samba - Jul 2018 - Failed to establish your Kerberos Ticket cache due time differences with the domain controller

Thanks Rowland.
> -----Original Message-----
> From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland
> Penny via samba
> Sent: 21 July 2018 18:04
> To: samba at lists.samba.org
> Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due
time
> differences with the domain controller
> 
> On Sat, 21 Jul 2018 17:36:14 +0100
> Roy Eastwood via samba <samba at lists.samba.org> wrote:
> 
> > >
> > > Try restarting Samba on 'debian-vb'.
> > > If this doesn't help, try 'samba-tool dbcheck' and
compare the two
> > > DC's with 'samba-tool ldapcmp'
> > >
> > > Rowland
> > >
> >
> > OK, have tried that but no change.   I used Louis'  script:
> > samba-check-db-repl.sh which includes samba-tool ldapcmp and
> > samba-tool drs showrepl it passes both tests.
> >
> > Roy
> >
> >
> 
> Did you run 'samba-tool dbcheck' ? Louis's script doesn't
do this.
> 
> Was this machine provisioned quite a few versions ago ? and then updated
> in place ?
> 'samba-tool time' was changed at sometime (cannot just when) and a
> python module was replaced, but 'make install' did not remove the
old
> python script. Check if you have:
> 
> '/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/time.py'
> 
> If you have, delete it.
> 
> Rowland
> 
Sorry, yes I ,meant to say, I ran samba-tool dbcheck and initially it threw up
some errors about deleted items (I had recently demoted a DC after the pi-dc was
joined) but these were repaired with the --fix option.   I tried the samba-tool
time commands afterwards with the same result.    I also had to clean up all the
DNS records as the demote command doesn't tidy things up properly.

Whist this is a new domain provision with v 4.8.3, the machine has had versions
going back to 4.7.4 compiled and installed (albeit with different domains).  I
used make uninstall on the last version of samba before installing 4.8.3 if that
makes any difference.   I checked for that time.py file and it's not in that
folder (or anywhere else according to find).

Roy

On Sat, 21 Jul 2018 18:30:48 +0100
Roy Eastwood via samba <samba at lists.samba.org> wrote:
> Thanks Rowland.
> 
> > -----Original Message-----
> > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of
> > Rowland Penny via samba
> > Sent: 21 July 2018 18:04
> > To: samba at lists.samba.org
> > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache
> > due time differences with the domain controller
> > 
> > On Sat, 21 Jul 2018 17:36:14 +0100
> > Roy Eastwood via samba <samba at lists.samba.org> wrote:
> > 
> > > >
> > > > Try restarting Samba on 'debian-vb'.
> > > > If this doesn't help, try 'samba-tool dbcheck'
and compare the
> > > > two DC's with 'samba-tool ldapcmp'
> > > >
> > > > Rowland
> > > >
> > >
> > > OK, have tried that but no change.   I used Louis'  script:
> > > samba-check-db-repl.sh which includes samba-tool ldapcmp and
> > > samba-tool drs showrepl it passes both tests.
> > >
> > > Roy
> > >
> > >
> > 
> > Did you run 'samba-tool dbcheck' ? Louis's script
doesn't do this.
> > 
> > Was this machine provisioned quite a few versions ago ? and then
> > updated in place ?
> > 'samba-tool time' was changed at sometime (cannot just when)
and a
> > python module was replaced, but 'make install' did not remove
the
> > old python script. Check if you have:
> > 
> >
'/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/time.py'
> > 
> > If you have, delete it.
> > 
> > Rowland
> > 
> Sorry, yes I ,meant to say, I ran samba-tool dbcheck and initially it
> threw up some errors about deleted items (I had recently demoted a DC
> after the pi-dc was joined) but these were repaired with the --fix
> option.   I tried the samba-tool time commands afterwards with the
> same result.    I also had to clean up all the DNS records as the
> demote command doesn't tidy things up properly.
> 
> Whist this is a new domain provision with v 4.8.3, the machine has
> had versions going back to 4.7.4 compiled and installed (albeit with
> different domains).  I used make uninstall on the last version of
> samba before installing 4.8.3 if that makes any difference.   I
> checked for that time.py file and it's not in that folder (or
> anywhere else according to find).
> 
> Roy
> 
> 
No, it wouldn't have been there, 4.7.4 isn't old enough.

When you built Samba, did you have all the correct packages installed,
see here:

https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Debian_.2F_Ubuntu

Is Apparmor installed, or a firewall ?

Rowland

On Sat, 21 Jul 2018 18:59:08 +0100
Rowland Penny via samba <samba at lists.samba.org> wrote:
> On Sat, 21 Jul 2018 18:30:48 +0100
> Roy Eastwood via samba <samba at lists.samba.org> wrote:
> 
> > Thanks Rowland.
> > 
> > > -----Original Message-----
> > > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf
Of
> > > Rowland Penny via samba
> > > Sent: 21 July 2018 18:04
> > > To: samba at lists.samba.org
> > > Subject: Re: [Samba] Failed to establish your Kerberos Ticket
> > > cache due time differences with the domain controller
> > > 
> > > On Sat, 21 Jul 2018 17:36:14 +0100
> > > Roy Eastwood via samba <samba at lists.samba.org> wrote:
> > > 
> > > > >
> > > > > Try restarting Samba on 'debian-vb'.
> > > > > If this doesn't help, try 'samba-tool
dbcheck' and compare the
> > > > > two DC's with 'samba-tool ldapcmp'
> > > > >
> > > > > Rowland
> > > > >
> > > >
> > > > OK, have tried that but no change.   I used Louis' 
script:
> > > > samba-check-db-repl.sh which includes samba-tool ldapcmp and
> > > > samba-tool drs showrepl it passes both tests.
> > > >
> > > > Roy
> > > >
> > > >
> > > 
> > > Did you run 'samba-tool dbcheck' ? Louis's script
doesn't do this.
> > > 
> > > Was this machine provisioned quite a few versions ago ? and then
> > > updated in place ?
> > > 'samba-tool time' was changed at sometime (cannot just
when) and a
> > > python module was replaced, but 'make install' did not
remove the
> > > old python script. Check if you have:
> > > 
> > >
'/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/time.py'
> > > 
> > > If you have, delete it.
> > > 
> > > Rowland
> > > 
> > Sorry, yes I ,meant to say, I ran samba-tool dbcheck and initially
> > it threw up some errors about deleted items (I had recently demoted
> > a DC after the pi-dc was joined) but these were repaired with the
> > --fix option.   I tried the samba-tool time commands afterwards
> > with the same result.    I also had to clean up all the DNS records
> > as the demote command doesn't tidy things up properly.
> > 
> > Whist this is a new domain provision with v 4.8.3, the machine has
> > had versions going back to 4.7.4 compiled and installed (albeit with
> > different domains).  I used make uninstall on the last version of
> > samba before installing 4.8.3 if that makes any difference.   I
> > checked for that time.py file and it's not in that folder (or
> > anywhere else according to find).
> > 
> > Roy
> > 
> > 
> 
> No, it wouldn't have been there, 4.7.4 isn't old enough.
> 
> When you built Samba, did you have all the correct packages installed,
> see here:
> 
>
https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Debian_.2F_Ubuntu
> 
> Is Apparmor installed, or a firewall ?
> 
> Rowland
> 
Another thought, could this be an authentication problem ? try adding
'-U Administrator' and see if this helps.

Rowland