samba - Oct 2013 - URGENT - production server stops working (v3.6)

Hello,

i need some help. A samba3 (3.6.9-151.el6_4.1) ADS member (WIN 2008 AD 
Master) Server did his work for years. Since hours some Clients can not 
connect to the name (\\fileserver)
connecting to \\192... sometimes work.

Log say:
2013/10/09 09:54:27.735101,  3] smbd/sesssetup.c:660(reply_spnego_negotiate)
   reply_spnego_negotiate: Got secblob of size 1638
[2013/10/09 09:54:27.735423,  3] 
libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
   libads/kerberos_verify.c:435: enc type [23] failed to decrypt with 
error Decrypt integrity check failed
[2013/10/09 09:54:27.757589,  3] 
libads/kerberos_verify.c:638(ads_verify_ticket)
   libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad 
encryption type)
[2013/10/09 09:54:27.757792,  1] smbd/sesssetup.c:342(reply_spnego_kerberos)
   Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!


Any hints are wellcome?

Andreas

-- 
Ing. Andreas Grabner
+43 676 840 775 101
andreas at vianova.cc
  
Via Nova Mediendesign GMBH
Augasse 24
A- 7400 oberwart
+4333 52 / 32 860
www.vianova.cc

On Wed, Oct 09, 2013 at 10:07:52AM +0200, Andreas Grabner
wrote:
> Hello,
> 
> i need some help. A samba3 (3.6.9-151.el6_4.1) ADS member (WIN 2008
> AD Master) Server did his work for years. Since hours some Clients
> can not connect to the name (\\fileserver)
> connecting to \\192... sometimes work.
> 
> Log say:
> 2013/10/09 09:54:27.735101,  3]
smbd/sesssetup.c:660(reply_spnego_negotiate)
>   reply_spnego_negotiate: Got secblob of size 1638
> [2013/10/09 09:54:27.735423,  3]
> libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
>   libads/kerberos_verify.c:435: enc type [23] failed to decrypt with
> error Decrypt integrity check failed
> [2013/10/09 09:54:27.757589,  3]
> libads/kerberos_verify.c:638(ads_verify_ticket)
>   libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad
> encryption type)
> [2013/10/09 09:54:27.757792,  1]
smbd/sesssetup.c:342(reply_spnego_kerberos)
>   Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
> 
> 
> Any hints are wellcome?
Try re-joining (net ads join).

Volker

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de

*****************************************************************
visit us on it-sa:IT security exhibitions in N?rnberg, Germany
October 8th - 10th 2013, hall 12, booth 333
free tickets available via code 270691 on: www.it-sa.de/gutschein
******************************************************************