Ritter, Marcel (RRZE)
2015-Sep-01 09:24 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi again, I just started to debug things on the samba4 side: When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs): auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails). I guess this search should look something like this: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call. Please, could someone more familiar with the samba code base provide me with the required information to do this? Bye, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Montag, 31. August 2015 08:44 An: samba at lists.samba.org Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) Hi, has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory? I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS server running when using samba as AD. As far as i can tell, the setup looks good: I've got Linux based NFS servers and clients (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails. Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble. The failing windows NFS Server reports lots of messages like: "Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log. MSV Status: 0xC000009A, Substatus: 0x0 S4U Status: 0xC000006D, Substatus: 0x0 " The security log reports: "An account failed to log on. Subject: Security ID: SYSTEM Account Name: WIN12$ Account Domain: MYDOM Logon ID: 0x3E7 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: nfs/nfsclient.mydom.test Account Domain: MYDOM.TEST Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x4 Caller Process Name: Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NfsSvr Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. " For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess. Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)? Any other ideas what could cause this? Marcel BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
L.P.H. van Belle
2015-Sep-01 09:51 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
hai, The servers have "A and PTR" records? You have for both server these UPNs. nfs/${SETFQDN} ${SETHOSTNAME_CAPS}$ nfs/${SETFQDN}@${SAMBA_KERBEROS_REALM} ${SETHOSTNAME_CAPS}$ on the samba side the nfs spn is in you keytab file? and if your brave, read, * dont run it, since i did not test this with windows servers. https://secure.bazuin.nl/scripts/these_are_experimental_scripts/ check the setup-nfsv4-kerberos.sh script, tested in a samba4 only setup, on debian (wheezy and jessie) and its not quite finished, i think.. Greetz, Louis>-----Oorspronkelijk bericht----- >Van: samba [mailto:samba-bounces at lists.samba.org] Namens >Ritter, Marcel (RRZE) >Verzonden: dinsdag 1 september 2015 11:25 >Aan: samba at lists.samba.org >Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server >(2012R2) - Update > >Hi again, > >I just started to debug things on the samba4 side: > >When trying to mount the Windows NFS share, I get the >following error on >the samba4 dc (just grepping for nfs in the logs): > > auth_check_password_send: Checking password for unmapped >user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] > map_user_info_cracknames: Mapping user >[MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] > auth_check_password_send: mapped user is: >[MYDOM]\[nfs/nfsclient.mydom.test]@[] > expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) > sam_search_user: Couldn't find user >[nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test > auth_check_password_recv: sam_ignoredomain authentication >for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error >NT_STATUS_NO_SUCH_USER > >From a first search, it looks like function authsam_search_account() >from source4/auth/ntlm/auth_sam.c does this lookup (and fails). > >I guess this search should look something like this: > >(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName >=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) > >I'd like to give this a try, however I've no idea how to get >the required >realm name from the parameters available during >authsam_search_account() >call. > >Please, could someone more familiar with the samba code base provide me >with the required information to do this? > >Bye, > Marcel > >-----Ursprüngliche Nachricht----- >Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag >von Ritter, Marcel (RRZE) >Gesendet: Montag, 31. August 2015 08:44 >An: samba at lists.samba.org >Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) > >Hi, > >has anyone out there tried to get a Windows Server 2012R2 >based NFS Server running against a Samba4 active directory? > >I'm currently doing some interop testing, and I cannot get a >Windows Server 2012R2 based NFS server running when using samba as AD. > >As far as i can tell, the setup looks good: > >I've got Linux based NFS servers and clients (Ubuntu + SuSE) >up and running fine (krb5 auth against samba DC), but trying >to access the Windows NFS server fails. > >Outside the above testbed I've tried to mount NFS shares on a >different Windows Server (joined against our MS AD) and access >from Linux clients works fine here, so I guess it's not MS NFS >server itself that's causing the trouble. > > >The failing windows NFS Server reports lots of messages like: > >"Server for NFS was unable to obtain security information for >the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. > >Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test >is valid and meets als configured security policies. Ther may >be additional information in the Windows Security event log. > >MSV Status: 0xC000009A, Substatus: 0x0 >S4U Status: 0xC000006D, Substatus: 0x0 >" > >The security log reports: > >"An account failed to log on. > >Subject: > Security ID: SYSTEM > Account Name: WIN12$ > Account Domain: MYDOM > Logon ID: 0x3E7 > >Logon Type: 3 > >Account For Which Logon Failed: > Security ID: NULL SID > Account Name: nfs/nfsclient.mydom.test > Account Domain: MYDOM.TEST > >Failure Information: > Failure Reason: Unknown user name or bad password. > Status: 0xC000006D > Sub Status: 0xC0000064 > >Process Information: > Caller Process ID: 0x4 > Caller Process Name: > >Network Information: > Workstation Name: > Source Network Address: - > Source Port: - > >Detailed Authentication Information: > Logon Process: NfsSvr > Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 > Transited Services: - > Package Name (NTLM only): - > Key Length: 0 > >This event is generated when a logon request fails. It is >generated on the computer where access was attempted. > >The Subject fields indicate the account on the local system >which requested the logon. This is most commonly a service >such as the Server service, or a local process such as >Winlogon.exe or Services.exe. > >The Logon Type field indicates the kind of logon that was >requested. The most common types are 2 (interactive) and 3 (network). > >The Process Information fields indicate which account and >process on the system requested the logon. > >The Network Information fields indicate where a remote logon >request originated. Workstation name is not always available >and may be left blank in some cases. > >The authentication information fields provide detailed >information about this specific logon request. > - Transited services indicate which intermediate >services have participated in this logon request. > - Package name indicates which sub-protocol was used >among the NTLM protocols. > - Key length indicates the length of the generated >session key. This will be 0 if no session key was requested. >" > >For me it looks like Windows NFS server does some >additional/different lookups that fail on a samba backend but >succeed against a Windows AD, but that's just a guess. > >Is there an easy way to debug LDAP lookups (and results) in >Samba 4 (by setting a certain log level maybe)? > >Any other ideas what could cause this? > >Marcel > >BTW, I've tested this with Ubuntu samba package 4.1.6, but >also with latest git version of samba. > > > >-- >To unsubscribe from this list go to the following URL and read the >instructions: https://lists.samba.org/mailman/options/samba >-- >To unsubscribe from this list go to the following URL and read the >instructions: https://lists.samba.org/mailman/options/samba > >
Ritter, Marcel (RRZE)
2015-Sep-01 10:30 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi Louis, as I mentioned in my first mail on this topic, the setup is working quite fine as long as NFS server and client are both Linux based. Only the Microsoft NFS Server seems to trigger some different lookups, that fail. DNS is fine - both forward and reverse. And yes I got all those UPNs in the keytab. I also had a quick look at the check script, and I'll give it a try later this week. According to my experience it would be *very* handy to have a check script like this, especially when dealing with NFS. Bye, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H. van Belle Gesendet: Dienstag, 1. September 2015 11:52 An: samba at lists.samba.org Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update hai, The servers have "A and PTR" records? You have for both server these UPNs. nfs/${SETFQDN} ${SETHOSTNAME_CAPS}$ nfs/${SETFQDN}@${SAMBA_KERBEROS_REALM} ${SETHOSTNAME_CAPS}$ on the samba side the nfs spn is in you keytab file? and if your brave, read, * dont run it, since i did not test this with windows servers. https://secure.bazuin.nl/scripts/these_are_experimental_scripts/ check the setup-nfsv4-kerberos.sh script, tested in a samba4 only setup, on debian (wheezy and jessie) and its not quite finished, i think.. Greetz, Louis>-----Oorspronkelijk bericht----- >Van: samba [mailto:samba-bounces at lists.samba.org] Namens >Ritter, Marcel (RRZE) >Verzonden: dinsdag 1 september 2015 11:25 >Aan: samba at lists.samba.org >Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server >(2012R2) - Update > >Hi again, > >I just started to debug things on the samba4 side: > >When trying to mount the Windows NFS share, I get the >following error on >the samba4 dc (just grepping for nfs in the logs): > > auth_check_password_send: Checking password for unmapped >user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] > map_user_info_cracknames: Mapping user >[MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] > auth_check_password_send: mapped user is: >[MYDOM]\[nfs/nfsclient.mydom.test]@[] > expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) > sam_search_user: Couldn't find user >[nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test > auth_check_password_recv: sam_ignoredomain authentication >for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error >NT_STATUS_NO_SUCH_USER > >From a first search, it looks like function authsam_search_account() >from source4/auth/ntlm/auth_sam.c does this lookup (and fails). > >I guess this search should look something like this: > >(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName >=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) > >I'd like to give this a try, however I've no idea how to get >the required >realm name from the parameters available during >authsam_search_account() >call. > >Please, could someone more familiar with the samba code base provide me >with the required information to do this? > >Bye, > Marcel > >-----Ursprüngliche Nachricht----- >Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag >von Ritter, Marcel (RRZE) >Gesendet: Montag, 31. August 2015 08:44 >An: samba at lists.samba.org >Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) > >Hi, > >has anyone out there tried to get a Windows Server 2012R2 >based NFS Server running against a Samba4 active directory? > >I'm currently doing some interop testing, and I cannot get a >Windows Server 2012R2 based NFS server running when using samba as AD. > >As far as i can tell, the setup looks good: > >I've got Linux based NFS servers and clients (Ubuntu + SuSE) >up and running fine (krb5 auth against samba DC), but trying >to access the Windows NFS server fails. > >Outside the above testbed I've tried to mount NFS shares on a >different Windows Server (joined against our MS AD) and access >from Linux clients works fine here, so I guess it's not MS NFS >server itself that's causing the trouble. > > >The failing windows NFS Server reports lots of messages like: > >"Server for NFS was unable to obtain security information for >the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. > >Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test >is valid and meets als configured security policies. Ther may >be additional information in the Windows Security event log. > >MSV Status: 0xC000009A, Substatus: 0x0 >S4U Status: 0xC000006D, Substatus: 0x0 >" > >The security log reports: > >"An account failed to log on. > >Subject: > Security ID: SYSTEM > Account Name: WIN12$ > Account Domain: MYDOM > Logon ID: 0x3E7 > >Logon Type: 3 > >Account For Which Logon Failed: > Security ID: NULL SID > Account Name: nfs/nfsclient.mydom.test > Account Domain: MYDOM.TEST > >Failure Information: > Failure Reason: Unknown user name or bad password. > Status: 0xC000006D > Sub Status: 0xC0000064 > >Process Information: > Caller Process ID: 0x4 > Caller Process Name: > >Network Information: > Workstation Name: > Source Network Address: - > Source Port: - > >Detailed Authentication Information: > Logon Process: NfsSvr > Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 > Transited Services: - > Package Name (NTLM only): - > Key Length: 0 > >This event is generated when a logon request fails. It is >generated on the computer where access was attempted. > >The Subject fields indicate the account on the local system >which requested the logon. This is most commonly a service >such as the Server service, or a local process such as >Winlogon.exe or Services.exe. > >The Logon Type field indicates the kind of logon that was >requested. The most common types are 2 (interactive) and 3 (network). > >The Process Information fields indicate which account and >process on the system requested the logon. > >The Network Information fields indicate where a remote logon >request originated. Workstation name is not always available >and may be left blank in some cases. > >The authentication information fields provide detailed >information about this specific logon request. > - Transited services indicate which intermediate >services have participated in this logon request. > - Package name indicates which sub-protocol was used >among the NTLM protocols. > - Key length indicates the length of the generated >session key. This will be 0 if no session key was requested. >" > >For me it looks like Windows NFS server does some >additional/different lookups that fail on a samba backend but >succeed against a Windows AD, but that's just a guess. > >Is there an easy way to debug LDAP lookups (and results) in >Samba 4 (by setting a certain log level maybe)? > >Any other ideas what could cause this? > >Marcel > >BTW, I've tested this with Ubuntu samba package 4.1.6, but >also with latest git version of samba. > > > >-- >To unsubscribe from this list go to the following URL and read the >instructions: https://lists.samba.org/mailman/options/samba >-- >To unsubscribe from this list go to the following URL and read the >instructions: https://lists.samba.org/mailman/options/samba > >-- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Ritter, Marcel (RRZE)
2015-Sep-01 13:04 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi again, I just hacked the code to also query userPrincipalName in authsam_search_account() (hardcoded my realm for now). Now the NFS client object is found, however password authentication fails: auth_check_password_send: Checking password for unmapped user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) dn: <GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test sAMAccountName: nfsclient_nfs$ userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST servicePrincipalName: nfs/nfsclient.mydom.test servicePrincipalName: host/nfsclient_nfs.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test after wrong password auth_check_password_recv: sam_ignoredomain authentication for user [MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD As the whole NFS thing is krb5 based, I guess checking NTLM passwords (with zero-length) is not the way to go ... Any ideas / patches welcome ... Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Dienstag, 1. September 2015 11:25 An: samba at lists.samba.org Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Hi again, I just started to debug things on the samba4 side: When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs): auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails). I guess this search should look something like this: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call. Please, could someone more familiar with the samba code base provide me with the required information to do this? Bye, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Montag, 31. August 2015 08:44 An: samba at lists.samba.org Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) Hi, has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory? I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS server running when using samba as AD. As far as i can tell, the setup looks good: I've got Linux based NFS servers and clients (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails. Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble. The failing windows NFS Server reports lots of messages like: "Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log. MSV Status: 0xC000009A, Substatus: 0x0 S4U Status: 0xC000006D, Substatus: 0x0 " The security log reports: "An account failed to log on. Subject: Security ID: SYSTEM Account Name: WIN12$ Account Domain: MYDOM Logon ID: 0x3E7 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: nfs/nfsclient.mydom.test Account Domain: MYDOM.TEST Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x4 Caller Process Name: Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NfsSvr Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. " For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess. Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)? Any other ideas what could cause this? Marcel BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
L.P.H. van Belle
2015-Sep-01 13:43 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Try this on your samba DC. amba-tool spn list PCNAME$ You should see something like: PCNAME$$ User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following servicePrincipalName: HOST/PCNAME HOST/PCNAME.internal.domain.tld nfs/PCNAME.internal.domain.tld nfs/PCNAME.internal.domain.tld at YOUR_REALM can you confirm this for both your servers which you want to use nfs on. And host/pcname is not HOST/PCNAME These must match depending on what the software wants. For example, my zarafa mail server software must have : HTTP/mail.... And not http/mail.... Greetz, Louis -----Oorspronkelijk bericht----- Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel (RRZE) Verzonden: dinsdag 1 september 2015 15:04 Aan: samba at lists.samba.org Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Hi again, I just hacked the code to also query userPrincipalName in authsam_search_account() (hardcoded my realm for now). Now the NFS client object is found, however password authentication fails: auth_check_password_send: Checking password for unmapped user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) dn: <GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test sAMAccountName: nfsclient_nfs$ userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST servicePrincipalName: nfs/nfsclient.mydom.test servicePrincipalName: host/nfsclient_nfs.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test after wrong password auth_check_password_recv: sam_ignoredomain authentication for user [MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD As the whole NFS thing is krb5 based, I guess checking NTLM passwords (with zero-length) is not the way to go ... Any ideas / patches welcome ... Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Dienstag, 1. September 2015 11:25 An: samba at lists.samba.org Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Hi again, I just started to debug things on the samba4 side: When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs): auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER>From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails).I guess this search should look something like this: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call. Please, could someone more familiar with the samba code base provide me with the required information to do this? Bye, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Montag, 31. August 2015 08:44 An: samba at lists.samba.org Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) Hi, has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory? I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS server running when using samba as AD. As far as i can tell, the setup looks good: I've got Linux based NFS servers and clients (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails. Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble. The failing windows NFS Server reports lots of messages like: "Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log. MSV Status: 0xC000009A, Substatus: 0x0 S4U Status: 0xC000006D, Substatus: 0x0 " The security log reports: "An account failed to log on. Subject: Security ID: SYSTEM Account Name: WIN12$ Account Domain: MYDOM Logon ID: 0x3E7 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: nfs/nfsclient.mydom.test Account Domain: MYDOM.TEST Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x4 Caller Process Name: Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NfsSvr Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. " For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess. Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)? Any other ideas what could cause this? Marcel BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Ritter, Marcel (RRZE)
2015-Sep-02 06:42 UTC
[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi Louis, thanks for pointing out some of the specialities of kerberos, however I know about these and they're not the cause of my current problem :-( The SPNs look fine to me (but just to mention another speciality of NFS/kerberos/AD: Windows kerberos implementation handles ServicePrincipalNames (SPNs) quite different from UserPrincipalNames (UPNs) - that's the reason for the separate AD object mentioned below). Windows (NFS) Server: User CN=WIN12,CN=Computers,DC=mydom,DC=test has the following servicePrincipalName: HOST/win12.mydom.test RestrictedKrbHost/win12.mydom.test HOST/WIN12 RestrictedKrbHost/WIN12 WSMAN/win12.mydom.test WSMAN/win12 nfs/win12.mydom.test nfs/WIN12 TERMSRV/win12.mydom.test TERMSRV/WIN12 Linux (NFS) Client: User CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test has the following servicePrincipalName: nfs/nfsclient.mydom.test host/nfsclient_nfs.mydom.test The NFS Client has 2 separate objects in the samba AD: One created by "net ads join" containing the typical HOSTNAME$ (used for winbindd) and another one for nfs/* (that's the one listed above). The nfs/* credentials are stored in a separate keytab (that's used by rpc.gssd). I know that newer versions of nfs-utils can also use the HOSTNAME$ principals, but as we're in an interop test, we're trying to make things work for as much clients/servers as possible. Jeremy asked to open a bug on this topic and to provide logs and network traces, so that'll be my next step. Thanks for your comments and help, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H. van Belle Gesendet: Dienstag, 1. September 2015 15:44 An: samba at lists.samba.org Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Try this on your samba DC. amba-tool spn list PCNAME$ You should see something like: PCNAME$$ User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following servicePrincipalName: HOST/PCNAME HOST/PCNAME.internal.domain.tld nfs/PCNAME.internal.domain.tld nfs/PCNAME.internal.domain.tld at YOUR_REALM can you confirm this for both your servers which you want to use nfs on. And host/pcname is not HOST/PCNAME These must match depending on what the software wants. For example, my zarafa mail server software must have : HTTP/mail.... And not http/mail.... Greetz, Louis -----Oorspronkelijk bericht----- Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel (RRZE) Verzonden: dinsdag 1 september 2015 15:04 Aan: samba at lists.samba.org Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Hi again, I just hacked the code to also query userPrincipalName in authsam_search_account() (hardcoded my realm for now). Now the NFS client object is found, however password authentication fails: auth_check_password_send: Checking password for unmapped user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) dn: <GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test sAMAccountName: nfsclient_nfs$ userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST servicePrincipalName: nfs/nfsclient.mydom.test servicePrincipalName: host/nfsclient_nfs.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test after wrong password auth_check_password_recv: sam_ignoredomain authentication for user [MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD As the whole NFS thing is krb5 based, I guess checking NTLM passwords (with zero-length) is not the way to go ... Any ideas / patches welcome ... Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Dienstag, 1. September 2015 11:25 An: samba at lists.samba.org Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update Hi again, I just started to debug things on the samba4 side: When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs): auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[] map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation [] auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[] expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user)) sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails). I guess this search should look something like this: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user)) I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call. Please, could someone more familiar with the samba code base provide me with the required information to do this? Bye, Marcel -----Ursprüngliche Nachricht----- Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE) Gesendet: Montag, 31. August 2015 08:44 An: samba at lists.samba.org Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2) Hi, has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory? I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS server running when using samba as AD. As far as i can tell, the setup looks good: I've got Linux based NFS servers and clients (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails. Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble. The failing windows NFS Server reports lots of messages like: "Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test. Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log. MSV Status: 0xC000009A, Substatus: 0x0 S4U Status: 0xC000006D, Substatus: 0x0 " The security log reports: "An account failed to log on. Subject: Security ID: SYSTEM Account Name: WIN12$ Account Domain: MYDOM Logon ID: 0x3E7 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: nfs/nfsclient.mydom.test Account Domain: MYDOM.TEST Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x4 Caller Process Name: Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NfsSvr Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. " For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess. Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)? Any other ideas what could cause this? Marcel BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba