Hi Alexander,
Thank you very much for this quick and effective response. I get stuck with
the anonymous bind and I didn't even notice the TLS error... I'm clueless
with the flu :(
If I change LDAPS for plain LDAP it works, but when I try to LDAP+STARTTLS
problems arise:
[2018/03/23 10:48:04.846575, 5] ../source3/lib/smbldap.c:1302(
smbldap_search_ext)
smbldap_search_ext: base => [dc=ipaserverdomain], filter =>
[(&(objectClass=ipaNTUserAttrs)(uid=testuser))], scope => [2]
[2018/03/23 10:48:04.847142, 5] ../source3/lib/smbldap.c:1167(
smbldap_close)
The connection to the LDAP server was closed
[2018/03/23 10:48:04.848881, 0] ../source3/lib/smbldap.c:622(
smbldap_start_tls)
Failed to issue the StartTLS instruction: Connect error
[2018/03/23 10:48:04.849755, 1] ../source3/lib/smbldap.c:1259(
get_cached_ldap_connect)
Connection to LDAP server failed for the 1 try!
But the fact is that any ldapsearch with -ZZ option (so, forcing START_TLS)
is working perfectly, so LDAP config and certs seems ok. I don't understand
what's happening...
Thanks,
A.
2018-03-22 14:52 GMT+01:00 Alexander Bokovoy <abokovoy(a)redhat.com>:
On to, 22 maalis 2018, x 31978 via FreeIPA-users wrote:
> Hi everybody,
>
> First of all, thank you for providing all that helpful support in this
> list, it's amazing!
>
> I've a couple of servers running on CentOS, having FreeIPA as
> authentication source and SaMBa for sharing files with some Windows
> machines. The configuration is the same as indicated in the post
>
https://bgstack15.wordpress.com/2017/05/10/samba-share-with-freeipa-auth/
>
> Versions are the latest as of today: CentOS 7.4.1708 up-to-date, FreeIPA
> 4.5.0, SSSD 1.15.2 and SaMBa 4.6.2. Everything is working flawlessly.
>
> These days I'm trying the same config on Fedora 27 (on the two sides: ipa
> and samba). Versions are the latest: Fedora 27 up-to-date, FreeIPA 4.6.2,
> SSSD 1.16.1 and SaMBa 4.7.6...
>
> ... and I can't get it work.
>
> [root@sambaserver ~]# systemctl start smb
> [root@sambaserver ~]# systemctl status smb
> ● smb.service - Samba SMB Daemon
> Loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor
> preset: disabled)
> Active: active (running) since Thu 2018-03-22 10:54:42 CET; 20s ago
> Main PID: 656 (smbd)
> Status: "smbd: ready to serve connections..."
> Tasks: 3 (limit: 4915)
> CGroup: /system.slice/smb.service
> ├─656 /usr/sbin/smbd --foreground --no-process-group
> ├─832 /usr/sbin/smbd --foreground --no-process-group
> └─833 /usr/sbin/smbd --foreground --no-process-group
>
> mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]: [2018/03/22
> 10:54:41.603487, 0] ../source3/lib/smbldap.c:1046(
> smbldap_connect_system)
> mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]: failed to bind to
> server ldaps://ipaserver.ipaserverdomain with dn="[Anonymous bind]"
> Error:
> Local error
> mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]: (unknown)
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step
> 1
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step
> 1
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step
> 1
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step
> 2
> mar 22 10:54:42 sambaserver.ipaserverdomain systemd[1]: Started Samba SMB
> Daemon.
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: [2018/03/22
> 10:54:42.999414, 0] ../lib/util/become_daemon.c:124(daemon_ready)
> mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: STATUS=daemon
> 'smbd' finished starting up and ready to serve connections
>
> [root@sambaserver ~]# cat /var/log/samba/log.smbd
> .../...
> [2018/03/22 10:54:19.827292, 2]
> ../source3/lib/smbldap.c:841(smbldap_open_connection)
> smbldap_open_connection: connection opened
> [2018/03/22 10:54:19.843503, 2]
> ../source3/lib/smbldap.c:1046(smbldap_connect_system)
> failed to bind to server ldaps://ipaserver.ipaserverdomain with
> dn="[Anonymous bind]" Error: Can't contact LDAP server
> TLS error -8023:A PKCS #11 module returned CKR_DEVICE_ERROR,
> indicating that a problem has occurred with the token or slot.
> [2018/03/22 10:54:19.843558, 1]
> ../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
> Connection to LDAP server failed for the 16 try!
> [2018/03/22 10:54:20.845647, 3]
> ../source3/smbd/server_exit.c:244(exit_server_common)
> Server exit (termination signal)
> [2018/03/22 10:54:41.463285, 3]
> ../source3/param/loadparm.c:3862(lp_load_ex)
> lp_load_ex: refreshing parameters
> [2018/03/22 10:54:41.470801, 3]
> ../source3/param/loadparm.c:549(init_globals)
> Initialising global parameters
> [2018/03/22 10:54:41.470868, 3]
> ../source3/param/loadparm.c:2776(lp_do_section)
> Processing section "[global]"
> [2018/03/22 10:54:41.470980, 2]
> ../source3/param/loadparm.c:2793(lp_do_section)
> Processing section "[aplicacions]"
> [2018/03/22 10:54:41.471043, 2]
> ../source3/param/loadparm.c:2793(lp_do_section)
> Processing section "[compartit]"
> [2018/03/22 10:54:41.471099, 2]
> ../source3/param/loadparm.c:2793(lp_do_section)
> Processing section "[escaner]"
> [2018/03/22 10:54:41.471153, 2]
> ../source3/param/loadparm.c:2793(lp_do_section)
> Processing section "[usuaris]"
> [2018/03/22 10:54:41.471202, 2]
> ../source3/param/loadparm.c:2793(lp_do_section)
> Processing section "[wpkg]"
> [2018/03/22 10:54:41.471288, 3]
> ../source3/param/loadparm.c:1611(lp_add_ipc)
> adding IPC service
> [2018/03/22 10:54:41.482042, 3] ../source3/smbd/server.c:1822(main)
> loaded services
> [2018/03/22 10:54:41.535960, 1]
> ../source3/profile/profile.c:51(set_profile_level)
> INFO: Profiling turned OFF from pid 656
> [2018/03/22 10:54:41.535998, 3] ../source3/smbd/server.c:1842(main)
> Standard input is not a socket, assuming -D option
> [2018/03/22 10:54:41.536011, 3] ../source3/smbd/server.c:1854(main)
> Becoming a daemon.
> [2018/03/22 10:54:41.536379, 2]
> ../source3/passdb/pdb_interface.c:161(make_pdb_method_name)
> No builtin backend found, trying to load plugin
> [2018/03/22 10:54:41.582725, 3]
> ../lib/util/modules.c:167(load_module_absolute_path)
> load_module_absolute_path: Module '/usr/lib64/samba/pdb/ipaserversam.so'
> loaded
> [2018/03/22 10:54:41.590445, 2]
> ../source3/lib/smbldap.c:841(smbldap_open_connection)
> smbldap_open_connection: connection opened
> [2018/03/22 10:54:41.603262, 0] ipaserver_sam.c:4245(bind_call
> back_cleanup)
> kerberos error: code=-1765328230, message=Cannot find KDC for realm
> "ipaserverdomain"
> [2018/03/22 10:54:41.603487, 0]
> ../source3/lib/smbldap.c:1046(smbldap_connect_system)
> failed to bind to server ldaps://ipaserver.ipaserverdomain with
> dn="[Anonymous bind]" Error: Local error
> (unknown)
> [2018/03/22 10:54:41.603539, 1]
> ../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
> Connection to LDAP server failed for the 1 try!
> [2018/03/22 10:54:42.604598, 2]
> ../source3/lib/smbldap.c:841(smbldap_open_connection)
> smbldap_open_connection: connection opened
> [2018/03/22 10:54:42.742964, 3]
> ../source3/lib/smbldap.c:1063(smbldap_connect_system)
> ldap_connect_system: successful connection to the LDAP server
> [2018/03/22 10:54:42.750197, 1] ipaserver_sam.c:4724(pdb_init_
> ipaserversam)
> pdb_init_ipaserversam: support for pdb_enum_upn_suffixes enabled for
> domain ipaserverdomain
> [2018/03/22 10:54:42.856428, 3]
> ../source3/lib/util_procid.c:54(pid_to_procid)
> pid_to_procid: messaging_dgm_get_unique failed: El fitxer o directori no
> existeix
> [2018/03/22 10:54:42.976566, 3]
> ../source3/rpc_server/svcctl/srv_svcctl_reg.c:565(svcctl_init_winreg)
> Initialise the svcctl registry keys if needed.
> [2018/03/22 10:54:42.998031, 3]
> ../source3/rpc_server/eventlog/srv_eventlog_reg.c:59(
> eventlog_init_winreg)
> Initialise the eventlog registry keys if needed.
> [2018/03/22 10:54:42.999414, 0]
> ../lib/util/become_daemon.c:124(daemon_ready)
> STATUS=daemon 'smbd' finished starting up and ready to serve connections
> [2018/03/22 10:54:43.007591, 2]
> ../source3/smbd/server.c:1395(smbd_parent_loop)
> waiting for connections
>
> That's driving me mad. Everything is working well: ipaserver, ipaclient,
> dns, kerberos, kinit, tickets, users, resolution, keytabs, etc. I can't
> figure out why SaMBa cannot find KDC and then trying to contact LDAPS
> server with "Anonymous bind" when the dedicated keytab explicitly gives
> this permissions. Commands like kinit <user> and kinit -kt <keytab>
> <principal> are working as expected.
>
It is not 'anonymous bind', it is code in samba that prints phrase
[Anonymous bind] if DN to bind is empty. This is normal for ipasam
module because we use GSSAPI authentication and don't need to explicitly
provide DN in the calls to smbldap utility library.
https://git.samba.org/?p=samba.git;a=blob;f=source3/lib/
smbldap.c;h=5a67ab79058dd0cec331d12c86b7b99370731532;hb=HEAD#l1050
What I see in the logs above, you have somewhat incorrect configuration
for your openldap/nss setup:
> failed to bind to server ldaps://ipaserver.ipaserverdomain with
> dn="[Anonymous bind]" Error: Can't contact LDAP server
> TLS error -8023:A PKCS #11 module returned CKR_DEVICE_ERROR,
>
The TLS error is reported by openldap and is translated from the nss
code that it uses. You need to check your configuration. We don't really
support use of ipasam module outside of FreeIPA server itself.
--
/ Alexander Bokovoy