00:27:08.916883,  0]
> ../source4/smbd/server.c:487(binary_smbd_main)
> Jun 13 00:27:08 dc1 samba[601]: samba: using 'standard' process
model
> Jun 13 00:27:08 dc1 samba[601]: [2017/06/13 00:27:08.932572,  0]
> ../lib/util/become_daemon.c:124(daemon_ready)
> Jun 13 00:27:08 dc1 samba[601]: STATUS=daemon 'samba' finished
> starting up and ready to serve connections
> Jun 13 00:27:08 dc1 winbindd[640]: [2017/06/13 00:27:08.995026,  0]
> ../source3/winbindd/winbindd_cache.c:3171(initialize_winbindd_cache)
> Jun 13 00:27:08 dc1 winbindd[640]: initialize_winbindd_cache: clearing
> cache and re-creating with version number 2
> Jun 13 00:27:09 dc1 winbindd[640]: [2017/06/13 00:27:09.356050,  0]
> ../lib/util/become_daemon.c:124(daemon_ready)
> Jun 13 00:27:09 dc1 winbindd[640]: STATUS=daemon 'winbindd'
finished
> starting up and ready to serve connections
> Jun 13 00:27:09 dc1 smbd[628]: [2017/06/13 00:27:09.396000,  0]
> ../lib/util/become_daemon.c:124(daemon_ready)
> Jun 13 00:27:09 dc1 smbd[628]: STATUS=daemon 'smbd' finished
starting
> up and ready to serve connections
> 
> Is it a problem?
> 
> Regards,
> 
> Márcio Bacci
There doesn't appear to be anything wrong, so where are not get users
authenticated, on the DC, or on the fileserver, or both ?

Can you post the smb.conf files from both machines.

Rowland

Rowland Penny

2017-Jun-13 20:22 UTC

head link

[Samba] Problems with Windind Authentication

On Tue, 13 Jun 2017 17:00:10 -0300
Marcio Demetrio Bacci <marciobacci at gmail.com> wrote:
> Hi,
> 
> When I run the command line *wbinfo -a user* I get the following
> result:
> 
> root at filserver:~# wbinfo -a mane
> Enter mane's password:
> plaintext password authentication succeeded
> Enter mane's password:
> challenge/response password authentication failed
> error code was NT_STATUS_WRONG_PASSWORD (0xc000006a)
> error message was: Wrong Password
> Could not authenticate user mane with challenge/response
> 
> However the password is correct.
> 
> File server users can not access SMB shares.
> 
> This is my smb.conf and nsswitch of the File Server:
> 
> ##########################################################
> [global]
>   netbios name = fileserver
>   workgroup = EMPRESA
>   security = ads
>   realm = EMPRESA.COM.BR
>   encrypt passwords = yes
>   dedicated keytab file = /etc/krb5.keytab
>   kerberos method = secrets and keytab
>   preferred master = no
>   idmap config *:backend = tdb
>   idmap config *:range = 1000-3000
>   idmap config EMPRESA:backend = ad
>   idmap config EMPRESA:schema_mode = rfc2307
>   idmap config EMPRESA:range = 10000-9999999
> 
>   winbind nss info = rfc2307
>   winbind trusted domains only = no
>   winbind use default domain = yes
>   winbind enum users = yes
>   winbind enum groups = yes
>   winbind refresh tickets = yes
> 
>   vfs objects = acl_xattr
>   map acl inherit = Yes
>   store dos attributes = Yes
>   username map = /etc/samba/user.map
> 
What OS is this ?
Is there anything like an auth.log on the DC ?
If so, is there anything in it ?

Rowland

Possibly Parallel Threads

Search for more apparently analagous threads

samba - Jun 2017 - Problems with Windind Authentication

[Samba] Problems with Windind Authentication

[Samba] Problems with Windind Authentication

[Samba] Problems with Windind Authentication

Possibly Parallel Threads