thr3ads.net - samba - [Samba] Debian Stable Samba 3.0.5 to 3.0.6 upgrade

If this information is useful, please help other people find it:
Share via:
Josh T
2004-Aug-30 14:51 UTC
[Samba] Debian Stable Samba 3.0.5 to 3.0.6 upgrade - broke my config?

I upgraded Samba from 3.0.5 to 3.0.6 using apt & the Debian Stable 
binary packages on samba.org.  Samba server was a member server for a 
Windows 2000 AD domain.  Since then, I have been having problems 
connecting to it by name (\\TERABYTE) - ip address works fine, but by 
name I'm prompted for a username/password and nothing works.  I'm 
guessing this is a Kerberos problem, and either the upgrade broke 
something with it or possibly exposed a flaw in my configuration?

On the Samba server:
kinit user@MYDOMAIN.local --works
smbclient -k //dc1/c$ -- works, where DC1 is a Windows 2000 Server 
Domain Controller
smbclient -k //workstation/c$ -- works, where workstation are either XP 
SP2 Pro or 2000 SP4, or seems any Windows PC in the domain
smbclient -k //terabyte/disk1 -- fails with
	session setup failed: NT_STATUS_LOGON_FAILURE
smbclient -U user //terabyte/disk1 -- prompts for password & then works

As far as I can tell - wbinfo -t, net ads testjoin, getent passwd are 
giving the same expected results they always have.

Under Windows XP, using klist.exe (from Server 2003 Resource Kit), if 
"klist tickets" show cached tickets for the Samba server, I can use 
"klist purge" and purge all tickets, then I am able to access the
Samba
server by name as normal with no prompts for a while, until Xp decides 
to use Kerberos again - "klist tickets" will report no tickets for a 
while.  Under Windows 2000, using klist from the Server 2000 RK, this 
doesn't work - after "klist purge" I'm still prompted for the
passord
and "klist tickets" shows two tickets:

    Server: krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
       KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
       End Time: 8/30/2004 20:24:18
       Renew Time: 9/6/2004 10:24:18

    Server: terabyte$@MYDOMAIN.LOCAL
       KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
       End Time: 8/30/2004 20:24:18
       Renew Time: 9/6/2004 10:24:18

I've been fiddling the krb5.conf file without any luck - Debian stable 
uses version "1.2.4-5woody5" for package "libkrb53."  There
seem to be
encryption related error messages in the samba logs - such as this from 
a Windows 2000 client failing to connect:

[2004/08/30 10:30:20, 3] 
libads/kerberos_verify.c:ads_secrets_verify_ticket(193)
   ads_secrets_verify_ticket: enc type [3] failed to decrypt with error 
Program lacks support for encryption type
[2004/08/30 10:30:20, 3] libads/kerberos_verify.c:ads_verify_ticket(307)
   ads_verify_ticket: krb5_rd_req with auth failed (Success)
[2004/08/30 10:30:20, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
   Failed to verify incoming ticket!
[2004/08/30 10:30:20, 3] smbd/error.c:error_packet(105)
   error string = No such file or directory
[2004/08/30 10:30:20, 3] smbd/error.c:error_packet(129)
   error packet at smbd/sesssetup.c(174) cmd=115 (SMBsesssetupX) 
NT_STATUS_LOGON_FAILURE

If anyone can provide some insight into what's going wrong, I'd greatly 
appreciate it.

Thanks,
Josh


### output of testparm ###
# Global parameters
[global]
         workgroup = MYDOMAIN
         realm = MYDOMAIN.LOCAL
         server string = %h server (Samba %v)
         security = ADS
         obey pam restrictions = Yes
         password server = DC1 DC2
         passwd program = /usr/bin/passwd %u
         passwd chat = *Enter\snew\sUNIX\spassword:* %n\n 
*Retype\snew\sUNIX\spassword:* %n\n .
         lanman auth = No
         ntlm auth = No
         client NTLMv2 auth = Yes
         client lanman auth = No
         client plaintext auth = No
         log level = 3
         syslog = 0
         log file = /var/log/samba/log.%m
         max log size = 1000
         dns proxy = No
         wins server = 192.168.100.8
         ldap ssl = no
         panic action = /usr/share/samba/panic-action %d
         idmap uid = 10000-20000
         idmap gid = 10000-20000
         template homedir = /home/%D
         winbind separator = +
         invalid users = root
         hosts allow = 192.168.100., 127.

[Disk1]
         comment = Data Storage Disk 1
         path = /mnt/disk1
         valid users = "@MYDOMAIN+Domain Admins"
         admin users = "@MYDOMAIN+Domain Admins"
         read only = No

### /etc/krb5.conf ###
[libdefaults]
         default_realm = MYDOMAIN.LOCAL

# The following krb5.conf variables are only for MIT Kerberos.
         default_tgs_enctypes = rc4-hmac des-cbc-md5
         default_tkt_enctypes = rc4-hmac des-cbc-md5
         permitted_enctypes = rc4-hmac des-cbc-md5

         krb4_config = /etc/krb.conf
         krb4_realms = /etc/krb.realms
         kdc_timesync = 1
         ccache_type = 4
         forwardable = true
         proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
         v4_instance_resolve = false
         v4_name_convert = {
                 host = {
                         rcmd = host
                         ftp = ftp
                 }
                 plain = {
                         something = something-else
                 }
         }

[realms]
MYDOMAIN.LOCAL = {
         kdc = DC1.MYDOMAIN.LOCAL:88
         kdc = DC2.MYDOMAIN.LOCAL:88
         admin_server = DC1.MYDOMAIN.LOCAL
}

[domain_realm]

[login]
         krb4_convert = true
         krb4_get_tickets = true


### log.192.168.100.14 of me using smbclient -k on the Samba server to 
connect to itself ###
[2004/08/30 09:41:58, 3] smbd/oplock.c:init_oplocks(1302)
   open_oplock_ipc: opening loopback UDP socket.
[2004/08/30 09:41:58, 3] smbd/oplock_linux.c:linux_init_kernel_oplocks(303)
   Linux kernel oplocks enabled
[2004/08/30 09:41:58, 3] smbd/oplock.c:init_oplocks(1333)
   open_oplock ipc: pid = 22178, global_oplock_port = 36676
[2004/08/30 09:41:58, 3] lib/access.c:check_access(313)
   check_access: no hostnames in host allow/deny list.
[2004/08/30 09:41:58, 2] lib/access.c:check_access(324)
   Allowed connection from  (167.120.214.14)
[2004/08/30 09:41:58, 3] smbd/process.c:process_smb(1092)
   Transaction 0 of length 183
[2004/08/30 09:41:58, 3] smbd/process.c:switch_message(887)
   switch message SMBnegprot (pid 22178) conn 0x0
[2004/08/30 09:41:58, 3] smbd/sec_ctx.c:set_sec_ctx(288)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [PC NETWORK PROGRAM 1.0]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [MICROSOFT NETWORKS 1.03]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [MICROSOFT NETWORKS 3.0]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [LANMAN1.0]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [LM1.2X002]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [DOS LANMAN2.1]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(457)
   Requested protocol [Samba]
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_nt1(329)
   using SPNEGO
[2004/08/30 09:41:58, 3] smbd/negprot.c:reply_negprot(545)
   Selected protocol NT LANMAN 1.0
[2004/08/30 09:41:58, 3] smbd/process.c:process_smb(1092)
   Transaction 1 of length 1276
[2004/08/30 09:41:58, 3] smbd/process.c:switch_message(887)
   switch message SMBsesssetupX (pid 22178) conn 0x0
[2004/08/30 09:41:58, 3] smbd/sec_ctx.c:set_sec_ctx(288)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655)
   wct=12 flg2=0xc801
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535)
   Doing spnego session setup
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566)
   NativeOS=[Unix] NativeLanMan=[Samba] PrimaryDomain=[]
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_spnego_negotiate(444)
   Got OID 1 2 840 48018 1 2 2
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_spnego_negotiate(444)
   Got OID 1 3 6 1 4 1 311 2 2 10
[2004/08/30 09:41:58, 3] smbd/sesssetup.c:reply_spnego_negotiate(447)
   Got secblob of size 1136
[2004/08/30 09:41:58, 3] 
libads/kerberos_verify.c:ads_secrets_verify_ticket(193)
   ads_secrets_verify_ticket: enc type [3] failed to decrypt with error 
Decrypt integrity check failed
[2004/08/30 09:41:58, 3] libads/kerberos_verify.c:ads_verify_ticket(307)
   ads_verify_ticket: krb5_rd_req with auth failed (Success)
[2004/08/30 09:41:58, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
   Failed to verify incoming ticket!
[2004/08/30 09:41:58, 3] smbd/error.c:error_packet(105)
   error string = No such file or directory
[2004/08/30 09:41:58, 3] smbd/error.c:error_packet(129)
   error packet at smbd/sesssetup.c(174) cmd=115 (SMBsesssetupX) 
NT_STATUS_LOGON_FAILURE
[2004/08/30 09:41:58, 3] smbd/process.c:timeout_processing(1332)
   timeout_processing: End of file from client (client has disconnected).
[2004/08/30 09:41:58, 3] smbd/sec_ctx.c:set_sec_ctx(288)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/08/30 09:41:58, 2] smbd/server.c:exit_server(571)
   Closing connections
[2004/08/30 09:41:58, 3] smbd/connection.c:yield_connection(69)
   Yielding connection to
[2004/08/30 09:41:58, 3] smbd/connection.c:yield_connection(76)
   yield_connection: tdb_delete for name  failed with error Record does 
not exist.
[2004/08/30 09:41:58, 3] smbd/server.c:exit_server(614)
   Server exit (normal exit)
Possibly Parallel Threads

Search for more apparently analagous threads
samba - Aug 2004 - Debian Stable Samba 3.0.5 to 3.0.6 upgrade - broke my config?

[Samba] Debian Stable Samba 3.0.5 to 3.0.6 upgrade - broke my config?

Possibly Parallel Threads

Wisdom of the Ancients
