thr3ads.net - samba - [Samba] Samba 4 and MS Windows NFS Server (2012R2)

If this information is useful, please help other people find it:
Share via:

Ritter, Marcel (RRZE)

2015-Sep-01 09:24 UTC

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just started to debug things on the samba4 side:

When trying to mount the Windows NFS share, I get the following error on
the samba4 dc (just grepping for nfs in the logs):

  auth_check_password_send: Checking password for unmapped user
[S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
  sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb,
under DC=mydom,DC=test
  auth_check_password_recv: sam_ignoredomain authentication for user
[S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER

From a first search, it looks like function authsam_search_account()
from source4/auth/ntlm/auth_sam.c does this lookup (and fails).

I guess this search should look something like this:

(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))

I'd like to give this a try, however I've no idea how to get the
required
realm name from the parameters available during authsam_search_account()
call.

Please, could someone more familiar with the samba code base provide me
with the required information to do this?

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)

Hi,

has anyone out there tried to get a Windows Server 2012R2 based NFS Server
running against a Samba4 active directory?

I'm currently doing some interop testing, and I cannot get a Windows Server
2012R2 based NFS  server running when using samba as AD.

As far as i can tell, the setup looks good:

I've got Linux based NFS servers and clients  (Ubuntu + SuSE) up and running
fine (krb5 auth against samba DC), but trying to access the Windows NFS server
fails.

Outside the above testbed I've tried to mount NFS shares on a different
Windows Server (joined against our MS AD) and access from Linux clients works
fine here, so I guess it's not MS NFS server itself that's causing the
trouble.


The failing windows NFS Server reports lots of messages like:

"Server for NFS was unable to obtain security information for the GSS user
account MYDOM.TEST\nfs/nfsclient.mydom.test.

Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional
information in the Windows Security event log.

MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"

The security log reports:

"An account failed to log on.

Subject:
        Security ID:            SYSTEM
        Account Name:           WIN12$
        Account Domain:         MYDOM
        Logon ID:               0x3E7

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           nfs/nfsclient.mydom.test
        Account Domain:         MYDOM.TEST

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xC000006D
        Sub Status:             0xC0000064

Process Information:
        Caller Process ID:      0x4
        Caller Process Name:

Network Information:
        Workstation Name:
        Source Network Address: -
        Source Port:            -

Detailed Authentication Information:
        Logon Process:          NfsSvr
        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Transited Services:     -
        Package Name (NTLM only):       -
        Key Length:             0

This event is generated when a logon request fails. It is generated on the
computer where access was attempted.

The Subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most
common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system
requested the logon.

The Network Information fields indicate where a remote logon request originated.
Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this
specific logon request.
        - Transited services indicate which intermediate services have
participated in this logon request.
        - Package name indicates which sub-protocol was used among the NTLM
protocols.
        - Key length indicates the length of the generated session key. This
will be 0 if no session key was requested.
"

For me it looks like Windows NFS server does some additional/different lookups
that fail on a samba backend but succeed against a Windows AD, but that's
just a guess.

Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting
a certain log level maybe)?

Any other ideas what could cause this?

Marcel

BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest
git version of samba.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

L.P.H. van Belle

2015-Sep-01 09:51 UTC

head link

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

hai, 

The servers have "A and PTR" records? 
You have for both server these UPNs. 

nfs/${SETFQDN} ${SETHOSTNAME_CAPS}$
nfs/${SETFQDN}@${SAMBA_KERBEROS_REALM} ${SETHOSTNAME_CAPS}$

on the samba side the nfs spn is in you keytab file? 

and if your brave, read, * dont run it, since i did not test this with windows
servers.

https://secure.bazuin.nl/scripts/these_are_experimental_scripts/ 
check the setup-nfsv4-kerberos.sh script, tested in a samba4 only setup, on
debian (wheezy and jessie)
and its not quite finished, i think.. 



Greetz, 

Louis


>-----Oorspronkelijk bericht-----
>Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
>Ritter, Marcel (RRZE)
>Verzonden: dinsdag 1 september 2015 11:25
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server 
>(2012R2) - Update
>
>Hi again,
>
>I just started to debug things on the samba4 side:
>
>When trying to mount the Windows NFS share, I get the 
>following error on
>the samba4 dc (just grepping for nfs in the logs):
>
>  auth_check_password_send: Checking password for unmapped 
>user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
>  map_user_info_cracknames: Mapping user 
>[MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
>  auth_check_password_send: mapped user is: 
>[MYDOM]\[nfs/nfsclient.mydom.test]@[]
>   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
>  sam_search_user: Couldn't find user 
>[nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test
>  auth_check_password_recv: sam_ignoredomain authentication 
>for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error 
>NT_STATUS_NO_SUCH_USER
>
>From a first search, it looks like function authsam_search_account()
>from source4/auth/ntlm/auth_sam.c does this lookup (and fails).
>
>I guess this search should look something like this:
>
>(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName
>=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))
>
>I'd like to give this a try, however I've no idea how to get 
>the required
>realm name from the parameters available during 
>authsam_search_account()
>call.
>
>Please, could someone more familiar with the samba code base provide me
>with the required information to do this?
>
>Bye,
>   Marcel
>
>-----Ursprüngliche Nachricht-----
>Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag 
>von Ritter, Marcel (RRZE)
>Gesendet: Montag, 31. August 2015 08:44
>An: samba at lists.samba.org
>Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)
>
>Hi,
>
>has anyone out there tried to get a Windows Server 2012R2 
>based NFS Server running against a Samba4 active directory?
>
>I'm currently doing some interop testing, and I cannot get a 
>Windows Server 2012R2 based NFS  server running when using samba as AD.
>
>As far as i can tell, the setup looks good:
>
>I've got Linux based NFS servers and clients  (Ubuntu + SuSE) 
>up and running fine (krb5 auth against samba DC), but trying 
>to access the Windows NFS server fails.
>
>Outside the above testbed I've tried to mount NFS shares on a 
>different Windows Server (joined against our MS AD) and access 
>from Linux clients works fine here, so I guess it's not MS NFS 
>server itself that's causing the trouble.
>
>
>The failing windows NFS Server reports lots of messages like:
>
>"Server for NFS was unable to obtain security information for 
>the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test.
>
>Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
>is valid and meets als configured security policies. Ther may 
>be additional information in the Windows Security event log.
>
>MSV Status: 0xC000009A, Substatus: 0x0
>S4U Status: 0xC000006D, Substatus: 0x0
>"
>
>The security log reports:
>
>"An account failed to log on.
>
>Subject:
>        Security ID:            SYSTEM
>        Account Name:           WIN12$
>        Account Domain:         MYDOM
>        Logon ID:               0x3E7
>
>Logon Type:                     3
>
>Account For Which Logon Failed:
>        Security ID:            NULL SID
>        Account Name:           nfs/nfsclient.mydom.test
>        Account Domain:         MYDOM.TEST
>
>Failure Information:
>        Failure Reason:         Unknown user name or bad password.
>        Status:                 0xC000006D
>        Sub Status:             0xC0000064
>
>Process Information:
>        Caller Process ID:      0x4
>        Caller Process Name:
>
>Network Information:
>        Workstation Name:
>        Source Network Address: -
>        Source Port:            -
>
>Detailed Authentication Information:
>        Logon Process:          NfsSvr
>        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>        Transited Services:     -
>        Package Name (NTLM only):       -
>        Key Length:             0
>
>This event is generated when a logon request fails. It is 
>generated on the computer where access was attempted.
>
>The Subject fields indicate the account on the local system 
>which requested the logon. This is most commonly a service 
>such as the Server service, or a local process such as 
>Winlogon.exe or Services.exe.
>
>The Logon Type field indicates the kind of logon that was 
>requested. The most common types are 2 (interactive) and 3 (network).
>
>The Process Information fields indicate which account and 
>process on the system requested the logon.
>
>The Network Information fields indicate where a remote logon 
>request originated. Workstation name is not always available 
>and may be left blank in some cases.
>
>The authentication information fields provide detailed 
>information about this specific logon request.
>        - Transited services indicate which intermediate 
>services have participated in this logon request.
>        - Package name indicates which sub-protocol was used 
>among the NTLM protocols.
>        - Key length indicates the length of the generated 
>session key. This will be 0 if no session key was requested.
>"
>
>For me it looks like Windows NFS server does some 
>additional/different lookups that fail on a samba backend but 
>succeed against a Windows AD, but that's just a guess.
>
>Is there an easy way to debug LDAP lookups (and results) in 
>Samba 4 (by setting a certain log level maybe)?
>
>Any other ideas what could cause this?
>
>Marcel
>
>BTW, I've tested this with Ubuntu samba package 4.1.6, but 
>also with latest git version of samba.
>
>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

Ritter, Marcel (RRZE)

2015-Sep-01 10:30 UTC

head link

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi Louis,

as I mentioned in my first mail on this topic, the setup is working quite fine
as long as NFS server and client are both Linux based.

Only the Microsoft NFS Server seems to trigger some different lookups,
that fail.

DNS is fine - both forward and reverse.
And yes I got all those UPNs in the keytab.

I also had a quick look at the check script, and I'll give it a try later
this
week. According to my experience it would be *very* handy to have
a check script like this, especially when dealing with NFS.

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H. van
Belle
Gesendet: Dienstag, 1. September 2015 11:52
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

hai, 

The servers have "A and PTR" records? 
You have for both server these UPNs. 

nfs/${SETFQDN} ${SETHOSTNAME_CAPS}$
nfs/${SETFQDN}@${SAMBA_KERBEROS_REALM} ${SETHOSTNAME_CAPS}$

on the samba side the nfs spn is in you keytab file? 

and if your brave, read, * dont run it, since i did not test this with windows
servers.

https://secure.bazuin.nl/scripts/these_are_experimental_scripts/
check the setup-nfsv4-kerberos.sh script, tested in a samba4 only setup, on
debian (wheezy and jessie) and its not quite finished, i think..



Greetz, 

Louis


>-----Oorspronkelijk bericht-----
>Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
>Ritter, Marcel (RRZE)
>Verzonden: dinsdag 1 september 2015 11:25
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server 
>(2012R2) - Update
>
>Hi again,
>
>I just started to debug things on the samba4 side:
>
>When trying to mount the Windows NFS share, I get the 
>following error on
>the samba4 dc (just grepping for nfs in the logs):
>
>  auth_check_password_send: Checking password for unmapped 
>user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
>  map_user_info_cracknames: Mapping user 
>[MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
>  auth_check_password_send: mapped user is: 
>[MYDOM]\[nfs/nfsclient.mydom.test]@[]
>   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
>  sam_search_user: Couldn't find user 
>[nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test
>  auth_check_password_recv: sam_ignoredomain authentication 
>for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error 
>NT_STATUS_NO_SUCH_USER
>
>From a first search, it looks like function authsam_search_account()
>from source4/auth/ntlm/auth_sam.c does this lookup (and fails).
>
>I guess this search should look something like this:
>
>(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName
>=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))
>
>I'd like to give this a try, however I've no idea how to get 
>the required
>realm name from the parameters available during 
>authsam_search_account()
>call.
>
>Please, could someone more familiar with the samba code base provide me
>with the required information to do this?
>
>Bye,
>   Marcel
>
>-----Ursprüngliche Nachricht-----
>Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag 
>von Ritter, Marcel (RRZE)
>Gesendet: Montag, 31. August 2015 08:44
>An: samba at lists.samba.org
>Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)
>
>Hi,
>
>has anyone out there tried to get a Windows Server 2012R2 
>based NFS Server running against a Samba4 active directory?
>
>I'm currently doing some interop testing, and I cannot get a 
>Windows Server 2012R2 based NFS  server running when using samba as AD.
>
>As far as i can tell, the setup looks good:
>
>I've got Linux based NFS servers and clients  (Ubuntu + SuSE) 
>up and running fine (krb5 auth against samba DC), but trying 
>to access the Windows NFS server fails.
>
>Outside the above testbed I've tried to mount NFS shares on a 
>different Windows Server (joined against our MS AD) and access 
>from Linux clients works fine here, so I guess it's not MS NFS 
>server itself that's causing the trouble.
>
>
>The failing windows NFS Server reports lots of messages like:
>
>"Server for NFS was unable to obtain security information for 
>the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test.
>
>Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
>is valid and meets als configured security policies. Ther may 
>be additional information in the Windows Security event log.
>
>MSV Status: 0xC000009A, Substatus: 0x0
>S4U Status: 0xC000006D, Substatus: 0x0
>"
>
>The security log reports:
>
>"An account failed to log on.
>
>Subject:
>        Security ID:            SYSTEM
>        Account Name:           WIN12$
>        Account Domain:         MYDOM
>        Logon ID:               0x3E7
>
>Logon Type:                     3
>
>Account For Which Logon Failed:
>        Security ID:            NULL SID
>        Account Name:           nfs/nfsclient.mydom.test
>        Account Domain:         MYDOM.TEST
>
>Failure Information:
>        Failure Reason:         Unknown user name or bad password.
>        Status:                 0xC000006D
>        Sub Status:             0xC0000064
>
>Process Information:
>        Caller Process ID:      0x4
>        Caller Process Name:
>
>Network Information:
>        Workstation Name:
>        Source Network Address: -
>        Source Port:            -
>
>Detailed Authentication Information:
>        Logon Process:          NfsSvr
>        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>        Transited Services:     -
>        Package Name (NTLM only):       -
>        Key Length:             0
>
>This event is generated when a logon request fails. It is 
>generated on the computer where access was attempted.
>
>The Subject fields indicate the account on the local system 
>which requested the logon. This is most commonly a service 
>such as the Server service, or a local process such as 
>Winlogon.exe or Services.exe.
>
>The Logon Type field indicates the kind of logon that was 
>requested. The most common types are 2 (interactive) and 3 (network).
>
>The Process Information fields indicate which account and 
>process on the system requested the logon.
>
>The Network Information fields indicate where a remote logon 
>request originated. Workstation name is not always available 
>and may be left blank in some cases.
>
>The authentication information fields provide detailed 
>information about this specific logon request.
>        - Transited services indicate which intermediate 
>services have participated in this logon request.
>        - Package name indicates which sub-protocol was used 
>among the NTLM protocols.
>        - Key length indicates the length of the generated 
>session key. This will be 0 if no session key was requested.
>"
>
>For me it looks like Windows NFS server does some 
>additional/different lookups that fail on a samba backend but 
>succeed against a Windows AD, but that's just a guess.
>
>Is there an easy way to debug LDAP lookups (and results) in 
>Samba 4 (by setting a certain log level maybe)?
>
>Any other ideas what could cause this?
>
>Marcel
>
>BTW, I've tested this with Ubuntu samba package 4.1.6, but 
>also with latest git version of samba.
>
>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Ritter, Marcel (RRZE)

2015-Sep-01 13:04 UTC

head link

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just hacked the code to also query userPrincipalName in
authsam_search_account()
(hardcoded my realm for now). Now the NFS client object is found, however
password
authentication fails:

  auth_check_password_send: Checking password for unmapped user
[MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr:
(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))
  dn:
<GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
  sAMAccountName: nfsclient_nfs$
  userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST
  servicePrincipalName: nfs/nfsclient.mydom.test
  servicePrincipalName: host/nfsclient_nfs.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
after wrong password
  auth_check_password_recv: sam_ignoredomain authentication for user
[MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD

As the whole NFS thing is krb5 based, I guess checking NTLM passwords
(with zero-length) is not the way to go ...

Any ideas / patches welcome ...

Marcel


-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Dienstag, 1. September 2015 11:25
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just started to debug things on the samba4 side:

When trying to mount the Windows NFS share, I get the following error on the
samba4 dc (just grepping for nfs in the logs):

  auth_check_password_send: Checking password for unmapped user
[S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
  sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb,
under DC=mydom,DC=test
  auth_check_password_recv: sam_ignoredomain authentication for user
[S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER

From a first search, it looks like function authsam_search_account() from
source4/auth/ntlm/auth_sam.c does this lookup (and fails).

I guess this search should look something like this:

(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))

I'd like to give this a try, however I've no idea how to get the
required realm name from the parameters available during
authsam_search_account() call.

Please, could someone more familiar with the samba code base provide me with the
required information to do this?

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)

Hi,

has anyone out there tried to get a Windows Server 2012R2 based NFS Server
running against a Samba4 active directory?

I'm currently doing some interop testing, and I cannot get a Windows Server
2012R2 based NFS  server running when using samba as AD.

As far as i can tell, the setup looks good:

I've got Linux based NFS servers and clients  (Ubuntu + SuSE) up and running
fine (krb5 auth against samba DC), but trying to access the Windows NFS server
fails.

Outside the above testbed I've tried to mount NFS shares on a different
Windows Server (joined against our MS AD) and access from Linux clients works
fine here, so I guess it's not MS NFS server itself that's causing the
trouble.


The failing windows NFS Server reports lots of messages like:

"Server for NFS was unable to obtain security information for the GSS user
account MYDOM.TEST\nfs/nfsclient.mydom.test.

Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional
information in the Windows Security event log.

MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"

The security log reports:

"An account failed to log on.

Subject:
        Security ID:            SYSTEM
        Account Name:           WIN12$
        Account Domain:         MYDOM
        Logon ID:               0x3E7

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           nfs/nfsclient.mydom.test
        Account Domain:         MYDOM.TEST

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xC000006D
        Sub Status:             0xC0000064

Process Information:
        Caller Process ID:      0x4
        Caller Process Name:

Network Information:
        Workstation Name:
        Source Network Address: -
        Source Port:            -

Detailed Authentication Information:
        Logon Process:          NfsSvr
        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Transited Services:     -
        Package Name (NTLM only):       -
        Key Length:             0

This event is generated when a logon request fails. It is generated on the
computer where access was attempted.

The Subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most
common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system
requested the logon.

The Network Information fields indicate where a remote logon request originated.
Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this
specific logon request.
        - Transited services indicate which intermediate services have
participated in this logon request.
        - Package name indicates which sub-protocol was used among the NTLM
protocols.
        - Key length indicates the length of the generated session key. This
will be 0 if no session key was requested.
"

For me it looks like Windows NFS server does some additional/different lookups
that fail on a samba backend but succeed against a Windows AD, but that's
just a guess.

Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting
a certain log level maybe)?

Any other ideas what could cause this?

Marcel

BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest
git version of samba.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

L.P.H. van Belle

2015-Sep-01 13:43 UTC

head link

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Try this on your samba DC. 

amba-tool spn list PCNAME$ 

You should see something like: 

PCNAME$$
User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following
servicePrincipalName:
         HOST/PCNAME
         HOST/PCNAME.internal.domain.tld
	   nfs/PCNAME.internal.domain.tld
         nfs/PCNAME.internal.domain.tld at YOUR_REALM 

can you confirm this for both your servers which you want to use nfs on. 

And host/pcname is not HOST/PCNAME 
These must match depending on what the software wants. 
For example, my zarafa mail server software must have : HTTP/mail....  
And not http/mail.... 

Greetz, 

Louis




-----Oorspronkelijk bericht-----
Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel
(RRZE)
Verzonden: dinsdag 1 september 2015 15:04
Aan: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just hacked the code to also query userPrincipalName in
authsam_search_account()
(hardcoded my realm for now). Now the NFS client object is found, however
password
authentication fails:

  auth_check_password_send: Checking password for unmapped user
[MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr:
(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))
  dn:
<GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
  sAMAccountName: nfsclient_nfs$
  userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST
  servicePrincipalName: nfs/nfsclient.mydom.test
  servicePrincipalName: host/nfsclient_nfs.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
after wrong password
  auth_check_password_recv: sam_ignoredomain authentication for user
[MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD

As the whole NFS thing is krb5 based, I guess checking NTLM passwords
(with zero-length) is not the way to go ...

Any ideas / patches welcome ...

Marcel


-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Dienstag, 1. September 2015 11:25
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just started to debug things on the samba4 side:

When trying to mount the Windows NFS share, I get the following error on the
samba4 dc (just grepping for nfs in the logs):

  auth_check_password_send: Checking password for unmapped user
[S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
  sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb,
under DC=mydom,DC=test
  auth_check_password_recv: sam_ignoredomain authentication for user
[S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER
>From a first search, it looks like function authsam_search_account() from
source4/auth/ntlm/auth_sam.c does this lookup (and fails).
I guess this search should look something like this:

(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))

I'd like to give this a try, however I've no idea how to get the
required realm name from the parameters available during
authsam_search_account() call.

Please, could someone more familiar with the samba code base provide me with the
required information to do this?

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)

Hi,

has anyone out there tried to get a Windows Server 2012R2 based NFS Server
running against a Samba4 active directory?

I'm currently doing some interop testing, and I cannot get a Windows Server
2012R2 based NFS  server running when using samba as AD.

As far as i can tell, the setup looks good:

I've got Linux based NFS servers and clients  (Ubuntu + SuSE) up and running
fine (krb5 auth against samba DC), but trying to access the Windows NFS server
fails.

Outside the above testbed I've tried to mount NFS shares on a different
Windows Server (joined against our MS AD) and access from Linux clients works
fine here, so I guess it's not MS NFS server itself that's causing the
trouble.


The failing windows NFS Server reports lots of messages like:

"Server for NFS was unable to obtain security information for the GSS user
account MYDOM.TEST\nfs/nfsclient.mydom.test.

Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional
information in the Windows Security event log.

MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"

The security log reports:

"An account failed to log on.

Subject:
        Security ID:            SYSTEM
        Account Name:           WIN12$
        Account Domain:         MYDOM
        Logon ID:               0x3E7

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           nfs/nfsclient.mydom.test
        Account Domain:         MYDOM.TEST

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xC000006D
        Sub Status:             0xC0000064

Process Information:
        Caller Process ID:      0x4
        Caller Process Name:

Network Information:
        Workstation Name:
        Source Network Address: -
        Source Port:            -

Detailed Authentication Information:
        Logon Process:          NfsSvr
        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Transited Services:     -
        Package Name (NTLM only):       -
        Key Length:             0

This event is generated when a logon request fails. It is generated on the
computer where access was attempted.

The Subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most
common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system
requested the logon.

The Network Information fields indicate where a remote logon request originated.
Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this
specific logon request.
        - Transited services indicate which intermediate services have
participated in this logon request.
        - Package name indicates which sub-protocol was used among the NTLM
protocols.
        - Key length indicates the length of the generated session key. This
will be 0 if no session key was requested.
"

For me it looks like Windows NFS server does some additional/different lookups
that fail on a samba backend but succeed against a Windows AD, but that's
just a guess.

Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting
a certain log level maybe)?

Any other ideas what could cause this?

Marcel

BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest
git version of samba.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Ritter, Marcel (RRZE)

2015-Sep-02 06:42 UTC

head link

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi Louis,

thanks for pointing out some of the specialities of kerberos,
however I know about these and they're not the cause of my
current problem :-(

The SPNs look fine to me (but just to mention another speciality
of NFS/kerberos/AD: Windows kerberos implementation handles
ServicePrincipalNames (SPNs) quite different from UserPrincipalNames
(UPNs) - that's the reason for the separate AD object mentioned below).

Windows (NFS) Server:

User CN=WIN12,CN=Computers,DC=mydom,DC=test has the following
servicePrincipalName:
         HOST/win12.mydom.test
         RestrictedKrbHost/win12.mydom.test
         HOST/WIN12
         RestrictedKrbHost/WIN12
         WSMAN/win12.mydom.test
         WSMAN/win12
         nfs/win12.mydom.test
         nfs/WIN12
         TERMSRV/win12.mydom.test
         TERMSRV/WIN12

Linux (NFS) Client:

User CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test has the following
servicePrincipalName:
         nfs/nfsclient.mydom.test
         host/nfsclient_nfs.mydom.test

The NFS Client has 2 separate objects in the samba AD:

One created by "net ads join" containing the typical HOSTNAME$
(used for winbindd) and another one for nfs/* (that's the one listed above).

The nfs/* credentials are stored in a separate keytab (that's used
by rpc.gssd). I know that newer versions of nfs-utils can also use the
HOSTNAME$ principals, but as we're in an interop test, we're trying
to make things work for as much clients/servers as possible.

Jeremy asked to open a bug on this topic and to provide logs and network
traces, so that'll be my next step.

Thanks for your comments and help,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H. van
Belle
Gesendet: Dienstag, 1. September 2015 15:44
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Try this on your samba DC. 

amba-tool spn list PCNAME$ 

You should see something like: 

PCNAME$$
User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following
servicePrincipalName:
         HOST/PCNAME
         HOST/PCNAME.internal.domain.tld
	   nfs/PCNAME.internal.domain.tld
         nfs/PCNAME.internal.domain.tld at YOUR_REALM 

can you confirm this for both your servers which you want to use nfs on. 

And host/pcname is not HOST/PCNAME
These must match depending on what the software wants. 
For example, my zarafa mail server software must have : HTTP/mail....  
And not http/mail.... 

Greetz, 

Louis




-----Oorspronkelijk bericht-----
Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel
(RRZE)
Verzonden: dinsdag 1 september 2015 15:04
Aan: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just hacked the code to also query userPrincipalName in
authsam_search_account() (hardcoded my realm for now). Now the NFS client object
is found, however password authentication fails:

  auth_check_password_send: Checking password for unmapped user
[MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr:
(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))
  dn:
<GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
  sAMAccountName: nfsclient_nfs$
  userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST
  servicePrincipalName: nfs/nfsclient.mydom.test
  servicePrincipalName: host/nfsclient_nfs.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user
nfs/nfsclient.mydom.test
  Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
after wrong password
  auth_check_password_recv: sam_ignoredomain authentication for user
[MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD

As the whole NFS thing is krb5 based, I guess checking NTLM passwords (with
zero-length) is not the way to go ...

Any ideas / patches welcome ...

Marcel


-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Dienstag, 1. September 2015 11:25
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just started to debug things on the samba4 side:

When trying to mount the Windows NFS share, I get the following error on the
samba4 dc (just grepping for nfs in the logs):

  auth_check_password_send: Checking password for unmapped user
[S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]
from workstation []
  auth_check_password_send: mapped user is:
[MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
  sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb,
under DC=mydom,DC=test
  auth_check_password_recv: sam_ignoredomain authentication for user
[S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER

From a first search, it looks like function authsam_search_account() from
source4/auth/ntlm/auth_sam.c does this lookup (and fails).

I guess this search should look something like this:

(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test
at MYDOM.TEST))(objectclass=user))

I'd like to give this a try, however I've no idea how to get the
required realm name from the parameters available during
authsam_search_account() call.

Please, could someone more familiar with the samba code base provide me with the
required information to do this?

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter,
Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)

Hi,

has anyone out there tried to get a Windows Server 2012R2 based NFS Server
running against a Samba4 active directory?

I'm currently doing some interop testing, and I cannot get a Windows Server
2012R2 based NFS  server running when using samba as AD.

As far as i can tell, the setup looks good:

I've got Linux based NFS servers and clients  (Ubuntu + SuSE) up and running
fine (krb5 auth against samba DC), but trying to access the Windows NFS server
fails.

Outside the above testbed I've tried to mount NFS shares on a different
Windows Server (joined against our MS AD) and access from Linux clients works
fine here, so I guess it's not MS NFS server itself that's causing the
trouble.


The failing windows NFS Server reports lots of messages like:

"Server for NFS was unable to obtain security information for the GSS user
account MYDOM.TEST\nfs/nfsclient.mydom.test.

Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional
information in the Windows Security event log.

MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"

The security log reports:

"An account failed to log on.

Subject:
        Security ID:            SYSTEM
        Account Name:           WIN12$
        Account Domain:         MYDOM
        Logon ID:               0x3E7

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           nfs/nfsclient.mydom.test
        Account Domain:         MYDOM.TEST

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xC000006D
        Sub Status:             0xC0000064

Process Information:
        Caller Process ID:      0x4
        Caller Process Name:

Network Information:
        Workstation Name:
        Source Network Address: -
        Source Port:            -

Detailed Authentication Information:
        Logon Process:          NfsSvr
        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Transited Services:     -
        Package Name (NTLM only):       -
        Key Length:             0

This event is generated when a logon request fails. It is generated on the
computer where access was attempted.

The Subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most
common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system
requested the logon.

The Network Information fields indicate where a remote logon request originated.
Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this
specific logon request.
        - Transited services indicate which intermediate services have
participated in this logon request.
        - Package name indicates which sub-protocol was used among the NTLM
protocols.
        - Key length indicates the length of the generated session key. This
will be 0 if no session key was requested.
"

For me it looks like Windows NFS server does some additional/different lookups
that fail on a samba backend but succeed against a Windows AD, but that's
just a guess.

Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting
a certain log level maybe)?

Any other ideas what could cause this?

Marcel

BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest
git version of samba.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Reasonably Related Threads

Search for more apparently analagous threads

samba - Sep 2015 - Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Reasonably Related Threads