search for: sig_size

.../kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/04/16 09:44:43.019958, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) failed: NT_STATUS_ACCESS_DENIED [2016/04/16 09:44:43.020409, 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection) Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED' Giovanni

.../gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 13:12:41.571495, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) failed: NT_STATUS_ACCESS_DENIED ---- I am specifically worried about the "unknonwn mech-code" error which might indicate some issues regarding Kerberos crypto. I am running Samba on Gentoo along with Heimdal 1.5.3-r2. Does anybody have a clue where to look for...

Hello Louis, Thanks for your reply. > No, your output is not good. So let's have a look. > >C:\Temp>netdom verify cyb64w10-monster > >The format of the specified computer name is invalid. > Thats not good. Well, it quite clearly states the format is invalid. If I use the the FQDN of the AD domain it works fine. The DNS search is also including the AD domain as

...et = acr->func->ls_func[falcon_id]->load(subdev, &img->base); if (ret) { + kfree(img->base.ucode_data); + kfree(img->base.sig); kfree(img); return ERR_PTR(ret); } - return img; + /* Check that the signature size matches our expectations... */ + if (img->base.sig_size != sizeof(img->lsb_header.signature)) { + nvkm_error(subdev, "invalid signature size for %s falcon!\n", + nvkm_falcon_name[falcon_id]); + return ERR_PTR(-EINVAL); + } + + /* Copy signature to the right place */ + memcpy(&img->lsb_header.signature, img->base.sig, img-&g...

...nseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 13:12:41.571495, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) > failed: > NT_STATUS_ACCESS_DENIED > ---- > > > I am specifically worried about the "unknonwn mech-code" error which might > indicate some issues regarding Kerberos crypto. I am running Samba on > Gentoo > along with Heimdal 1.5.3-r2. &gt...

.../kerberos/gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/04/16 09:44:43.019958, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) failed: NT_STATUS_ACCESS_DENIED [2016/04/16 09:44:43.020409, 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection) Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED' Giovanni

...beros/gssapi_helper.c:388(gssapi_check_packet) GSS VerifyMic failed: A token had an invalid MIC: unknown mech-code 2529638943 for mech 1 2 840 113554 1 2 2 [2018/02/26 21:08:10.634820, 0] ../source4/auth/gensec/gensec_gssapi.c:1344(gensec_gssapi_check_packet) gssapi_check_packet(hdr_signing=0,sig_size=28,data=171,pdu=171) failed: NT_STATUS_ACCESS_DENIED Any help trying to resolve this will be appreciated, Roy

...ap_iov failed: Miscellaneous failure (see text): unknown > mech- > > code 0 > > for mech 1 2 840 113554 1 2 2 > > [2016/08/03 17:48:48.064868, 0] > > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > > gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) > > failed: > > NT_STATUS_ACCESS_DENIED > > > > > > Many thanks for your patience trying to debug this issue. I am a bit out > > of > > ideas now how to trace this down. All file server services of Samba seem > > to work > >...

...: 0x00000000 (0) buf: ARRAY(0) : NULL ads: struct out ofs : 0x00000000 (0) left : 0x00000000 (0) max_unwrapped : 0x00000000 (0) sig_size : 0x00000000 (0) size : 0x00000000 (0) buf: ARRAY(0) : NULL sitename_fetch: No stored sitename for DOMAIN.LOCAL ads_find_dc: (cldap) looking for realm 'DOMAIN.LOCAL' get_sorted_dc_list: attempting lookup for name...

...packet) >    gss_unwrap_iov failed:  Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 15:17:45.609387,  0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) >    gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) > failed: > NT_STATUS_ACCESS_DENIED > > > I am not fully sure about the MS changes though. My GPO all list > "Authenticated > Users" in the "Security Filtering" section in Scope tab. I unsure where to > insert the "Auth...

Hi all, Since I have upgraded to Samba 4.2.11 I got errors when updating group policy objects (GPO) on my clients (all Windows 7 Professional). When running "gpupdate" from the command line on Windows 7 Pro Domain-Joined clients it states not to be able to resolve the domain controller. According to what I see from the logs it looks like it's related to resolving accounts. I am

.../gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 17:48:48.064868, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) failed: NT_STATUS_ACCESS_DENIED Many thanks for your patience trying to debug this issue. I am a bit out of ideas now how to trace this down. All file server services of Samba seem to work fine. Thanks again Rainer

...os/gssapi_helper.c:391(gssapi_check_packet) GSS VerifyMic failed: A token had an invalid MIC: unknown mech-code 2529638943 for mech 1 2 840 113554 1 2 2 [2020/07/03 09:20:18.211625, 0] ../../source4/auth/gensec/gensec_gssapi.c:1347(gensec_gssapi_check_packet) gssapi_check_packet(hdr_signing=0,sig_size=28,data=241,pdu=241) failed: NT_STATUS_ACCESS_DENIED -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Unencrypted messages have no legal claim to privacy Do NOT open attachments nor follow links sent by e-Mail James B. Byrne...

.../gssapi_helper.c:291(gssapi_unseal_packet) gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech-code 0 for mech 1 2 840 113554 1 2 2 [2016/08/03 15:17:45.609387, 0] ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) failed: NT_STATUS_ACCESS_DENIED I am not fully sure about the MS changes though. My GPO all list "Authenticated Users" in the "Security Filtering" section in Scope tab. I unsure where to insert the "Authenticated Users" group in the GPO with r...

...nseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/04 10:44:54.806331, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=208,pdu=240) > failed: > NT_STATUS_ACCESS_DENIED > > > > > best regards, > Rainer > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba

...nseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown mech- > code 0 > for mech 1 2 840 113554 1 2 2 > [2016/08/03 17:48:48.064868, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) > failed: > NT_STATUS_ACCESS_DENIED > > > Many thanks for your patience trying to debug this issue. I am a bit out > of > ideas now how to trace this down. All file server services of Samba seem > to work > fine. > > Thanks again > Rainer...

...ignature(struct gm200_secboot *gsb, void *acr_image) +{ + struct nvkm_secboot *sb = &gsb->base; + struct fw_bin_header *hsbin_hdr = acr_image; + struct hsf_fw_header *fw_hdr = acr_image + hsbin_hdr->header_offset; + void *hs_data = acr_image + hsbin_hdr->data_offset; + void *sig; + u32 sig_size; + + /* Falcon in debug or production mode? */ + if ((nvkm_rd32(sb->subdev.device, sb->base + 0xc08) >> 20) & 0x1) { + sig = acr_image + fw_hdr->sig_dbg_offset; + sig_size = fw_hdr->sig_dbg_size; + } else { + sig = acr_image + fw_hdr->sig_prod_offset; + sig_size = fw_hd...

...api_unseal_packet) > gss_unwrap_iov failed: Miscellaneous failure (see text): unknown > mech-code 0 for mech 1 2 840 113554 1 2 2 > [2016/08/04 11:49:23.546602, 0] > ../source4/auth/gensec/gensec_gssapi.c:1051(gensec_gssapi_unseal_packet) > gssapi_unseal_packet(hdr_signing=1,sig_size=45,data=144,pdu=176) > failed: NT_STATUS_ACCESS_DENIED > > > best regards, > Rainer > Lets go back to basics, can you post you smb.conf again, but this time, obtain it via cat Can you also post your /etc/krb5.conf Rowland

Sending things in a smaller chunks since it makes their reviewing easier. This part part 2/3 of the secboot refactoring/PMU command support patch series. Part 1 was the new falcon library which should be merged soon now. This series is mainly a refactoring/sanitization of the existing secure boot code. It does not add new features (part 3 will). Secure boot handling is now separated by NVIDIA

This is a rework of the secure boot code that moves the building of the blob into its own set of source files (and own hooks), making the code more flexible and (hopefully) easier to understand as well. This rework is needed to support more signed firmware for existing and new chips. Since the firmwares in question are not available yet I cannot send the code to manage then, but hopefully the