thr3ads.net - samba - [Samba] samba-4.18.6: keytab issues [Sep 2023]

If this information is useful, please help other people find it:
Share via:

Stefan G. Weichinger

2023-Sep-27 11:20 UTC

[Samba] samba-4.18.6: keytab issues

Yes, I google all around ...

Debian 12.1, samba-4.18.6 from backports, AD-member server / fileserver.

Customer tells me they have issues with accessing software on a share 
called "myprog" (see below).

keytab issues logged, maybe related maybe not

Tried things around flushing and "net ads keytab" ...

Access as domain admin (trying to check the share from "computer 
management" on a Windows server) fails as well. Although there is this 
parameter "min domain uid = 0" in smb.conf. I don't see in in the
output
of "samba-tool testparm" below.



# smb.conf

# Global parameters
[global]
	dedicated keytab file = /etc/krb5.keytab
	kerberos method = secrets and keytab
	log file = /var/log/samba/%m.log
	log level = 2
	logon home = ""
	logon path = ""
	map to guest = Bad User
	max log size = 150000
	netbios name = SERVER
	printcap name = /dev/null
	realm = MYDOM.AT
	security = ADS
	template homedir = /mnt/samba/Daten/%U
	template shell = /bin/bash
	username map = /etc/samba/smbusers
	winbind nss info = template
	winbind offline logon = Yes
	winbind refresh tickets = Yes
	winbind use default domain = Yes
	workgroup = BUERO
	full_audit:priority = notice
	full_audit:facility = local5
	full_audit:success = mkdir rmdir read pread write pwrite rename unlink
	full_audit:failure = connect
	full_audit:prefix = %u|%I|%m|%S
	idmap config buero:range = 10000-99999
	idmap config buero:backend = rid
	idmap config *:range = 2000-9999
	idmap config *:backend = tdb
	hosts allow = localhost 192.168.16. 172.32.99.
	map acl inherit = Yes
	store dos attributes = Yes
	vfs objects = acl_xattr


### the relevant share


[myprog]
	comment = xy-Programme
	guest ok = Yes
	path = /mnt/samba/xy
	read only = No
	acl_xattr:ignore system acls = yes



### log entries


[2023/09/27 13:04:24.906003,  1] 
../../auth/gensec/spnego.c:1242(gensec_spnego_server_negTokenInit_step)
   gensec_spnego_server_negTokenInit_step: gse_krb5: parsing 
NEG_TOKEN_INIT content failed (next[(null)]): NT_STATUS_LOGON_FAILURE
[2023/09/27 13:04:24.941867,  1] 
../../source3/librpc/crypto/gse.c:712(gse_get_server_auth_token)
   gss_accept_sec_context failed with [ Miscellaneous failure (see 
text): Failed to find cifs/pre01svdeb01 at mydom.AT(kvno 5) in keytab 
MEMORY:cifs_srv_keytab (aes256-cts-hmac-sha1-96)]

### klist

# net ads  keytab list
Vno  Type                                        Principal
   2  aes128-cts-hmac-sha1-96                     cifs/PRE01SVDEB01 at mydom.AT
   2  arcfour-hmac-md5                            cifs/PRE01SVDEB01 at mydom.AT
   2  aes256-cts-hmac-sha1-96                     cifs/SERVER at mydom.AT
   2  aes256-cts-hmac-sha1-96                     cifs/PRE01SVDEB01 at mydom.AT
   2  aes128-cts-hmac-sha1-96 
cifs/server.mydom.at at mydom.AT
   2  aes128-cts-hmac-sha1-96                     cifs/SERVER at mydom.AT
   2  arcfour-hmac-md5 
cifs/server.mydom.at at mydom.AT
   2  arcfour-hmac-md5                            cifs/SERVER at mydom.AT
   2  aes256-cts-hmac-sha1-96 
cifs/server.mydom.at at mydom.AT

Stefan G. Weichinger

2023-Sep-27 11:38 UTC

head link

[Samba] samba-4.18.6: keytab issues

Found this in the journal of smbd:

Sep 17 21:28:12 pre01svdeb01 smbd[1378242]: [2023/09/17 21:28:12.182549, 
  0] ../../source3/smbd/server.c:1746(main)
Sep 17 21:28:12 pre01svdeb01 smbd[1378242]:   smbd version 4.18.6-Debian 
started.
Sep 17 21:28:12 pre01svdeb01 smbd[1378242]:   Copyright Andrew Tridgell 
and the Samba Team 1992-2023
Sep 17 21:28:12 pre01svdeb01 systemd[1]: Started smbd.service - Samba 
SMB Daemon.
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034325, 
  0] ../../source3/smbd/fd_handle.c:39(fd_handle_destructor)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   PANIC: assert failed at 
../../source3/smbd/fd_handle.c(39): (fh->fd == -1) || (fh->fd == AT_FDCWD)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034420, 
  0] ../../lib/util/fault.c:173(smb_panic_log)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: 
==============================================================Sep 19 06:17:34
pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034509,
  0] ../../lib/util/fault.c:174(smb_panic_log)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   INTERNAL ERROR: assert 
failed: (fh->fd == -1) || (fh->fd == AT_FDCWD) in pid 1378756 
(4.18.6-Debian)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034610, 
  0] ../../lib/util/fault.c:178(smb_panic_log)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   If you are running a 
recent Samba version, and if you think this problem is not yet fixed in 
the latest versions, please consider reporting this bug, see 
https://wiki.samba.org/index.php/Bug_Reporting
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034682, 
  0] ../../lib/util/fault.c:183(smb_panic_log)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: 
==============================================================Sep 19 06:17:34
pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.034742,
  0] ../../lib/util/fault.c:184(smb_panic_log)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   PANIC (pid 1378756): 
assert failed: (fh->fd == -1) || (fh->fd == AT_FDCWD) in 4.18.6-Debian
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.035794, 
  0] ../../lib/util/fault.c:292(log_stack_trace)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   BACKTRACE: 27 stack frames:
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #0 
/usr/lib/x86_64-linux-gnu/samba/libgenrand-samba4.so.0(log_stack_trace+0x2e) 
[0x7f3284aa455e]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #1 
/usr/lib/x86_64-linux-gnu/samba/libgenrand-samba4.so.0(smb_panic+0x9) 
[0x7f3284aa47b9]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #2 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(+0x506eb) 
[0x7f3284e876eb]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #3 
/lib/x86_64-linux-gnu/libtalloc.so.2(+0x47af) [0x7f3284a477af]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #4 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(file_free+0xd6) 
[0x7f3284e8d456]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #5 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(vfs_default_durable_reconnect+0x11c1)
[0x7f3284f134f1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #6 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(smbd_smb2_request_process_create+0x11d8)
[0x7f3284ef3dc8]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #7 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(smbd_smb2_request_dispatch+0x1a8a)
[0x7f3284ee91da]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #8 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(+0xb33b1) 
[0x7f3284eea3b1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #9 
/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_invoke_fd_handler+0x91) 
[0x7f3284a348c1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #10 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xee07) [0x7f3284a3ae07]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #11 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xcef7) [0x7f3284a38ef7]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #12 
/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x91) 
[0x7f3284a33ba1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #13 
/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_loop_wait+0x1b) 
[0x7f3284a33e7b]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #14 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xce97) [0x7f3284a38e97]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #15 
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base-samba4.so.0(smbd_process+0x82f) 
[0x7f3284ed71df]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #16 smbd: client 
[192.168.16.173](+0x9e2e) [0x5624a7a51e2e]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #17 
/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_invoke_fd_handler+0x91) 
[0x7f3284a348c1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #18 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xee07) [0x7f3284a3ae07]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #19 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xcef7) [0x7f3284a38ef7]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #20 
/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x91) 
[0x7f3284a33ba1]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #21 
/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_loop_wait+0x1b) 
[0x7f3284a33e7b]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #22 
/lib/x86_64-linux-gnu/libtevent.so.0(+0xce97) [0x7f3284a38e97]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #23 smbd: client 
[192.168.16.173](main+0x149b) [0x5624a7a4f29b]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #24 
/lib/x86_64-linux-gnu/libc.so.6(+0x271ca) [0x7f32848721ca]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #25 
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x85) [0x7f3284872285]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:    #26 smbd: client 
[192.168.16.173](_start+0x21) [0x5624a7a4fb81]
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]: [2023/09/19 06:17:34.036893, 
  0] ../../source3/lib/dumpcore.c:315(dump_core)
Sep 19 06:17:34 pre01svdeb01 smbd[1378756]:   dumping core in 
/var/log/samba/cores/smbd


although that is ~1 week old

The issues with the access are there for months as far I am told. So 
before 4.18

Additional fact:

the software uses some ISAM database ... there might be locking issues.

Some years ago I already did *something* related to this. But I don't 
remember.

samba - Sep 2023 - samba-4.18.6: keytab issues

[Samba] samba-4.18.6: keytab issues

[Samba] samba-4.18.6: keytab issues