samba - Apr 2016 - samba-3.6.23-30.el6_7.x86_64 - The trust relationship between this workstation and the primary domain failed

Hi All,

I am running Samba 3.6 in PDC mode (i know, i know...AD upgrade is in the
works).

The most recent update for CentOS 6 (samba-3.6.23-30.el6_7.x86_64) appears
to have caused issues and I was forced to downgrade back
to samba-3.6.23-25.el6_7.x86_64.

When 3.6.23-30 is installed, users running Windows 7 x64 receive the
following error when trying access shares:

"The trust relationship between this workstation and the primary domain
failed".

As soon as I downgrade back to the earlier version, things work as expected.

I found this post, so it does not appear I am alone:

https://lists.centos.org/pipermail/centos/2016-April/158671.html

Curious if anyone else is seeing this, if this is a known bug, or if there
is a fix?

Thanks!

--Bill

On 13/04/16 17:55, Bill Baird wrote:
> Hi All,
>
> I am running Samba 3.6 in PDC mode (i know, i know...AD upgrade is in the
> works).
>
> The most recent update for CentOS 6 (samba-3.6.23-30.el6_7.x86_64) appears
> to have caused issues and I was forced to downgrade back
> to samba-3.6.23-25.el6_7.x86_64.
>
> When 3.6.23-30 is installed, users running Windows 7 x64 receive the
> following error when trying access shares:
>
> "The trust relationship between this workstation and the primary
domain
> failed".
>
> As soon as I downgrade back to the earlier version, things work as
expected.
>
> I found this post, so it does not appear I am alone:
>
> https://lists.centos.org/pipermail/centos/2016-April/158671.html
>
> Curious if anyone else is seeing this, if this is a known bug, or if there
> is a fix?
>
> Thanks!
>
> --Bill
No, this is a fix for a bug, a number of Samba upgrades were released 
yesterday to stop man in the middle attacks.

You need to decide whether you want security or ease of use, knowing 
that your network could be at risk if you go for 'ease of use'.

I would suggest you read the release notes here: 
https://www.samba.org/samba/history/samba-4.4.2.html

I know they are for 4.4.2, but RHEL will have based your update on that.

Rowland

On Wed, 13 Apr 2016, Rowland penny wrote:
> On 13/04/16 17:55, Bill Baird wrote:
>>
>>  When 3.6.23-30 is installed, users running Windows 7 x64 receive the
>>  following error when trying access shares:
>>
>>  "The trust relationship between this workstation and the primary
domain
>>  failed".
>
> No, this is a fix for a bug, a number of Samba upgrades were released 
> yesterday to stop man in the middle attacks.
>
> You need to decide whether you want security or ease of use, knowing that 
> your network could be at risk if you go for 'ease of use'.
>
> I would suggest you read the release notes here: 
> https://www.samba.org/samba/history/samba-4.4.2.html
>
> I know they are for 4.4.2, but RHEL will have based your update on that.
Just wanted to add that on my one remaining CentOS 6 server which I just 
updated to samba-3.6.23-30.el6_7, it works fine for me in Windows, but 
smbclient is broken unless I use -k, with what looks like a similar error:

session setup failed: NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE

Just to follow up, the fix for us was to add "client ipc signing =
auto" to
our smb.conf configuration file.

On Wed, Apr 13, 2016 at 12:55 PM, Bill Baird <bill.baird at phoenixmi.com>
wrote:
> Hi All,
>
> I am running Samba 3.6 in PDC mode (i know, i know...AD upgrade is in the
> works).
>
> The most recent update for CentOS 6 (samba-3.6.23-30.el6_7.x86_64)
> appears to have caused issues and I was forced to downgrade back
> to samba-3.6.23-25.el6_7.x86_64.
>
> When 3.6.23-30 is installed, users running Windows 7 x64 receive the
> following error when trying access shares:
>
> "The trust relationship between this workstation and the primary
domain
> failed".
>
> As soon as I downgrade back to the earlier version, things work as
> expected.
>
> I found this post, so it does not appear I am alone:
>
> https://lists.centos.org/pipermail/centos/2016-April/158671.html
>
> Curious if anyone else is seeing this, if this is a known bug, or if there
> is a fix?
>
> Thanks!
>
> --Bill
>


-- 
*Bill Baird*
Chief Technology Officer
Office: 845-876-8228 x311
Mobile: 203-545-0437
www.phoenixmi.com