Omnis ludis - games
2024-Jun-05 12:25 UTC
[Samba] Failed to bind to uuid NT_STATUS_LOGON_FAILURE
Yes, well, I understand that you can't use sssd, but I already have this problem and I'm asking for help, what can I do to make samba accept the computer password back and everything works again, any tip in this direction maybe I need to fix some keytab or change kvno somewhere, any hint in this the direction would give a chance that even such a problem can be fixed ??, 5 ???. 2024??. ? 15:17, Christian Naumer via samba < samba at lists.samba.org>:> Hi there, > NEVER ever use sssd on a DC!!!!!! I did this once and sssd moved the DC > from OU "Domain Controllers" to "Domain Computers". Even if this did not > happen for you I still repeat "DO NOT DO THIS" Sorry for all the captal > letters but this nearly broke my AD. I was lucky at the time that I had > 3 more DCs. > You can enable login to the DC with domain accounts without sssd. See here: > > https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC > > > Regards > > > Christian > > Am 05.06.24 um 14:02 schrieb Omnis ludis - games via samba: > > Good afternoon, tell me, this error occurs on the domain controller > samba v > > 4.19.0, I paired the domain controller with sssd so that authentication > > occurs under domain accounts on the domain controller, but as you know, > > sssd changes the machine password every 30 days if this option is not > > disabled > > ad_maximum_machine_account_password_age = 0 > > I haven?t disabled it for 30 days and as I understand it, the password > has > > changed and when I call samba-tool drs showrepl the following error > occurs > > samba-tool drs showrepl -d 5 > > INFO: Current debug levels: > > lpcfg_load: refreshing parameters from /opt/samba/etc/smb.conf > > ldb_wrap open of secrets.ldb > > GENSEC backend 'gssapi_spnego' registered > > GENSEC backend 'gssapi_krb5' registered > > GENSEC backend 'gssapi_krb5_sasl' registered > > GENSEC backend 'spnego' registered > > GENSEC backend 'schannel' registered > > GENSEC backend 'ncalrpc_as_system' registered > > GENSEC backend 'sasl-EXTERNAL' registered > > GENSEC backend 'ntlmssp' registered > > GENSEC backend 'ntlmssp_resume_ccache' registered > > GENSEC backend 'http_basic' registered > > GENSEC backend 'http_ntlm' registered > > GENSEC backend 'http_negotiate' registered > > GENSEC backend 'krb5' registered > > GENSEC backend 'fake_gssapi_krb5' registered > > Using binding ncacn_ip_tcp:dc1.red-soft.biz[,seal] > > Mapped to DCERPC endpoint 135 > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > netmask=255.255.255.0 > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > netmask=255.255.255.0 > > resolve_lmhosts: Attempting lmhosts lookup for name dc1.test.dom<0x20> > > startlmhosts: Can't open lmhosts file /opt/samba/etc/lmhosts. Error was > No > > such file or directory > > Mapped to DCERPC endpoint 49153 > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > netmask=255.255.255.0 > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > netmask=255.255.255.0 > > resolve_lmhosts: Attempting lmhosts lookup for name dc1.red-soft.biz > <0x20> > > startlmhosts: Can't open lmhosts file /opt/samba/etc/lmhosts. Error was > No > > such file or directory > > Starting GENSEC mechanism spnego > > Starting GENSEC submechanism gssapi_krb5 > > Received smb_krb5 packet of length 294 > > Received smb_krb5 packet of length 203 > > Failed to get kerberos credentials: kinit for DC1$@TEST.DOM failed > > (Preauthentication failed) > > Wrong username or password: kinit for DC1$@TEST.DOM failed > > (Preauthentication failed) > > gensec_update_done: gssapi_krb5[0x55d227285240]: NT_STATUS_LOGON_FAILURE > > gensec_spnego_create_negTokenInit_step: gssapi_krb5: creating > > NEG_TOKEN_INIT for ldap/DC1.TEST.DOM failed (next[ntlmssp]): > > NT_STATUS_LOGON_FAILURE > > Starting GENSEC submechanism ntlmssp > > Got challenge flags: > > Got NTLMSSP neg_flags=0x62898235 > > NTLMSSP_NEGOTIATE_UNICODE > > NTLMSSP_REQUEST_TARGET > > NTLMSSP_NEGOTIATE_SIGN > > NTLMSSP_NEGOTIATE_SEAL > > NTLMSSP_NEGOTIATE_NTLM > > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > > NTLMSSP_TARGET_TYPE_DOMAIN > > NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY > > NTLMSSP_NEGOTIATE_TARGET_INFO > > NTLMSSP_NEGOTIATE_VERSION > > NTLMSSP_NEGOTIATE_128 > > NTLMSSP_NEGOTIATE_KEY_EXCH > > NTLMSSP: Set final flags: > > Got NTLMSSP neg_flags=0x62088235 > > NTLMSSP_NEGOTIATE_UNICODE > > NTLMSSP_REQUEST_TARGET > > NTLMSSP_NEGOTIATE_SIGN > > NTLMSSP_NEGOTIATE_SEAL > > NTLMSSP_NEGOTIATE_NTLM > > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > > NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY > > NTLMSSP_NEGOTIATE_VERSION > > NTLMSSP_NEGOTIATE_128 > > NTLMSSP_NEGOTIATE_KEY_EXCH > > NTLMSSP Sign/Seal - Initialising with flags: > > Got NTLMSSP neg_flags=0x62088235 > > NTLMSSP_NEGOTIATE_UNICODE > > NTLMSSP_REQUEST_TARGET > > NTLMSSP_NEGOTIATE_SIGN > > NTLMSSP_NEGOTIATE_SEAL > > NTLMSSP_NEGOTIATE_NTLM > > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > > NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY > > NTLMSSP_NEGOTIATE_VERSION > > NTLMSSP_NEGOTIATE_128 > > NTLMSSP_NEGOTIATE_KEY_EXCH > > dcerpc: alter_resp - rpc fault: DCERPC_FAULT_SEC_PKG_ERROR > > Failed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for > > > ncacn_ip_tcp:10.81.0.250[49153,seal,target_hostname=dc1.test.dom,abstract_syntax=e3514235-4b06-11d1-ab04-00c04fc2dcd2/0x00000004,localaddress=10.81.0.250] > > NT_STATUS_LOGON_FAILURE > > ERROR(<class 'samba.drs_utils.drsException'>): DRS connection to > > dc1.test.dom failed - drsException: DRS connection to dc1.test.dom > failed: > > (3221225581, 'The attempted logon is invalid. This is either due to a bad > > username or authentication information.') > > File "samba/netcmd/drs.py", line 55, in > samba.netcmd.drs.drsuapi_connect > > File "samba/drs_utils.py", line 78, in samba.drs_utils.drsuapi_connect > > > > > > even if you can tell me the direction why this could happen, I will be > > grateful, here is my samba config > > # Global parameters > > [global] > > netbios name = DC1 > > realm = TEST.DOM > > server role = active directory domain controller > > server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, > drepl, > > winbindd, ntp_signd, kcc, dnsupdate > > workgroup = TEST > > idmap_ldb:use rfc2307 = yes > > map acl inherit = yes > > allow dns updates = nonsecure > > dsdb:schema update allowed = true > > ldap server require strong auth = no > > dedicated keytab file = /etc/krb5.keytab > > kerberos method = dedicated keytab > > > > > > [sysvol] > > path = /opt/samba/var/locks/sysvol > > read only = No > > > > [netlogon] > > path = /opt/samba/var/locks/sysvol/red-soft.biz/scripts > > read only = No > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >
Christian Naumer
2024-Jun-05 12:29 UTC
[Samba] Failed to bind to uuid NT_STATUS_LOGON_FAILURE
Am 05.06.24 um 14:25 schrieb Omnis ludis - games:> Yes, well, I understand that you can't use sssd, but I already have this > problem and I'm asking for help, what can I do to make samba accept the > computer password back and everything works again, any tip in this > direction maybe I need to fix some keytab or change kvno somewhere, any > hint in this the direction would give a chance that even such a problem > can be fixedRejoin the domain if you have another DC! If you don't.... puh. Did you use /etc/krb5.keytab with sssd? Regards Christian
Andrew Bartlett
2024-Jun-05 19:56 UTC
[Samba] How to cope when you changed the DC's own account password
This is the tool to fix it, assuming only the password was changed: ./source4/scripting/devel/chgtdcpass If run from a source tree that it now how you built Samba, you may need to specify options to point at the right paths etc. A long-desired feature of mine is to have Samba refused to accept a password change on or deletion of it's own DC account. If the account was deleted, my only suggestion is to hope enough of the system is still working to join a new DC. I might do that anyway, if I couldn't be totally sure. Finally, the backup/restore tooling might also work, as we delete the DC account and rebuild it on the restored DC. But that is much the same disruption as joining a new DC. Andrew Bartlett On Wed, 2024-06-05 at 15:25 +0300, Omnis ludis - games via samba wrote:> Yes, well, I understand that you can't use sssd, but I already have > thisproblem and I'm asking for help, what can I do to make samba > accept thecomputer password back and everything works again, any tip > in thisdirection maybe I need to fix some keytab or change kvno > somewhere, anyhint in this the direction would give a chance that > even such a problem canbe fixed > ??, 5 ???. 2024??. ? 15:17, Christian Naumer via samba < > samba at lists.samba.org>: > > Hi there,NEVER ever use sssd on a DC!!!!!! I did this once and sssd > > moved the DCfrom OU "Domain Controllers" to "Domain Computers". > > Even if this did nothappen for you I still repeat "DO NOT DO THIS" > > Sorry for all the captalletters but this nearly broke my AD. I was > > lucky at the time that I had3 more DCs.You can enable login to the > > DC with domain accounts without sssd. See here: > > https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC > > > > > > Regards > > > > Christian > > Am 05.06.24 um 14:02 schrieb Omnis ludis - games via samba: > > > Good afternoon, tell me, this error occurs on the domain > > > controller > > samba v > > > 4.19.0, I paired the domain controller with sssd so that > > > authenticationoccurs under domain accounts on the domain > > > controller, but as you know,sssd changes the machine password > > > every 30 days if this option is > > > notdisabledad_maximum_machine_account_password_age = 0I haven?t > > > disabled it for 30 days and as I understand it, the password > > has > > > changed and when I call samba-tool drs showrepl the following > > > error > > occurs > > > samba-tool drs showrepl -d 5INFO: Current debug > > > levels:lpcfg_load: refreshing parameters from > > > /opt/samba/etc/smb.confldb_wrap open of secrets.ldbGENSEC backend > > > 'gssapi_spnego' registeredGENSEC backend 'gssapi_krb5' > > > registeredGENSEC backend 'gssapi_krb5_sasl' registeredGENSEC > > > backend 'spnego' registeredGENSEC backend 'schannel' > > > registeredGENSEC backend 'ncalrpc_as_system' registeredGENSEC > > > backend 'sasl-EXTERNAL' registeredGENSEC backend 'ntlmssp' > > > registeredGENSEC backend 'ntlmssp_resume_ccache' registeredGENSEC > > > backend 'http_basic' registeredGENSEC backend 'http_ntlm' > > > registeredGENSEC backend 'http_negotiate' registeredGENSEC > > > backend 'krb5' registeredGENSEC backend 'fake_gssapi_krb5' > > > registeredUsing binding ncacn_ip_tcp:dc1.red- > > > soft.biz[,seal]Mapped to DCERPC endpoint 135added interface ens3 > > > ip=10.81.0.250 bcast=10.81.0.255 > > netmask=255.255.255.0 > > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > > netmask=255.255.255.0 > > > resolve_lmhosts: Attempting lmhosts lookup for name > > > dc1.test.dom<0x20>startlmhosts: Can't open lmhosts file > > > /opt/samba/etc/lmhosts. Error was > > No > > > such file or directoryMapped to DCERPC endpoint 49153added > > > interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > > netmask=255.255.255.0 > > > added interface ens3 ip=10.81.0.250 bcast=10.81.0.255 > > netmask=255.255.255.0 > > > resolve_lmhosts: Attempting lmhosts lookup for name dc1.red- > > > soft.biz > > <0x20> > > > startlmhosts: Can't open lmhosts file /opt/samba/etc/lmhosts. > > > Error was > > No > > > such file or directoryStarting GENSEC mechanism spnegoStarting > > > GENSEC submechanism gssapi_krb5Received smb_krb5 packet of length > > > 294Received smb_krb5 packet of length 203Failed to get kerberos > > > credentials: kinit for DC1$@TEST.DOM failed(Preauthentication > > > failed)Wrong username or password: kinit for DC1$@TEST.DOM > > > failed(Preauthentication failed)gensec_update_done: gssapi_krb5[0x55d227285240]: NT_STATUS_LOGON_FAILUREgensec_spnego_create_negTokenInit_step: gssapi_krb5: creatingNEG_TOKEN_INIT for ldap/DC1.TEST.DOM failed (next[ntlmssp]):NT_STATUS_LOGON_FAILUREStarting GENSEC submechanism ntlmsspGot challenge flags:Got NTLMSSP neg_flags=0x62898235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_TARGET_TYPE_DOMAIN NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCHNTLMSSP: Set final flags:Got NTLMSSP neg_flags=0x62088235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCHNTLMSSP Sign/Seal - Initialising with flags:Got NTLMSSP neg_flags=0x62088235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCHdcerpc: alter_resp - rpc fault: DCERPC_FAULT_SEC_PKG_ERRORFailed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for > > ncacn_ip_tcp:10.81.0.250[49153,seal,target_hostname=dc1.test.dom,ab > > stract_syntax=e3514235-4b06-11d1-ab04- > > 00c04fc2dcd2/0x00000004,localaddress=10.81.0.250] > > > NT_STATUS_LOGON_FAILUREERROR(<class > > > 'samba.drs_utils.drsException'>): DRS connection todc1.test.dom > > > failed - drsException: DRS connection to dc1.test.dom > > failed: > > > (3221225581, 'The attempted logon is invalid. This is either due > > > to a badusername or authentication information.') File > > > "samba/netcmd/drs.py", line 55, in > > samba.netcmd.drs.drsuapi_connect > > > File "samba/drs_utils.py", line 78, in > > > samba.drs_utils.drsuapi_connect > > > > > > even if you can tell me the direction why this could happen, I > > > will begrateful, here is my samba config# Global > > > parameters[global] netbios name = DC1 realm > > > TEST.DOM server role = active directory domain > > > controller server services = s3fs, rpc, nbt, wrepl, ldap, > > > cldap, kdc, > > drepl, > > > winbindd, ntp_signd, kcc, dnsupdate workgroup > > > TEST idmap_ldb:use rfc2307 = yes map acl inherit > > > = yes allow dns updates = nonsecure dsdb:schema > > > update allowed = true ldap server require strong auth > > > no dedicated keytab file > > > /etc/krb5.keytab kerberos method = dedicated keytab > > > > > > [sysvol] path = /opt/samba/var/locks/sysvol read > > > only = No > > > [netlogon] path = /opt/samba/var/locks/sysvol/red- > > > soft.biz/scripts read only = No > > > > --To unsubscribe from this list go to the following URL and read > > theinstructions: https://lists.samba.org/mailman/options/samba > >-- Andrew Bartlett (he/him) https://samba.org/~abartlet/Samba Team Member (since 2001) https://samba.orgSamba Team Lead https://catalyst.net.nz/services/sambaCatalyst.Net Ltd Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group company Samba Development and Support: https://catalyst.net.nz/services/samba Catalyst IT - Expert Open Source Solutions