thr3ads.net - samba - [Samba] RODC and LDAP via Simple Authentication fails [Jan 2018]

If this information is useful, please help other people find it:
Share via:

Johannes Engel

2018-Jan-22 21:07 UTC

[Samba] RODC and LDAP via Simple Authentication fails

Am 22.01.2018 um 21:39 schrieb Andrew Bartlett:> On Mon, 2018-01-22 at 21:30 +0100, Johannes Engel via samba wrote:
>> [2018/01/22 21:15:50.022197,  2]
>> ../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
>>   auth_check_password_recv: sam_failtrusts authentication for user
>> [MYDOMAIN\ldap] FAILED with error NT_STATUS_NO_TRUST_LSA_SECRET,
>> authoritative=1
> Hmm.  Are you sure the RODC's join to the domain is all OK?Certainly to me it looks ok:

Finding a writeable DC for domain 'my.domain.com'
Found DC dc.my.domain.com
Password for [MYDOMAIN\Administrator]:
workgroup is MYDOMAIN
realm is my.domain.com
Deleted
CN=MYRODC,CN=Servers,CN=MySite,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=com
Adding CN=MYRODC,OU=Domain Controllers,DC=my,DC=domain,DC=com
Adding CN=krbtgt_MYRODC,CN=Users,DC=my,DC=domain,DC=com
Got krbtgt_name=krbtgt_38921
Renaming CN=krbtgt_MYRODC,CN=Users,DC=my,DC=domain,DC=com to
CN=krbtgt_38921,CN=Users,DC=my,DC=domain,DC=com
Adding
CN=MYRODC,CN=Servers,CN=MySite,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=com
Adding CN=NTDS
Settings,CN=MYRODC,CN=Servers,CN=MySite,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=com
Adding CN=RODC Connection (FRS),CN=NTDS
Settings,CN=MYRODC,CN=Servers,CN=MySite,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=com
Adding SPNs to CN=MYRODC,OU=Domain Controllers,DC=my,DC=domain,DC=com
Setting account password for MYRODC$
Enabling account
Calling bare provision
Looking up IPv4 addresses
More than one IPv4 address found. Using 192.168.5.206
Looking up IPv6 addresses
More than one IPv6 address found. Using 2001:1234:5678::1
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
The Kerberos KDC configuration for Samba AD is located at
/var/lib/samba/private/kdc.conf
A Kerberos configuration suitable for Samba AD has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=my,DC=domain,DC=com
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=com]
objects[402/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=com]
objects[804/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=com]
objects[1206/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=com]
objects[1550/1550] linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=my,DC=domain,DC=com] objects[402/1638]
linked_values[0/0]
Partition[CN=Configuration,DC=my,DC=domain,DC=com] objects[804/1638]
linked_values[0/0]
Partition[CN=Configuration,DC=my,DC=domain,DC=com] objects[1206/1638]
linked_values[0/0]
Partition[CN=Configuration,DC=my,DC=domain,DC=com] objects[1608/1638]
linked_values[0/2]
Partition[CN=Configuration,DC=my,DC=domain,DC=com] objects[1638/1638]
linked_values[38/38]
Replicating critical objects from the base DN of the domain
Partition[DC=my,DC=domain,DC=com] objects[100/100] linked_values[39/39]
Partition[DC=my,DC=domain,DC=com] objects[502/566] linked_values[0/82]
Partition[DC=my,DC=domain,DC=com] objects[666/566] linked_values[243/243]
Done with always replicated NC (base, config, schema)
Exop on[CN=MYRODC,OU=Domain Controllers,DC=my,DC=domain,DC=com]
objects[1] linked_values[8]
Exop on[CN=krbtgt_38921,CN=Users,DC=my,DC=domain,DC=com] objects[1]
linked_values[0]
Committing SAM database
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting RODC invocationId
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain MYDOMAIN (SID S-1-5-21-2089342896-204912209-1759679801) as
an RODC

Any thoughts?
Best regards
Johannes

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 512 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20180122/665bc3ad/signature.sig>

Andrew Bartlett

2018-Jan-23 20:54 UTC

head link

[Samba] RODC and LDAP via Simple Authentication fails

On Mon, 2018-01-22 at 22:07 +0100, Johannes Engel via samba
wrote:> Am 22.01.2018 um 21:39 schrieb Andrew Bartlett:
> > On Mon, 2018-01-22 at 21:30 +0100, Johannes Engel via samba wrote:
> > > [2018/01/22 21:15:50.022197,  2]
> > > ../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
> > >   auth_check_password_recv: sam_failtrusts authentication for
user
> > > [MYDOMAIN\ldap] FAILED with error NT_STATUS_NO_TRUST_LSA_SECRET,
> > > authoritative=1
> > 
> > Hmm.  Are you sure the RODC's join to the domain is all OK?
> 
> Certainly to me it looks ok:
..
> Any thoughts?
> Best regards
> Johannes
All I can suggest is trying Samba 4.8rc1.  

The stack involved changed again for 4.8, which might be what is going
on here.  Otherwise it looks like a bug which will need a code fix. 
I've CC'ed Garming who did a lot of the RODC work, I'm not sure
(please
check) if simple binds were in the RODC testsuite, and perhaps the
first thing you could do towards fixing this would be to add such a
failing test.

Sorry,

Andrew Bartlett
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Garming Sam

2018-Jan-23 21:04 UTC

head link

[Samba] RODC and LDAP via Simple Authentication fails

I don't believe there was a test for this. Initial testing seems to
indicate that this is indeed currently broken.


Cheers,

Garming


On 24/01/18 09:54, Andrew Bartlett wrote:> On Mon, 2018-01-22 at 22:07 +0100, Johannes Engel via samba wrote:
>> Am 22.01.2018 um 21:39 schrieb Andrew Bartlett:
>>> On Mon, 2018-01-22 at 21:30 +0100, Johannes Engel via samba wrote:
>>>> [2018/01/22 21:15:50.022197,  2]
>>>> ../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
>>>>   auth_check_password_recv: sam_failtrusts authentication for
user
>>>> [MYDOMAIN\ldap] FAILED with error
NT_STATUS_NO_TRUST_LSA_SECRET,
>>>> authoritative=1
>>> Hmm.  Are you sure the RODC's join to the domain is all OK?
>> Certainly to me it looks ok:
> ..
>
>> Any thoughts?
>> Best regards
>> Johannes
> All I can suggest is trying Samba 4.8rc1.  
>
> The stack involved changed again for 4.8, which might be what is going
> on here.  Otherwise it looks like a bug which will need a code fix. 
> I've CC'ed Garming who did a lot of the RODC work, I'm not sure
(please
> check) if simple binds were in the RODC testsuite, and perhaps the
> first thing you could do towards fixing this would be to add such a
> failing test.
>
> Sorry,
>
> Andrew Bartlett

Maybe Matching Threads

Search for more possibly parallel threads

samba - Jan 2018 - RODC and LDAP via Simple Authentication fails

[Samba] RODC and LDAP via Simple Authentication fails

[Samba] RODC and LDAP via Simple Authentication fails

[Samba] RODC and LDAP via Simple Authentication fails

Maybe Matching Threads