samba - Jan 2005 - Linux server & client in Win2k3 AD domain

Hello folks!

I am trying to make sure we can use Linux/Win2k3 mix in
my company. After reading up in the documentation I fealt
it sounded so good I would propably get there with little effort...

Well, halfway there I got fast enough. But that won't do...

I have successfully joined the AD-Domain from my Linux host.
And I also can authenticate a AD user in the Linux host.
I used nsswitch and pam.d/system-auth with winbind...

However I can't get to the shared files from a Windows
client. I can browse, with a LOT of waiting, so I can see
the machine and shares. But I can't login and access files.
I tried this both from the Win2k3 AD machine and from my XP
desktop.

Windows client says the user/password is wrong.
In the /var/log/samba/<machine> logfile i get:

[2005/01/29 15:21:48, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
  Failed to verify incoming ticket!

Painfull as it is I have to admit I don't know enough to get
any further.

Please advice!!


-- 
/ Jonas

 'Linux, because reboots are for HW upgrade' still applies..
  ... but now with the addition " or Windows update". * sigh *

Jonas,

Did you follow the guidelines in the Samba-Guide Chapter 9?
You can obtain it from:
	http://www.samba.org/samba/docs/Samba-Guide.pdf

If any of it does not work please let me know so I can fix it.

- John T.

On Saturday 29 January 2005 14:39, Jonas Printz?n wrote:
> Hello folks!
>
> I am trying to make sure we can use Linux/Win2k3 mix in
> my company. After reading up in the documentation I fealt
> it sounded so good I would propably get there with little effort...
>
> Well, halfway there I got fast enough. But that won't do...
>
> I have successfully joined the AD-Domain from my Linux host.
> And I also can authenticate a AD user in the Linux host.
> I used nsswitch and pam.d/system-auth with winbind...
>
> However I can't get to the shared files from a Windows
> client. I can browse, with a LOT of waiting, so I can see
> the machine and shares. But I can't login and access files.
> I tried this both from the Win2k3 AD machine and from my XP
> desktop.
>
> Windows client says the user/password is wrong.
> In the /var/log/samba/<machine> logfile i get:
>
> [2005/01/29 15:21:48, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
>   Failed to verify incoming ticket!
>
> Painfull as it is I have to admit I don't know enough to get
> any further.
>
> Please advice!!
>
>
> --
> / Jonas
>
>  'Linux, because reboots are for HW upgrade' still applies..
>   ... but now with the addition " or Windows update". * sigh *
-- 
John H Terpstra
Samba-Team Member
Phone: +1 (650) 580-8668

Author:
The Official Samba-3 HOWTO & Reference Guide, ISBN: 0131453556
Samba-3 by Example, ISBN: 0131472216
Hardening Linux, ISBN: 0072254971
Other books in production.

Hi,
you didn't tell us your distribution etc, so this is a bit guesswork.

you need a verry recent version of kerberos libraries on your system.
If you use MIT-kerberos you need at least version 1.3.4.
for heimdal i can't recall the exact version.
Please search the list-archives for the minimal required versions.
After installing these libraries you'll have to recompile samba against
them.
Christoph

Jonas Printz?n schrieb:
> Hello folks!
> 
> I am trying to make sure we can use Linux/Win2k3 mix in
> my company. After reading up in the documentation I fealt
> it sounded so good I would propably get there with little effort...
> 
> Well, halfway there I got fast enough. But that won't do...
> 
> I have successfully joined the AD-Domain from my Linux host.
> And I also can authenticate a AD user in the Linux host.
> I used nsswitch and pam.d/system-auth with winbind...
> 
> However I can't get to the shared files from a Windows
> client. I can browse, with a LOT of waiting, so I can see
> the machine and shares. But I can't login and access files.
> I tried this both from the Win2k3 AD machine and from my XP
> desktop.
> 
> Windows client says the user/password is wrong.
> In the /var/log/samba/<machine> logfile i get:
> 
> [2005/01/29 15:21:48, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
>   Failed to verify incoming ticket!
> 
> Painfull as it is I have to admit I don't know enough to get
> any further.
> 
> Please advice!!
> 
>