samba - May 2017 - SAMBA v3.6.8 on Solaris 10 NOT working after Windows Server 2008 AD updated

Hello,

My Samba has been working well until I recently run Windows update for DC.

I got the error message below on my client (Windows 8.1 Enterprise
Evaluation OS) when accessing the Samba shares.
" *\\pinnacle** is not accessible.  You might not have permission to use
this network resource.  Contact the administrator of this server to find
out if you have access permissions.* "

I can ping the Samba host and the hostname(pinnacle) is able to be resolved
by DNS.  The network is no problem at all.

Here is my smb.conf:
*[glocal]*
*workgroup = pmh*
*bind interfaces only = yes*
*wins server = 192.168.136.150*
*interfaces = pinnacle/255.255.255.0 <http://255.255.255.0>*
*netbios name = pinnacle*
*security = domain*
*encrypt passwords = yes*
*pid directory = /local/samba/pinnacle/var/locks*
*lock dir = /local/samba/pinnacle/var/locks*
*log file = /local/samba/pinnacle/logs/log.%m*
*log level = 3*
*[share]*
*comment = Shared Resources*
*path = /shared*
*guest only = no*
*mangled names = no*
*public = yes*
*writable = yes*
*create mask = 0664*

I turned on the Samba log and set the 'log level' to 3 for further
troubleshooting, and I got logs as below:
























*[2017/05/24 11:23:25.800563,  3] libsmb/namequery.c:2533(get_dc_list)
get_dc_list: preferred server list: ", *"[2017/05/24 11:23:25.800703, 
3]
libsmb/namequery.c:1741(resolve_lmhosts)  resolve_lmhosts: Attempting
lmhosts lookup for name PMH<0x1c>[2017/05/24 11:23:25.800746,  3]
../libcli/nbt/lmhosts.c:185(resolve_lmhosts_file_as_sockaddr)
resolve_lmhosts: Attempting lmhosts lookup for name PMH<0x1c>[2017/05/24
11:23:25.800779,  3] libsmb/namequery.c:1616(resolve_wins)  resolve_wins:
Attempting wins lookup for name PMH<0x1c>[2017/05/24 11:23:25.800872,  3]
libsmb/namequery.c:1672(resolve_wins)  resolve_wins: using WINS server
192.168.136.150 and tag '*'[2017/05/24 11:23:25.801597,  2]
libsmb/namequery.c:1327(name_query_validator)  Got a positive name query
response from 192.168.136.150 ( 192.168.136.150 )[2017/05/24
11:23:35.802771,  3] libsmb/trusts_util.c:166(enumerate_domain_trusts)
enumerate_domain_trusts: can't locate a DC for domain PMH[2017/05/24
11:23:35.802882,  3] auth/auth.c:219(check_ntlm_password)
check_ntlm_password:  Checking password for unmapped user
[PMH]\[azhou]@[SMBCLIENT] with the new password interface[2017/05/24
11:23:35.802905,  3] auth/auth.c:222(check_ntlm_password)
check_ntlm_password:  mapped user is: [PMH]\[azhou]@[SMBCLIENT][2017/05/24
11:23:35.803092,  3] libsmb/namequery.c:2533(get_dc_list)  get_dc_list:
preferred server list: ", *"[2017/05/24 11:23:45.804975,  2]
auth/auth.c:319(check_ntlm_password)  check_ntlm_password:  Authentication
for user [azhou] -> [azhou] FAILED with error
NT_STATUS_NO_LOGON_SERVERS[2017/05/24 11:23:45.805094,  3]
smbd/error.c:81(error_packet_set)  error packet at smbd/sesssetup.c(124)
cmd=115 (SMBsesssetupX) NT_STATUS_NO_LOGON_SERVERS*

Here is my virtualized env.:

Only DC - Windows Server 2008 evaluation version with the latest update

Samba version 3.6.8 as a file server running Solaris 10 x86 update 8

Client - Windows 8.1 Enterprise Evaluation OS

I doubted something was changed during the Windows update, but am not sure
what they are.  How to get my Samba back to work?


Thanks,
Albert.

Hi Albert,

Am 24.05.2017 um 20:13 schrieb albert samba via samba:
> My Samba has been working well until I recently run Windows update for DC.
> 
> I got the error message below on my client (Windows 8.1 Enterprise
> Evaluation OS) when accessing the Samba shares.
> " *\\pinnacle** is not accessible.  You might not have permission to
use
> this network resource.  Contact the administrator of this server to find
> out if you have access permissions.* "
> 
> Here is my smb.conf:
 > ...
> *security = domain*
3.6 is really old and unsupported. That a Windows update break 
compatibility may happen. I would try it with a supported version.

However, your smb.conf doesn't look like it is from an AD domain member. 
E. g. I miss the "realm" parameter, and "security" should be
set to "ADS".

Can you please check your setup with our domain member documentation:
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member
(Please note that the doc is valid for the supported versions. I'm not 
sure if it is compatible with a 5 year old Samba version)


Regards,
Marc

On Wed, 24 May 2017 20:38:11 +0200
Marc Muehlfeld via samba <samba at lists.samba.org> wrote:
> Hi Albert,
> 
> Am 24.05.2017 um 20:13 schrieb albert samba via samba:
> > My Samba has been working well until I recently run Windows update
> > for DC.
> > 
> > I got the error message below on my client (Windows 8.1 Enterprise
> > Evaluation OS) when accessing the Samba shares.
> > " *\\pinnacle** is not accessible.  You might not have permission
> > to use this network resource.  Contact the administrator of this
> > server to find out if you have access permissions.* "
> > 
> > Here is my smb.conf:
>  > ...
> > *security = domain*
> 
> 3.6 is really old and unsupported. That a Windows update break 
> compatibility may happen. I would try it with a supported version.
That might not be possible, the OP is using Solaris 10.
> 
> However, your smb.conf doesn't look like it is from an AD domain
> member. E. g. I miss the "realm" parameter, and
"security" should be
> set to "ADS".
No it looks like it is from an NT4-style domain client
> 
> Can you please check your setup with our domain member documentation:
> https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member
> (Please note that the doc is valid for the supported versions. I'm
> not sure if it is compatible with a 5 year old Samba version)
There is a chance, 'idmap config' existed on 3.6.

What would be interesting to know, what did the OP upgrade the 'DC'
from ??

Rowland
> 
> 
> Regards,
> Marc
>

My guess

Samba 3.6  (smb v1)
Windows 8.1 after update, disabled smb v1 probely. ( wannacry crypto leak) 
Dont know for sure but that was ms its advice also.

I think its time to update your samba.

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> albert samba via samba
> Verzonden: woensdag 24 mei 2017 20:13
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] SAMBA v3.6.8 on Solaris 10 NOT working 
> after Windows Server 2008 AD updated
> 
> Hello,
> 
> My Samba has been working well until I recently run Windows 
> update for DC.
> 
> I got the error message below on my client (Windows 8.1 
> Enterprise Evaluation OS) when accessing the Samba shares.
> " *\\pinnacle** is not accessible.  You might not have 
> permission to use this network resource.  Contact the 
> administrator of this server to find out if you have access 
> permissions.* "
> 
> I can ping the Samba host and the hostname(pinnacle) is able 
> to be resolved by DNS.  The network is no problem at all.
> 
> Here is my smb.conf:
> *[glocal]*
> *workgroup = pmh*
> *bind interfaces only = yes*
> *wins server = 192.168.136.150*
> *interfaces = pinnacle/255.255.255.0 <http://255.255.255.0>* 
> *netbios name = pinnacle* *security = domain* *encrypt 
> passwords = yes* *pid directory = 
> /local/samba/pinnacle/var/locks* *lock dir = 
> /local/samba/pinnacle/var/locks* *log file = 
> /local/samba/pinnacle/logs/log.%m*
> *log level = 3*
> *[share]*
> *comment = Shared Resources*
> *path = /shared*
> *guest only = no*
> *mangled names = no*
> *public = yes*
> *writable = yes*
> *create mask = 0664*
> 
> I turned on the Samba log and set the 'log level' to 3 for 
> further troubleshooting, and I got logs as below:
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> *[2017/05/24 11:23:25.800563,  3] libsmb/namequery.c:2533(get_dc_list)
> get_dc_list: preferred server list: ", *"[2017/05/24 
> 11:23:25.800703,  3]
> libsmb/namequery.c:1741(resolve_lmhosts)  resolve_lmhosts: 
> Attempting lmhosts lookup for name PMH<0x1c>[2017/05/24 
> 11:23:25.800746,  3]
> ../libcli/nbt/lmhosts.c:185(resolve_lmhosts_file_as_sockaddr)
> resolve_lmhosts: Attempting lmhosts lookup for name 
> PMH<0x1c>[2017/05/24 11:23:25.800779,  3] 
> libsmb/namequery.c:1616(resolve_wins)  resolve_wins:
> Attempting wins lookup for name PMH<0x1c>[2017/05/24 
> 11:23:25.800872,  3]
> libsmb/namequery.c:1672(resolve_wins)  resolve_wins: using 
> WINS server 192.168.136.150 and tag '*'[2017/05/24 
> 11:23:25.801597,  2]
> libsmb/namequery.c:1327(name_query_validator)  Got a positive 
> name query response from 192.168.136.150 ( 192.168.136.150 
> )[2017/05/24 11:23:35.802771,  3] 
> libsmb/trusts_util.c:166(enumerate_domain_trusts)
> enumerate_domain_trusts: can't locate a DC for domain 
> PMH[2017/05/24 11:23:35.802882,  3] 
> auth/auth.c:219(check_ntlm_password)
> check_ntlm_password:  Checking password for unmapped user 
> [PMH]\[azhou]@[SMBCLIENT] with the new password 
> interface[2017/05/24 11:23:35.802905,  3] 
> auth/auth.c:222(check_ntlm_password)
> check_ntlm_password:  mapped user is: 
> [PMH]\[azhou]@[SMBCLIENT][2017/05/24
> 11:23:35.803092,  3] libsmb/namequery.c:2533(get_dc_list)  
> get_dc_list:
> preferred server list: ", *"[2017/05/24 11:23:45.804975,  2]
> auth/auth.c:319(check_ntlm_password)  check_ntlm_password:  
> Authentication for user [azhou] -> [azhou] FAILED with error
> NT_STATUS_NO_LOGON_SERVERS[2017/05/24 11:23:45.805094,  3]
> smbd/error.c:81(error_packet_set)  error packet at 
> smbd/sesssetup.c(124)
> cmd=115 (SMBsesssetupX) NT_STATUS_NO_LOGON_SERVERS*
> 
> Here is my virtualized env.:
> 
> Only DC - Windows Server 2008 evaluation version with the 
> latest update
> 
> Samba version 3.6.8 as a file server running Solaris 10 x86 update 8
> 
> Client - Windows 8.1 Enterprise Evaluation OS
> 
> I doubted something was changed during the Windows update, 
> but am not sure what they are.  How to get my Samba back to work?
> 
> 
> Thanks,
> Albert.
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On Wed, 24 May 2017 21:02:53 +0200
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> My guess
> 
> Samba 3.6  (smb v1)
> Windows 8.1 after update, disabled smb v1 probely. ( wannacry crypto
> leak) Dont know for sure but that was ms its advice also.
> 
> I think its time to update your samba.
> 
I think he may have to change the OS before he can do that, I tried
looking for Samba version 4 packages for Solaris 10 and couldn't find
any. He could always try compiling Samba himself, but this looks like
it has problems as well.

Rowland

On Wed, 24 May 2017 16:34:23 -0400
albert samba <albertzhou.samba at gmail.com> wrote:
> yes, my samba unix box joined to NT4-style domain.  I run 'net rpc
> join' to join the domain as a member server.  I wanted all clients to
> contact Windows DC for authentication, so 'security = domain'
instead
> of ADS.
You may be able to get Samba 3.6 on Solaris to connect to an NT4-style
domain, but windows 8.1 is probably going to be harder, especially as
Microsoft seems to have disabled smb v1 now.

I think you really need to update to AD if you want to use windows 8.1
and you will probably need to to upgrade to a version of Samba on the
Solaris machines that isn't EOL (if you can).

I really think that the days of the NT4-style are over, Microsoft is
making it harder and harder to connect Windows to an NT4-style
domain, hardly surprising really, they abandoned them years ago.
   
Rowland