On Wed, Mar 08, 2017 at 04:28:06PM +0000, John Beranek wrote:
On 8 March 2017 at 16:09, John Beranek <john(a)redux.org.uk>
> On 8 March 2017 at 16:07, John Beranek <john(a)redux.org.uk> wrote:
>> On 8 March 2017 at 14:59, Sumit Bose <sbose(a)redhat.com> wrote:
>>> On Wed, Mar 08, 2017 at 02:09:09PM +0000, John Beranek wrote:
>>>> On 8 March 2017 at 13:40, Mote, Todd <moter(a)austin.utexas.edu>
>>>> > Does on my rhel 6 boxes. I'm not in front of a computer at the
>>>> > there is a log where you can see it. Sssd_domain.log I think.
>>>> > when I get to work and let you know. Might search the list archive
>>>> > pretty sure I asked about it when adcli was still in the .7’s.
>>>> Hmm, just reading a list thread from September 2016 where it's
>>>> suggested that adcli doesn't get on well with Samba,entitled
>>>> 4.2.11, 4.2.14 and sssd?" http://bit.ly/2n60x4r
>>>> I wonder if having adcli installed, but using "net ads join"
>>>> the domain is still troublesome...
>>> Maybe adcli does not lead to the expected result because you use
>>> 'kerberos method = secrets and keytab'. adcli can only update the
>>> but not the host password stored in Samba's secrets.tdb. So chances are
>>> that even if the keys in the keytab are updated Samba will still use the
>>> old one from secrets.tdb. Have you tried to use 'kerberos method =
>>> system keytab'?
>> Thanks Sumit, no change with just the config change, would I need to
>> clear out the Samba database after the change?
> Getting the following, which may answer that question:
> [2017/03/08 16:04:56.947025, 0] libads/kerberos_util.c:101(ads_kinit_password)
> kerberos_kinit_password SERVER$(a)EXAMPLE.COM failed: Preauthentication failed
> [2017/03/08 16:04:56.947192, 3]
> ads_connect failed: Preauthentication failed
Cleared all Samba databases and re-joined the domain with adcli.
I can now access the server via SMB from Windows, and also with
smbclient, but only by using '-k'.
Using Username/Password I get:
session setup failed: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
ok, for this the plain text host password form secrets.tdb is needed.
The only way I can see now is to enhance adcli to update the password in
secrets.tdb as well if requested. Feel free to open an RFE either with
adcli itself or on bugzilla.redhat.com
for the adcli component.
> In the Samba log:
> Connecting to 10.20.30.40 at port 445
> [2017/03/08 16:25:57.230010, 0]
> get_schannel_session_key: could not fetch trust account password for
> domain 'EXAMPLE'
> [2017/03/08 16:25:57.230740, 0]
> cli_rpc_pipe_open_schannel: failed to get schannel session key from
> server DC1.EXAMPLE.COM
for domain EXAMPLE.
> [2017/03/08 16:25:57.230827, 0]
> connect_to_domain_password_server: unable to open the domain client
> session to machine DC1.EXAMPLE.COM
. Error was :
> [2017/03/08 16:25:57.231268, 0] auth/auth_domain.c:292(domain_client_validate)
> domain_client_validate: Domain password server not available.
> [2017/03/08 16:25:57.231362, 2] auth/auth.c:330(check_ntlm_password)
> check_ntlm_password: Authentication for user [johnb] -> [johnb]
> FAILED with error NT_STATUS_CANT_ACCESS_DOMAIN_INFO
> [2017/03/08 16:25:57.231419, 3] smbd/error.c:81(error_packet_set)
> error packet at smbd/sesssetup.c(124) cmd=115 (SMBsesssetupX)
> [2017/03/08 16:25:57.231670, 3] smbd/server_exit.c:181(exit_server_common)
> Server exit (failed to receive smb request)
> John Beranek To generalise is to be an idiot.
-- William Blake
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org