Hi Rowland, On Tue, 7 Aug 2018 09:46:24 +0100 Rowland Penny via samba <samba at lists.samba.org> wrote:> > Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: acl: > > spn validation failed for spn[TERMSRV/DB1.MYDOM] uac[0x1000] > > account[db1$] hostname[(null)] nbname[mydom] ntds[(null)] > > forest[mydom.lan] domain[mydom.lan] > > > > At first I thought it was about missing SPN entries, but adding these > > did not resolve the problem: > > > > # samba-tool spn list db1$ > > db1$ > > User CN=db1,CN=Computers,DC=mydom,DC=lan has the following > > servicePrincipalName: TERMSRV/db1 > > TERMSRV/db1.mydom > > TERMSRV/db1.mydom.lan > > > > > > Samba is 4.7.8 and one DC with 4.8.3. > > > > I am fairly sure that 'TERMSRV' is coming from 'spn_update_list' and it > is trying to be added by 'samba_spnupdate'. > There is however a problem, this is the bottom of 'spn_update_list': > > # Only used on Terminal Server mode: > # TERMSRV/${HOSTNAME} > # TERMSRV/${NETBIOSNAME} > > As you can see, all the lines are commented out and should be ignored. > > Have you modified the 'spn_update_list' ?No, in /var/lib/samba/private/spn_update_list the lines you quoted are still commented out. Like I said, after the messages appeared (right after the migration fom the old NT-style domain) I added the TERMSRV entries manually with samba-tool spn add TERMSRV/db1 db1$ samba-tool spn add TERMSRV/db1.mydom db1$ samba-tool spn add TERMSRV/db1.mydom.lan db1$ thinking, this would resolve the issue, but it didn't. However, since TERMSRV is ignored, could one simply ignore these messages as well? Kind Regards, Henry
On Tue, 7 Aug 2018 13:00:57 +0200 Henry Jensen via samba <samba at lists.samba.org> wrote:> Hi Rowland, > > > On Tue, 7 Aug 2018 09:46:24 +0100 > Rowland Penny via samba <samba at lists.samba.org> wrote: > > > > Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: acl: > > > spn validation failed for spn[TERMSRV/DB1.MYDOM] uac[0x1000] > > > account[db1$] hostname[(null)] nbname[mydom] ntds[(null)] > > > forest[mydom.lan] domain[mydom.lan] > > > > > > At first I thought it was about missing SPN entries, but adding > > > these did not resolve the problem: > > > > > > # samba-tool spn list db1$ > > > db1$ > > > User CN=db1,CN=Computers,DC=mydom,DC=lan has the following > > > servicePrincipalName: TERMSRV/db1 > > > TERMSRV/db1.mydom > > > TERMSRV/db1.mydom.lan > > > > > > > > > Samba is 4.7.8 and one DC with 4.8.3. > > > > > > > I am fairly sure that 'TERMSRV' is coming from 'spn_update_list' > > and it is trying to be added by 'samba_spnupdate'. > > There is however a problem, this is the bottom of 'spn_update_list': > > > > # Only used on Terminal Server mode: > > # TERMSRV/${HOSTNAME} > > # TERMSRV/${NETBIOSNAME} > > > > As you can see, all the lines are commented out and should be > > ignored. > > > > Have you modified the 'spn_update_list' ? > > > No, in /var/lib/samba/private/spn_update_list the lines you quoted are > still commented out. > > Like I said, after the messages appeared (right after the migration > fom the old NT-style domain) I added the TERMSRV entries manually > with > > samba-tool spn add TERMSRV/db1 db1$ > samba-tool spn add TERMSRV/db1.mydom db1$ > samba-tool spn add TERMSRV/db1.mydom.lan db1$ > > thinking, this would resolve the issue, but it didn't. > > However, since TERMSRV is ignored, could one simply ignore these > messages as well? > > Kind Regards, > > Henry > >Well, you could, but where are they coming from ? Do you actually use terminal servers ? Can you post your smb.conf files. Rowland
On Tue, 7 Aug 2018 12:51:33 +0100 Rowland Penny via samba <samba at lists.samba.org> wrote:> > > > Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: acl: > > > > spn validation failed for spn[TERMSRV/DB1.MYDOM] uac[0x1000] > > > > account[db1$] hostname[(null)] nbname[mydom] ntds[(null)] > > > > forest[mydom.lan] domain[mydom.lan] > > > > > > > > At first I thought it was about missing SPN entries, but adding > > > > these did not resolve the problem: > > > > > > > > # samba-tool spn list db1$ > > > > db1$ > > > > User CN=db1,CN=Computers,DC=mydom,DC=lan has the following > > > > servicePrincipalName: TERMSRV/db1 > > > > TERMSRV/db1.mydom > > > > TERMSRV/db1.mydom.lan > > > > > > > > > > > > Samba is 4.7.8 and one DC with 4.8.3. > > > > > > > > > > I am fairly sure that 'TERMSRV' is coming from 'spn_update_list' > > > and it is trying to be added by 'samba_spnupdate'. > > > There is however a problem, this is the bottom of 'spn_update_list': > > > > > > # Only used on Terminal Server mode: > > > # TERMSRV/${HOSTNAME} > > > # TERMSRV/${NETBIOSNAME} > > > > > > As you can see, all the lines are commented out and should be > > > ignored. > > > > > > Have you modified the 'spn_update_list' ? > > > > > > No, in /var/lib/samba/private/spn_update_list the lines you quoted are > > still commented out. > > > > Like I said, after the messages appeared (right after the migration > > fom the old NT-style domain) I added the TERMSRV entries manually > > with > > > > samba-tool spn add TERMSRV/db1 db1$ > > samba-tool spn add TERMSRV/db1.mydom db1$ > > samba-tool spn add TERMSRV/db1.mydom.lan db1$ > > > > thinking, this would resolve the issue, but it didn't. > > > > However, since TERMSRV is ignored, could one simply ignore these > > messages as well? > > > > Kind Regards, > > > > Henry > > > > > > Well, you could, but where are they coming from ? > Do you actually use terminal servers ? > > Can you post your smb.conf files.Yes, we are using terminal servers and connecting to various machines via RDP. Indeed all machines regarding those TERMSRV messages are machines at which we use remote dektop services. # cat /etc/samba/smb.conf [global] netbios name = DC1 realm = MYDOM.LAN server role = active directory domain controller workgroup = MYDOM idmap_ldb:use rfc2307 = yes dns forwarder = 1.2.3.4 dsdb:schema update allowed=true [netlogon] path = /var/lib/samba/sysvol/mydom.lan/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No