samba - Jan 2017 - kerberos_kinit_password failed: Preauthentication failed

Hello!

My smb.conf

[global]
         workgroup = <DOMAIN>
         realm = <SUBDOMAIN.DOMAIN.COM.BR>

         security = ADS
         idmap config * : backend = rid
         idmap config * : range = 100000-999999

         client schannel = no
         allow trusted domains = yes
         winbind use default domain = yes
         winbind refresh tickets = Yes
         winbind offline logon = no
         winbind cache time = 60
         winbind enum users  = yes
         winbind enum groups = yes
         template shell = /bin/bash
         template homedir = /home/%U

         vfs objects = acl_xattr
         map acl inherit = yes
         store dos attributes = yes

       .....

         [SHARE]

      .......

Thanks



Em 08-01-2017 17:08, Rowland Penny via samba escreveu:
> On Sun, 8 Jan 2017 16:38:37 -0200
> "Carlos A. P. Cunha via samba" <samba at lists.samba.org>
wrote:
>
>> Hello!
>> I am having these messages in syslog
>>
>> Kerberos_kinit_password SERVER$@<MY-DOMAIN> failed:
Preauthentication
>> failed
>>
>> With this, my winbind is not working, so I need to restart winbind
>> cache (net cache flush), this is happening every 24 hours.
>>
>> Any idea ?
>>
>> Server:
>> Ubuntu 14.04.3 LTS
>> Version 4.4.4
>>
>> Client:
>> Ubuntu 16.04.1 LTS
>> Version 4.3.11-Ubuntu
>>
>>
>>
>> Thanks
>>
>>
> Can you post your smb.conf files
>
> Rowland
>

On Sun, 8 Jan 2017 20:04:41 -0200
"Carlos A. P. Cunha" <carlos.hollow at gmail.com> wrote:
> Hello!
> 
> My smb.conf
> 
> [global]
>          workgroup = <DOMAIN>
>          realm = <SUBDOMAIN.DOMAIN.COM.BR>
> 
>          security = ADS
>          idmap config * : backend = rid
>          idmap config * : range = 100000-999999
> 
>          client schannel = no
>          allow trusted domains = yes
>          winbind use default domain = yes
>          winbind refresh tickets = Yes
>          winbind offline logon = no
>          winbind cache time = 60
>          winbind enum users  = yes
>          winbind enum groups = yes
>          template shell = /bin/bash
>          template homedir = /home/%U
> 
>          vfs objects = acl_xattr
>          map acl inherit = yes
>          store dos attributes = yes
> 
OK, are you using sssd ?, If you are this isn't a Samba problem, or
are you trying to run the Samba AD DC as a subdomain of another
domain ? If you are, sorry but it doesn't (yet) work.

Rowland

Hello!
I do not use sssd use winbind.
When I mentioned in the lines workgroup and realm, they are like this 
(for example)

Workgroup = INTRNAL
Realm = INTERNAL.TESTE.COM.BR

I do not know if that was what caused the confusion ....

Thanks


Em 08-01-2017 20:28, Rowland Penny via samba escreveu:
> On Sun, 8 Jan 2017 20:04:41 -0200
> "Carlos A. P. Cunha" <carlos.hollow at gmail.com> wrote:
>
>> Hello!
>>
>> My smb.conf
>>
>> [global]
>>           workgroup = <DOMAIN>
>>           realm = <SUBDOMAIN.DOMAIN.COM.BR>
>>
>>           security = ADS
>>           idmap config * : backend = rid
>>           idmap config * : range = 100000-999999
>>
>>           client schannel = no
>>           allow trusted domains = yes
>>           winbind use default domain = yes
>>           winbind refresh tickets = Yes
>>           winbind offline logon = no
>>           winbind cache time = 60
>>           winbind enum users  = yes
>>           winbind enum groups = yes
>>           template shell = /bin/bash
>>           template homedir = /home/%U
>>
>>           vfs objects = acl_xattr
>>           map acl inherit = yes
>>           store dos attributes = yes
>>
> OK, are you using sssd ?, If you are this isn't a Samba problem, or
> are you trying to run the Samba AD DC as a subdomain of another
> domain ? If you are, sorry but it doesn't (yet) work.
>
> Rowland
>    
>