samba - Jul 2023 - **[EXTERNAL]**Re: Samba rejecting authentication from Windows machines

On 20/07/2023 15:02, Kothe Patrik via samba wrote:
> What version of Samba are the DCs running and on what OS ?
>          --> They're still running on 4.13.17 and Debian 10 since
that's the pre-packed version we started with and didn't dare to upgrade
so far.
> Was anything updated on any of the machines ? If so, what ?
>          --> No. We had our monthly maintenance window but there were no
upgrades to the Samba DCs
> This could be more fall out from Microsoft's last update
>          --> What do you mean with this? I haven't read anything in
this direction while searching for the issue.
> 
On the 7th July, Microsoft released a large update, KB5028166 (this also 
seems to have different identities on different Windows versions), after 
the update there were numerous Samba problems, mostly to do with trusts 
and authentication. an interim patch was quickly produced and this seems 
to have mitigated the problem.

I would suggest that upgrading Samba is probably your next step, but you 
will probably have to upgrade to bullseye or bookworm.

Rowland

Thanks for the info. I'm going to uninstall this update on the RSAT-VM to
see if anything changes.

Although I have to add, this doesn't really match with the Trust problem
since it was one week before this MS-patch, that somebody already reported the
current issue. The only difference is, that back then the issue just disappeared
by itself after a few hours. That's why we couldn't investigate it
earlier.

Kind regards
Patrik

-----Original Message-----
From: samba <samba-bounces at lists.samba.org> On Behalf Of Rowland Penny
via samba
Sent: Thursday, 20 July 2023 16:24
To: samba at lists.samba.org
Cc: Rowland Penny <rpenny at samba.org>
Subject: **[EXTERNAL]**Re: [Samba] Samba rejecting authentication from Windows
machines



On 20/07/2023 15:02, Kothe Patrik via samba wrote:
> What version of Samba are the DCs running and on what OS ?
>          --> They're still running on 4.13.17 and Debian 10 since
that's the pre-packed version we started with and didn't dare to upgrade
so far.
> Was anything updated on any of the machines ? If so, what ?
>          --> No. We had our monthly maintenance window but there were
> no upgrades to the Samba DCs This could be more fall out from
Microsoft's last update
>          --> What do you mean with this? I haven't read anything in
this direction while searching for the issue.
>
On the 7th July, Microsoft released a large update, KB5028166 (this also seems
to have different identities on different Windows versions), after the update
there were numerous Samba problems, mostly to do with trusts and authentication.
an interim patch was quickly produced and this seems to have mitigated the
problem.

I would suggest that upgrading Samba is probably your next step, but you will
probably have to upgrade to bullseye or bookworm.

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On 20-07-2023 16:23, Rowland Penny via samba wrote:
>
>
> On 20/07/2023 15:02, Kothe Patrik via samba wrote:
>> What version of Samba are the DCs running and on what OS ?
>> ???????? --> They're still running on 4.13.17 and Debian 10
since
>> that's the pre-packed version we started with and didn't dare
to
>> upgrade so far.
>> Was anything updated on any of the machines ? If so, what ?
>> ???????? --> No. We had our monthly maintenance window but there
were
>> no upgrades to the Samba DCs
>> This could be more fall out from Microsoft's last update
>> ???????? --> What do you mean with this? I haven't read anything
in
>> this direction while searching for the issue.
>>
>
> On the 7th July, Microsoft released a large update, KB5028166 (this 
> also seems to have different identities on different Windows 
> versions), after the update there were numerous Samba problems, mostly 
> to do with trusts and authentication. an interim patch was quickly 
> produced and this seems to have mitigated the problem.
>
> I would suggest that upgrading Samba is probably your next step, but 
> you will probably have to upgrade to bullseye or bookworm.
Yesterday's Samba patch release includes the interim patch mentioned 
above. Packages with those updates for bullseye an bookworm are already 
available in Michael's repo. (Great work, Michael !)

- Kees.
>
>
> Rowland
>