search for: nt_status_rpc_sec_pkg_error

Hi, I recently upgraded a smb server from Ubuntu 18.04 to Ubuntu 20.04 which required the Samba version to be upgraded from 4.7.6 to 4.15.13. Post the upgrade, winbind authentication fails with NT_STATUS_RPC_SEC_PKG_ERROR intermittently. The error goes away on restarting the smb service but comes back after some time. There were no isses with the setup before the upgrade. Tried clearing the cached tdb files as well but the issue still come back after some time. Logs (replaced domain, username and workstation values...

...t work without them, but when was the last time you ran 'finger' for instance ? I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to fail in around a day which has increased to 2 days now after which the auth calls fail with NT_STATUS_RPC_SEC_PKG_ERROR and winbind needs to be restarted for it to work. We use NTLMv2 for authentication and using the ntlm_auth tool (https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html) returns the same NT_STATUS_RPC_SEC_PKG_ERROR error as well while wbinfo -i returns the correct user info. Is there an...

On Mon, Jul 03, 2023 at 01:10:26AM +0530, Bharath Bheemarasetti via samba wrote: >On further investigation, the error that shows up in packet capture is that >the DC is returning [Fault: nca_s_fault_sec_pkg_error] for the >NetrLogonSamLogonEx call. There are no error logs (or any logs) regarding >the netlogon call failure in the netlogon logs even after enabling debug >logs in the

...21?AM Bharath Bheemarasetti < bharath.bheemarasetti at gmail.com> wrote: > Hi, > I recently upgraded a smb server from Ubuntu 18.04 to Ubuntu 20.04 which > required the Samba version to be upgraded from 4.7.6 to 4.15.13. > Post the upgrade, winbind authentication fails > with NT_STATUS_RPC_SEC_PKG_ERROR intermittently. The error goes away on > restarting the smb service but comes back after some time. There were no > isses with the setup before the upgrade. > Tried clearing the cached tdb files as well but the issue still come back > after some time. > <trimmed the log lines>...

...them, but when > was the last time you ran 'finger' for instance ? > > I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to fail in around a day which has increased to 2 days now after which the auth calls fail with NT_STATUS_RPC_SEC_PKG_ERROR and winbind needs to be restarted for it to work. We use NTLMv2 for authentication and using the ntlm_auth tool (https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html) returns the same NT_STATUS_RPC_SEC_PKG_ERROR error as well while wbinfo -i returns the correct user info. > > Is...

...hen >> was the last time you ran 'finger' for instance ? >> >> I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to fail in around a day which has increased to 2 days now after which the auth calls fail with NT_STATUS_RPC_SEC_PKG_ERROR and winbind needs to be restarted for it to work. We use NTLMv2 for authentication and using the ntlm_auth tool (https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html) returns the same NT_STATUS_RPC_SEC_PKG_ERROR error as well while wbinfo -i returns the correct user info. >> &gt...

...> was the last time you ran 'finger' for instance ? >>> >>> I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to fail in around a day which has increased to 2 days now after which the auth calls fail with NT_STATUS_RPC_SEC_PKG_ERROR and winbind needs to be restarted for it to work. We use NTLMv2 for authentication and using the ntlm_auth tool (https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html) returns the same NT_STATUS_RPC_SEC_PKG_ERROR error as well while wbinfo -i returns the correct user info. >>>...

...the last time you ran 'finger' for instance ? >>>> >>>> I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to fail in around a day which has increased to 2 days now after which the auth calls fail with NT_STATUS_RPC_SEC_PKG_ERROR and winbind needs to be restarted for it to work. We use NTLMv2 for authentication and using the ntlm_auth tool (https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html) returns the same NT_STATUS_RPC_SEC_PKG_ERROR error as well while wbinfo -i returns the correct user info. >>>...

...rked for now making commands like rpcclient working. However, this now breaks the 'net' command: $ sudo net -d10 -U someuser%somepass -S <netapp hostname> share .... ntlmssp3_handle_neg_flags: Got challenge flags[0x60898205] - possible downgrade detected! missing_flags[0x00000010] - NT_STATUS_RPC_SEC_PKG_ERROR Got NTLMSSP neg_flags=0x00000010 NTLMSSP_NEGOTIATE_SIGN neg_flags[0x60088205] Got NTLMSSP neg_flags=0x60088205 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EX...

...lient working. > > However, this now breaks the 'net' command: > > $ sudo net -d10 -U someuser%somepass -S <netapp hostname> share > .... > ntlmssp3_handle_neg_flags: Got challenge flags[0x60898205] - possible > downgrade detected! missing_flags[0x00000010] - > NT_STATUS_RPC_SEC_PKG_ERROR > Got NTLMSSP neg_flags=0x00000010 > NTLMSSP_NEGOTIATE_SIGN > neg_flags[0x60088205] > Got NTLMSSP neg_flags=0x60088205 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 >...

...er, this now breaks the 'net' command: > > > > $ sudo net -d10 -U someuser%somepass -S <netapp hostname> share > > .... > > ntlmssp3_handle_neg_flags: Got challenge flags[0x60898205] - possible > > downgrade detected! missing_flags[0x00000010] - > > NT_STATUS_RPC_SEC_PKG_ERROR > > Got NTLMSSP neg_flags=0x00000010 > > NTLMSSP_NEGOTIATE_SIGN > > neg_flags[0x60088205] > > Got NTLMSSP neg_flags=0x60088205 > > NTLMSSP_NEGOTIATE_UNICODE > > NTLMSSP_REQUEST_TARGET > > NTLMSSP_NEGOTIATE_NTLM > > NTLMSSP_NEGOTIATE_ALWAYS_S...

...BUG 15382: cli_list loops 100% CPU against pre-lanman2 servers. ?? * BUG 15391: smbclient leaks fds with showacls. o? Stefan Metzmacher <metze at samba.org> ?? * BUG 15374: aes256 smb3 encryption algorithms are not allowed in ???? smb3_sid_parse(). ?? * BUG 15413: winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR. o? Jones Syue <jonessyue at qnap.com> ?? * BUG 15403: smbget memory leak if failed to download files recursively. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technica...

...BUG 15382: cli_list loops 100% CPU against pre-lanman2 servers. ?? * BUG 15391: smbclient leaks fds with showacls. o? Stefan Metzmacher <metze at samba.org> ?? * BUG 15374: aes256 smb3 encryption algorithms are not allowed in ???? smb3_sid_parse(). ?? * BUG 15413: winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR. o? Jones Syue <jonessyue at qnap.com> ?? * BUG 15403: smbget memory leak if failed to download files recursively. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technica...