samba - May 2018 - Why am I getting login failures for domain members?

HI!
The strange thing is that the problem (error in the logs) only runs when 
the authentication trigger comes from IIS ....
Not the problem in DC, authentication via Windows machines or Winbind 
(other servers) all working.

What procedures do you want to help? Do we procdir some data loss or 
something?
Which procedure to open the bug?

Thank you.



On 29-05-2018 01:08, Andrew Bartlett wrote:
> On Mon, 2018-05-28 at 17:50 -0300, Carlos via samba wrote:
>> Hi!
>>
>> My DC is running Samba 4.8.2(Ubuntu 16)
>>
>> I have windows 2016(member domain), running IIS...
>>
>> But my site in IIS, use user the DC (in portal), but now dont worked ,
>> is much erro in log.samba when autentcation in site with user dc...
>>
>> Any Idea?
> G'Day Carlos,
>
> A Signal 11 is a very serious thing in Samba, and should never happen,
> if you could get a gdb backtrace it would be wonderful.
>
> There is a suitable script in selftest/gdb_backtrace to set as the
> 'panic action' if you can.
>
> You are most welcome to open a bug on bugzilla to track this.
>
> Thanks,
>
> Andrew Bartlett
>

Every so often I get a message in /var/log/samba/log.samba as follows:

2018/05/26 13:44:25.172415, 2] authentication for user [HPRS/LABRAT$] FAILED
with error NT_STATUS_WRONG_PASSWORD

Normally, I get this when a user types in the wrong password.  However, in this
case LABRAT$ is
not a user but rather a Linux domain member computer.  This happens periodically
on every Linux
domain member on the domain. 

Why? Is it a problem? Is there something I can do to fix this?

--Mark

No ideas on this? Anybody?

--Mark

-----Original Message-----
Date: Tue, 29 May 2018 09:27:36 -0400
Organization: Ohio Highway Patrol Retirement System
To: samba at lists.samba.org
Subject: [Samba] Why am I getting login failures for domain members?

Every so often I get a message in /var/log/samba/log.samba as follows:

2018/05/26 13:44:25.172415, 2] authentication for user [HPRS/LABRAT$] FAILED
with error NT_STATUS_WRONG_PASSWORD

Normally, I get this when a user types in the wrong password.  However, in this
case LABRAT$ is
not a user but rather a Linux domain member computer.  This happens periodically
on every Linux
domain member on the domain. 

Why? Is it a problem? Is there something I can do to fix this?

--Mark

On Tue, 2018-05-29 at 10:16 -0300, Carlos via samba
wrote:
> HI!
> The strange thing is that the problem (error in the logs) only runs when 
> the authentication trigger comes from IIS ....
> Not the problem in DC, authentication via Windows machines or Winbind 
> (other servers) all working.
> 
> What procedures do you want to help? Do we procdir some data loss or 
> something?
> Which procedure to open the bug?
I'm sorry for dropping the ball on this, I would like you to open a bug
on this, and send me a gdb backtrace privately.

The Samba sources include a handy gdb_backtrace script, which you can
enable with:

panic action = path_to/gdb_backtrace %d

That will help a lot in understanding what is wrong.

Even as a start, upgrading to samba 4.8.3 will get you a simple
backtrace we can start to at least categorise the error with, but we
will need the full thing from a developer or debug build to really
understand it.

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba