samba - Nov 2005 - Windows refusing samba server

Hi George, my machines are coming back since I've rebooted the machine. 
Some others don't. Because there is an unspecified interval of time 
between dying and reviving machines, I am sure it's a kerberos issue. 
But I don't have any idea where this error is located. I hope the 
machines are all coming back to productivity and stay at this point.

My samba is running as a domain member server using nss_ldap (openldap, 
cyrus_sasl) on a gentoo box. If someone notice the same problems: please 
post, I am not sure that the status quo will hold.

George schrieb:
> I still have the same problem you have even after having done these things.
> Try them anyway:
> 	Stop the webclient service on the windows machines
> 	There is a registry key change in the doco directory, try that
> 	Check firewalls on the windows machines
> 	
> Good luck with it. This is stopping me from upgrading our classrooms to XP,
> looks like we will dump samba and Linux and install 2000 server for the
> student files. Pity, the samba macros made life very easy with 98.
> 
> Mount Isa - Rodeo Capital of Australia
> -----Original Message-----
> From: samba-bounces+wftd=isaskills.org@lists.samba.org
> [mailto:samba-bounces+wftd=isaskills.org@lists.samba.org] On Behalf Of
> markus
> Sent: Friday, 4 November 2005 11:36 PM
> To: samba@lists.samba.org
> Subject: [Samba] Windows refusing samba server
> 
> Hi, I have some issues with some windows machines (xp pro, 2003). It
> sounds very weird, but some of my machines are loosing the connection to
> my samba server. You can't see any machine browsing the network, it
asks
> for a password getting access to a samba share, which leads to a refused
> connection. After this it asks never again for any password, just
> refusing me. I can ping the samba server, but the client doesn't show
> any shares, just talking about it could'nt find the specified host on
> the network. The strange thing is, that everything worked very fine for 
> months, since I encountered the first machine with these symptoms. A day 
> later the next one. Than the servers, maybe earlier having these 
> problems. And today another one.
> 
> I don't think that anyone encountered such strange and weird behaviour
> on any windows machine. But every hint is very welcome.
> 
> Thanks
>    Markus
>

System: w2003 SP1, samba 3.0.14a-r2 (even tried 3.0.20b)
Kernel: 2.6.12-gentoo-r4 SMP
Mode: ADS
Auth: nss_ldap, kerberos

The Problem: After a while the clients loosing their connection to the 
samba server and it's shares. After the connection is lost there is a 
clean cut: no further information is written to a machine log if trying 
to access a share on the samba server. So the problem has to be on 
windows side. Until the connection is gone forever the machine log has 
many entries like this:

[2005/11/07 12:53:54, 1] smbd/sesssetup.c:reply_spnego_kerberos(250)
   Username DOMAIN+MACHINE$ is invalid on this system

I know this error since I am using the combination of kerb, nss_ldap and 
samba as an ad member but never had problems accessing shares on sambas. 
Because of using nss_ldap, there is no entry for winbind in my 
nsswitch.conf and nss_winbind doesn't extend the machines and usernames 
as DOMAIN+{USER,MACHINE$}.

Are there any known issues related to hotfixes on windows? On w2003 it's 
definitely impossible browsing my samba shares, just refusing the 
connection without logging it anywhere. Neither under linux nor under 
windows, like if never happened.

If windows sends DOMAIN\USER (or interpreted by winbind like 
DOMAIN+USER), how can I tell samba to extend the users and machines the 
same using nss_ldap?

Thanks in advance for any help
   - markus