similar to: auth problem

I'm using Ubuntu 18.04 and try to connect a local *samba client* to my Windows AD. I use the packages squid samba winbind libnss-winbind. Both machines are already using an *ntp* server for sync. this is my samba config [global]    netbios name = sqntlm    workgroup = MY    security = ADS    realm = MY.CU    encrypt passwords = yes    min protocol = SMB2    max protocol = SMB3_11

Hi comunity, i have implemented in my company a small samba server only use for sharing proposes. Mi problem is simple, in the config i set the directives "client min protocol = SMB2" and "client max protocol = SMB3_11". Acording to this 2 directives a client with Windows XP can't connect to my server, but i have 2 clientes using that OS and conncect without problems.

Luis, ok I'v removed everything, step 1: KRB5_KTNAME=FILE:/etc/krb5.keytab2 net ads keytab CREATE -P klist -ke /etc/krb5.keytab2|grep 7|sort 7 cifs/FS-A at DOM.CORP (aes128-cts-hmac-sha1-96) 7 cifs/FS-A at DOM.CORP (aes256-cts-hmac-sha1-96) 7 cifs/FS-A at DOM.CORP (arcfour-hmac) 7 cifs/FS-A at DOM.CORP (des-cbc-crc) 7 cifs/FS-A at DOM.CORP (des-cbc-md5) 7

Hai, Nope.. To much again ;-) This is one step to much: step2: # KRB5_KTNAME=FILE:/etc/krb5.keytab2 net ads keytab ADD cifs/oldsamba.dom.corp at DOM.CORP # KRB5_KTNAME=FILE:/etc/krb5.keytab2 net ads keytab ADD cifs/oldsamba at DOM.CORP # KRB5_KTNAME=FILE:/etc/krb5.keytab2 net ads keytab ADD cifs/oldsamba$@DOM.CORP And why are you adding @REALM .. Do it exactly as shown below. Because

Luis, my typos, I'v to mask the output sorry (compliance) # su - testuser $ smbclient --option='client min protocol=NT1' -U testuser //oldsamba/testuser -c 'ls' Unable to initialize messaging context Enter DOM\testuser's password: session setup failed: NT_STATUS_LOGON_FAILURE [2019/11/05 15:50:50.009481, 1] ../../source3/librpc/crypto/gse.c:660(gse_get_server_auth_token)

samba-tool computer remove oldsamba Il giorno mar 5 nov 2019 alle ore 17:04 L.P.H. van Belle <belle at bazuin.nl> ha scritto: > Hai, > > Well that great you found it. > > Ah.. so you removed the entry from the DNS or ADDB? > Can you tell what you exactly did, that might help the next person with a > problem like this. > > And not many list messages today.. ;-)

On Tue, 26 Feb 2019 16:37:39 +0100 David Jehin <bedou210977 at gmail.com> wrote: > THANK YOU FOR YOUR REPLY > > THE RESULT : > KVNO Principal > ---- > -------------------------------------------------------------------------- > 1 HOST/samba4 at FSS.LAN (des-cbc-crc) > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > 1 SAMBA4$@FSS.LAN (des-cbc-crc) >

Hai,   I noticed something strange in the keytab file on my member server. This is a followup of : [Samba] winbind question. (challenge/response password authentication) Samba 4.5.3 on Debian Jessie.   Leave the domain. net ads leave -k Deleted account for 'PROXY2' in realm 'REALM'   I checked in windows, and the computer is gone in the “Computer” ou.   Removed the

Just to update this, I'm going to upgrade to samba4 but it won't be for a few days yet, I'll keep this thread updated with what happens. On 10 Nov 2017 11:23, "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > No, no idee, but really, upgrade to samba, best option, in my opinion. > If thats not possible, it happens.. > > A timeout option can

compiled samba version : 4.8.5 and my distribution is: debian stretch 9.6 I said that when I join the domain, restarting the machine takes the GPO, the other restart does not take the gpo computer. Thanks for your help Le mar. 26 févr. 2019 à 17:11, Rowland Penny via samba < samba at lists.samba.org> a écrit : > On Tue, 26 Feb 2019 16:37:39 +0100 > David Jehin <bedou210977 at

THANK YOU FOR YOUR REPLY THE RESULT : KVNO Principal ---- -------------------------------------------------------------------------- 1 HOST/samba4 at FSS.LAN (des-cbc-crc) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) 1 SAMBA4$@FSS.LAN (des-cbc-crc) 1 HOST/samba4 at FSS.LAN (des-cbc-md5) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) 1 SAMBA4$@FSS.LAN (des-cbc-md5) 1

Samba expects the keytab file as /etc/krb5.keytab. Solaris 11 looks for a keytab file in /etc/krb5/krb5.keytab When samba joins the domain it (probably) updates the machine password and then updates its krb5.keytab file. When connecting via ssh, the system would use a keytab file that had the wrong kvno and probably the wrong password key. The following symlink command fixed ssh

No, no idee, but really, upgrade to samba, best option, in my opinion. If thats not possible, it happens.. A timeout option can be set in krb5.conf for example : kdc_timeout = 5000 You have these for krb5.conf to try out also. the complete list. des-hmac-sha1 DES with HMAC/sha1 (weak) aes256-cts-hmac-sha1-96 aes256-cts AES-256 CTS mode with 96-bit SHA-1 HMAC

am getting this error in smbd.log when user try to open Share from Windows box: gss_accept_sec_context failed with [ Miscellaneous failure (see text): Failed to find cifs/mymember.my.domain.tld at MY.DOMAIN.TLD(kvno 58) in keytab MEMORY:cifs_srv_keytab (aes256-cts-hmac-sha1-96)] SPNEGO(gse_krb5) NEG_TOKEN_INIT failed: NT_STATUS_LOGON_FAILURE I have made a research here in google and here in mail

I have a Windows 2008 domain (one Win 2008 DC, one Win 2012 R2 DC.) I am trying to join a Solaris 11 machine to the domain for both Samba and other services. For "unix" logins and ssh, Solaris 11 is configured to use LDAP for user and group lookup and kerberos for authentication. The "kclient -T ms_ad" command joins the Solaris machine to the AD domain. It even

Hai Paul,   hmm, i think its time.. to upgrade your samba.   I dont think the other krb5.conf options work, but you might give it a try. See man krb5.conf, where i took it from. add /change in krb5.conf  [kdc] tgt-use-strongest-session-key = BOOL svc-use-strongest-session-key = BOOL preauth-use-strongest-session-key= BOOL use-strongest-server-key = BOOL encode_as_rep_as_tgs_rep = BOOL   BOOL

Thank you, Louis, for your reply. By simply asking me to provide outputs of the aforementioned files, I found the cause of my first problem (auth failing). It was my /etc/hosts file on dc1. All of them should look like this, and indeed DC2 and DC3's *did* look like this: # cat /etc/hosts > 127.0.0.1 ? ? ? localhost.samdom.mycompany.net ?localhost > 192.168.3.201

Hai Marco, > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Marco Gaiarin via samba > Verzonden: vrijdag 26 oktober 2018 11:23 > Aan: samba at lists.samba.org > Onderwerp: Re: [Samba] Again NFSv4 and Kerberos at the 'samba way'... > > Mandi! L.P.H. van Belle via samba > In chel di` si favelave... > >

any ideas ? please i got stuck and have no ideas what else i can do pozdrawiam Łukasz Sellmann 2017-02-01 17:50 GMT+01:00 Łukasz Sellmann <bravo.galaxy at gmail.com>: > Can someone help me with samba4 with internal dns. Something strange > showing in log.smbd when computers are doing gpupdate (becouse of this > error computers cant apply gpo) > > log.smbd on DC1: >

yes, permissions are set as default by apt package instalator > ls -al > -rw------- 1 root root 1082 sty 13 23:25 secrets.keytab samba,smbd deamons have run as root user > > log.smbd on DC1: > > > > [2017/01/13 13:49:16.075361, > > 1] ../source4/auth/gensec/gensec_gssapi.c:619(gensec_gssapi_update) > > GSS server Update(krb5)(1) Update failed: