thr3ads.net - samba - [Samba] Samba 4.2.0rc4 can't authenticate users [Feb 2015]

If this information is useful, please help other people find it:
Share via:

Thomas Schulz

2015-Feb-12 16:44 UTC

[Samba] Samba 4.2.0rc4 can't authenticate users

This problem shows up on both Linux and Solaris. I am going to show
the logs from a Fedora 2.6.25-14.fc9.i686 machine.

We are using 'security = domain' with a Windows 2000 domain controller.
We are setting 'password server = starfish2' dispite the fact that the
documentation says that this in not necessary as we have found it to
be necessary. We are setting 'workgroup = adi'.

I installed Samba 4.2.0rc4 in the same location as a previous 4.1.7
installation after removing everything in bin, sbin & lib. We are
running just nmbd and smbd.

Following are sections of two log files with debug set to 2. The first
one is just after starting Samba after it had been down for about
20 minutes. The second is after shutting down Samba and restarting it
about 2 minutes later. In each case I did not try to access anything
until about 2 minutes after starting Samba

The first log.

2015/02/11 15:53:38.155177,  2] ../source3/smbd/reply.c:593(reply_special)
  netbios connect: name1=BREAM          0x20 name2=TETRA          0x0
[2015/02/11 15:53:38.155651,  2] ../source3/smbd/reply.c:634(reply_special)
  netbios connect: local=bream remote=tetra, name type = 0
[2015/02/11 15:53:38.434732,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2015/02/11 15:53:38.441081,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:53:38.524513,  1] ../librpc/ndr/ndr.c:604(ndr_push_error)
  ndr_push_error(5): Bad character conversion
[2015/02/11 15:53:38.524853,  0]
../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain
ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
[2015/02/11 15:53:38.527744,  2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED
with error NT_STATUS_INVALID_PARAMETER
[2015/02/11 15:53:38.527941,  2]
../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_INVALID_PARAMETER
----------------- Logging contunues with a different file name --------------
[2015/02/11 15:53:38.202215,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2015/02/11 15:53:38.207809,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:53:38.344414,  1] ../librpc/ndr/ndr.c:604(ndr_push_error)
  ndr_push_error(5): Bad character conversion
[2015/02/11 15:53:38.344762,  0]
../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain
ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
[2015/02/11 15:53:38.347669,  2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED
with error NT_STATUS_INVALID_PARAMETER
[2015/02/11 15:53:38.347979,  2]
../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_INVALID_PARAMETER


*********** The second log: ****************

[2015/02/11 15:57:06.212318,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2015/02/11 15:57:06.218904,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.249431,  2]
../source3/libsmb/namequery.c:1356(name_query_validator)
  Got a positive name query response from 192.168.2.178 ( 192.168.2.178 )
[2015/02/11 15:57:06.324185,  1] ../librpc/ndr/ndr.c:578(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 8 (../librpc/ndr/ndr_basic.c:234)
[2015/02/11 15:57:06.324577,  0]
../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain
ADI to Domain controller STARFISH2. Error was NT_STATUS_BUFFER_TOO_SMALL.
[2015/02/11 15:57:06.327510,  2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED
with error NT_STATUS_BUFFER_TOO_SMALL
[2015/02/11 15:57:06.327704,  2]
../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_BUFFER_TOO_SMALL
[2015/02/11 15:57:06.387160,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2015/02/11 15:57:06.391843,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.485269,  0]
../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain
ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
[2015/02/11 15:57:06.488256,  2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED
with error NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.488526,  2]
../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.551853,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
[2015/02/11 15:57:06.556682,  2]
../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old
resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.639993,  0]
../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain
ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
[2015/02/11 15:57:06.642980,  2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED
with error NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.643253,  2]
../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_ACCESS_DENIED

Tom Schulz
Applied Dynamics Intl.
schulz at adi.com

Andrew Bartlett

2015-Feb-18 08:02 UTC

head link

[Samba] Samba 4.2.0rc4 can't authenticate users

On Thu, 2015-02-12 at 11:44 -0500, Thomas Schulz wrote:> This problem shows up on both Linux and Solaris. I am going to show
> the logs from a Fedora 2.6.25-14.fc9.i686 machine.
> 
> We are using 'security = domain' with a Windows 2000 domain
controller.
> We are setting 'password server = starfish2' dispite the fact that
the
> documentation says that this in not necessary as we have found it to
> be necessary. We are setting 'workgroup = adi'.
Can you use security=ads
> I installed Samba 4.2.0rc4 in the same location as a previous 4.1.7
> installation after removing everything in bin, sbin & lib. We are
> running just nmbd and smbd.
Please also run winbindd.  The old code to pass authentication to the DC
without winbindd is much less reliable, it has to find and set up the DC
connection every time.  (It has probably got better in recent git
master, but that's mostly because making it use better common code
helped us get rid of old code, rather than this being a use case we want
to encourage). 

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Maybe Matching Threads

Search for more possibly parallel threads

samba - Feb 2015 - Samba 4.2.0rc4 can't authenticate users

[Samba] Samba 4.2.0rc4 can't authenticate users

[Samba] Samba 4.2.0rc4 can't authenticate users

Maybe Matching Threads