samba - Jul 2018 - Failed to establish your Kerberos Ticket cache due time differences with the domain controller

> 
> Strange, you say the time is okay, but the error says it isn't.
> 
> Try this, open a terminal on both DC's, run 'date' and
'samba-tool
> time' on both. The results should be virtually the same.
> 
> e.g.
> root at dc4:~# samba-tool time
> Sat Jul 21 16:47:43 2018 BST
> root at dc4:~# date
> Sat 21 Jul 16:47:46 BST 2018
> 
> Rowland
> 
Interesting...

On the pi-dc (the one with the error) I get the following:
As root:
root at pi-dc:~# samba-tool time
Sat Jul 21 16:55:20 2018 BST
root at pi-dc:~# date
Sat 21 Jul 16:55:22 BST 2018
root at pi-dc:~#

OK, that's good.

As roy: (AD user)
MICROLYNX\roy at pi-dc:~ $ samba-tool time
ldb: Unable to open tdb '/usr/local/samba/private/secrets.ldb':
Permission denied
ldb: Failed to connect to '/usr/local/samba/private/secrets.ldb' with
backend 'tdb': Unable to open tdb
'/usr/local/samba/private/secrets.ldb': Permission denied
Could not find machine account in secrets database: Failed to fetch machine
account password from secrets.ldb: Could not open secrets.ldb and failed to open
/usr/local/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Sat Jul 21 16:56:00 2018 BST
MICROLYNX\roy at pi-dc:~ $ date
Sat 21 Jul 16:56:10 BST 2018

Maybe expected as roy doesn't have access to the 'private' folder?

On debian-vb, I get the following:
As roy:
MICROLYNX\roy at debian-vb:~$ samba-tool time
ldb: Unable to open tdb '/usr/local/samba/private/secrets.ldb':
Permission denied
ldb: Failed to connect to '/usr/local/samba/private/secrets.ldb' with
backend 'tdb': Unable to open tdb
'/usr/local/samba/private/secrets.ldb': Permission denied
Could not find machine account in secrets database: Failed to fetch machine
account password from secrets.ldb: Could not open secrets.ldb and failed to open
/usr/local/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
ERROR(runtime): uncaught exception - (-1073741823, "Connection to SRVSVC
pipe of server 'debian-vb.microlynx.org' failed:
NT_STATUS_UNSUCCESSFUL")
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/nettime.py",
line 59, in run
    self.outf.write(net.time(server_name)+"\n")
MICROLYNX\roy at debian-vb:~$ date
Sat 21 Jul 16:56:58 BST 2018

As root:
root at debian-vb:~# samba-tool time
ERROR(runtime): uncaught exception - (-1073741823, "Connection to SRVSVC
pipe of server 'debian-vb.microlynx.org' failed:
NT_STATUS_UNSUCCESSFUL")
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/nettime.py",
line 59, in run
    self.outf.write(net.time(server_name)+"\n")
root at debian-vb:~# date
Sat 21 Jul 17:01:21 BST 2018

So it would seem there's something amiss with the original dc (debian-vb)!

Roy

On Sat, 21 Jul 2018 17:09:12 +0100
Roy Eastwood via samba <samba at lists.samba.org> wrote:
> > 
> > Strange, you say the time is okay, but the error says it isn't.
> > 
> > Try this, open a terminal on both DC's, run 'date' and
'samba-tool
> > time' on both. The results should be virtually the same.
> > 
> > e.g.
> > root at dc4:~# samba-tool time
> > Sat Jul 21 16:47:43 2018 BST
> > root at dc4:~# date
> > Sat 21 Jul 16:47:46 BST 2018
> > 
> > Rowland
> > 
> Interesting...
> 
> On the pi-dc (the one with the error) I get the following:
> As root:
> root at pi-dc:~# samba-tool time
> Sat Jul 21 16:55:20 2018 BST
> root at pi-dc:~# date
> Sat 21 Jul 16:55:22 BST 2018
> root at pi-dc:~#
> 
> OK, that's good.
> 
> As roy: (AD user)
> MICROLYNX\roy at pi-dc:~ $ samba-tool time
> ldb: Unable to open tdb '/usr/local/samba/private/secrets.ldb':
> Permission denied ldb: Failed to connect to
> '/usr/local/samba/private/secrets.ldb' with backend 'tdb':
Unable to
> open tdb '/usr/local/samba/private/secrets.ldb': Permission denied
> Could not find machine account in secrets database: Failed to fetch
> machine account password from secrets.ldb: Could not open secrets.ldb
> and failed to open /usr/local/samba/private/secrets.tdb:
> NT_STATUS_CANT_ACCESS_DOMAIN_INFO Sat Jul 21 16:56:00 2018 BST
> MICROLYNX\roy at pi-dc:~ $ date Sat 21 Jul 16:56:10 BST 2018
> 
> Maybe expected as roy doesn't have access to the 'private'
folder?
> 
> On debian-vb, I get the following:
> As roy:
> MICROLYNX\roy at debian-vb:~$ samba-tool time
> ldb: Unable to open tdb '/usr/local/samba/private/secrets.ldb':
> Permission denied ldb: Failed to connect to
> '/usr/local/samba/private/secrets.ldb' with backend 'tdb':
Unable to
> open tdb '/usr/local/samba/private/secrets.ldb': Permission denied
> Could not find machine account in secrets database: Failed to fetch
> machine account password from secrets.ldb: Could not open secrets.ldb
> and failed to open /usr/local/samba/private/secrets.tdb:
> NT_STATUS_CANT_ACCESS_DOMAIN_INFO ERROR(runtime): uncaught exception
> - (-1073741823, "Connection to SRVSVC pipe of server
> 'debian-vb.microlynx.org' failed: NT_STATUS_UNSUCCESSFUL")
File
>
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 176, in _run return self.run(*args, **kwargs) File
>
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/nettime.py",
> line 59, in run self.outf.write(net.time(server_name)+"\n")
> MICROLYNX\roy at debian-vb:~$ date Sat 21 Jul 16:56:58 BST 2018
> 
> As root:
> root at debian-vb:~# samba-tool time
> ERROR(runtime): uncaught exception - (-1073741823, "Connection to
> SRVSVC pipe of server 'debian-vb.microlynx.org' failed:
> NT_STATUS_UNSUCCESSFUL") File
>
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 176, in _run return self.run(*args, **kwargs) File
>
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/nettime.py",
> line 59, in run self.outf.write(net.time(server_name)+"\n")
> root at debian-vb:~# date Sat 21 Jul 17:01:21 BST 2018
> 
> So it would seem there's something amiss with the original dc
> (debian-vb)!
> 
> Roy
> 
> 
Try restarting Samba on 'debian-vb'.
If this doesn't help, try 'samba-tool dbcheck' and compare the two
DC's
with 'samba-tool ldapcmp'

Rowland

> 
> Try restarting Samba on 'debian-vb'.
> If this doesn't help, try 'samba-tool dbcheck' and compare the
two DC's
> with 'samba-tool ldapcmp'
> 
> Rowland
> 
OK, have tried that but no change.   I used Louis'  script:
samba-check-db-repl.sh which includes samba-tool ldapcmp and samba-tool drs
showrepl it passes both tests.

Roy