samba - Feb 2002 - challenge/response password authentication failed

hi,

I'm having troubles joining a win2k domain with samba 2.2.3a. As you can
see below I always get a 'challenge/response password authentication
failed'
when trying to authenticate(. I searched the mailinglist but can't find a
solution.
After 3 days of searching i'm still stuck :( I'd appreciate any pointers
you
could give me.


- On the W2k PDC I created a computer account (name:LINUX) the
'Allow Pre-windows 2000 computer to use this account' checked
- I joined the domain
smbpasswd -r NT2000 -j CEREUSBE
2002/02/28 10:15:59 : change_trust_account_password: Changed password for
domain CEREUSBE.
Joined domain CEREUSBE.

wbinfo -u show a domain grouplisting
CEREUSBE+TemplateCursisten
CEREUSBE+testje
CEREUSBE+testusr
CEREUSBE+Thierry
CEREUSBE+TLuijbregts
CEREUSBE+travelcomp
CEREUSBE+TsInternetUser
CEREUSBE+tvermetten
CEREUSBE+TWillaert
CEREUSBE+VBrepoels
CEREUSBE+vdb213775
CEREUSBE+Walter
CEREUSBE+Wim
CEREUSBE+WIwens
CEREUSBE+wvalgaeren

So far so good ;)

I then try to authenticate a domain user using wbinfo:

wbinfo -a CEREUSBE+LVHoeylandt%LVHoeylandt
plaintext password authentication succeeded
challenge/response password authentication failed
Could not authenticate user CEREUSBE+LVHoeylandt%LVHoeylandt with
challenge/response

smb.conf contents:

[global]
        workgroup = CEREUSBE
        security = domain
        encrypt passwords = Yes
        password server = NT2000.cereus.be
        keepalive = 30
        os level = 33
        local master = No
        domain master = False
        winbind uid = 10000-20000
        winbind gid = 10000-20000
        template shell = /bin/bash
        winbind separator = +


Any ideas how to solve this problem ?

Thanks,

Luc

Luc Van Hoeylandt wrote:
> 
> hi,
> 
> I'm having troubles joining a win2k domain with samba 2.2.3a. As you
can
> see below I always get a 'challenge/response password authentication
failed'
> when trying to authenticate(. I searched the mailinglist but can't find
a
> solution.
> After 3 days of searching i'm still stuck :( I'd appreciate any
pointers you
> could give me.
As long as the 'plaintext' version works, its fine.  Samba 2.2 has this
feature disabled for security reasons.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net