So, an update on this - I left the server for a day, and Samba has
stopped authenticating. Samba log says:
[2017/03/09 10:21:48.814799, 3] smbd/process.c:1609(process_smb)
Transaction 9 of length 2670 (0 toread)
[2017/03/09 10:21:48.814904, 3] smbd/process.c:1414(switch_message)
switch message SMBsesssetupX (pid 20958) conn 0x0
[2017/03/09 10:21:48.814945, 3] smbd/sesssetup.c:1347(reply_sesssetup_and_X)
wct=12 flg2=0xc807
[2017/03/09 10:21:48.814973, 2] smbd/sesssetup.c:1293(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would
close all old resources.
[2017/03/09 10:21:48.815008, 3]
smbd/sesssetup.c:1074(reply_sesssetup_and_X_spnego)
Doing spnego session setup
[2017/03/09 10:21:48.815040, 3]
smbd/sesssetup.c:1116(reply_sesssetup_and_X_spnego)
NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
[2017/03/09 10:21:48.815093, 3] smbd/sesssetup.c:662(reply_spnego_negotiate)
reply_spnego_negotiate: Got secblob of size 2524
[2017/03/09 10:21:48.817915, 3]
libads/kerberos_verify.c:297(ads_keytab_verify_ticket)
libads/kerberos_verify.c:297: krb5_rd_req failed for all 40 matched
keytab principals
[2017/03/09 10:21:48.817969, 3] libads/kerberos_verify.c:638(ads_verify_ticket)
libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Success)
[2017/03/09 10:21:48.818024, 1] smbd/sesssetup.c:344(reply_spnego_kerberos)
Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
sssd shows that adcli has been run:
(Wed Mar 8 16:18:26 2017) [sssd[be[AD]]]
[ad_machine_account_password_renewal_done] (0x1000): --- adcli output
start---
* Found realm in keytab:
EXAMPLE.COM
* Found computer name in keytab: SERVER
* Found service principal in keytab: host/SERVER
* Found service principal in keytab:
host/server.example.com
* Found host qualified name in keytab:
host/server.example.com
* Found service principal in keytab: RestrictedKrbHost/SERVER
* Found service principal in keytab:
RestrictedKrbHost/server.example.com
* Using fully qualified name:
server.example.com
* Using domain name:
example.com
* Calculated computer account name from fqdn: SERVER
* Using domain realm:
example.com
* Sending netlogon pings to domain controller: cldap://10.20.30.40
* Received NetLogon info from:
dc1.example.com
* Wrote out krb5.conf snippet to
/tmp/adcli-krb5-m5MrZa/krb5.d/adcli-krb5-conf-FYuKkI
* Authenticated as default/reset computer account: SERVER
* Looked up short domain name: EXAMPLE
* Using fully qualified name:
server.example.com
* Using domain name:
example.com
* Using computer account name: SERVER
* Using domain realm:
example.com
* Using fully qualified name:
server.example.com
* Enrolling computer name: SERVER
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* Found computer account for SERVER$ at:
CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com
* Retrieved kvno '32' for computer account in directory:
CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com
* Password not too old, no change needed
* Modifying computer account: userAccountControl
! Couldn't set userAccountControl on computer account:
CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com: Insufficient
access
* Updated existing computer account:
CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com
---adcli output end---
So, adcli updated the keytab, but Samba auth still stopped working?
Cheers,
John
On 8 March 2017 at 17:13, Sumit Bose <sbose(a)redhat.com> wrote:
On Wed, Mar 08, 2017 at 04:28:06PM +0000, John Beranek wrote:
> On 8 March 2017 at 16:09, John Beranek <john(a)redux.org.uk> wrote:
> > On 8 March 2017 at 16:07, John Beranek <john(a)redux.org.uk> wrote:
> >> On 8 March 2017 at 14:59, Sumit Bose <sbose(a)redhat.com> wrote:
> >>> On Wed, Mar 08, 2017 at 02:09:09PM +0000, John Beranek wrote:
> >>>> On 8 March 2017 at 13:40, Mote, Todd <moter(a)austin.utexas.edu>
wrote:
> >>>> > Does on my rhel 6 boxes. I'm not in front of a computer at
the moment, but
> >>>> > there is a log where you can see it. Sssd_domain.log I think.
I'll look
> >>>> > when I get to work and let you know. Might search the list
archive too I'm
> >>>> > pretty sure I asked about it when adcli was still in the .7’s.
> >>>>
> >>>> Hmm, just reading a list thread from September 2016 where it's
> >>>> suggested that adcli doesn't get on well with Samba,entitled
"samba
> >>>> 4.2.11, 4.2.14 and sssd?"
http://bit.ly/2n60x4r
> >>>>
> >>>> I wonder if having adcli installed, but using "net ads
join" to join
> >>>> the domain is still troublesome...
> >>>
> >>> Maybe adcli does not lead to the expected result because you use
> >>> 'kerberos method = secrets and keytab'. adcli can only update
the keytab
> >>> but not the host password stored in Samba's secrets.tdb. So chances
are
> >>> that even if the keys in the keytab are updated Samba will still use
the
> >>> old one from secrets.tdb. Have you tried to use 'kerberos method =
> >>> system keytab'?
> >>
> >> Thanks Sumit, no change with just the config change, would I need to
> >> clear out the Samba database after the change?
> >
> > Getting the following, which may answer that question:
> >
> > [2017/03/08 16:04:56.947025, 0] libads/kerberos_util.c:101(ads_kinit_password)
> > kerberos_kinit_password SERVER$(a)EXAMPLE.COM failed: Preauthentication failed
> > [2017/03/08 16:04:56.947192, 3]
> > printing/nt_printing_ads.c:639(check_published_printers)
> > ads_connect failed: Preauthentication failed
>
> Cleared all Samba databases and re-joined the domain with adcli.
>
> I can now access the server via SMB from Windows, and also with
> smbclient, but only by using '-k'.
>
> Using Username/Password I get:
>
> session setup failed: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
ok, for this the plain text host password form secrets.tdb is needed.
The only way I can see now is to enhance adcli to update the password in
secrets.tdb as well if requested. Feel free to open an RFE either with
adcli itself or on
bugzilla.redhat.com for the adcli component.
bye,
Sumit
>
> In the Samba log:
>
> Connecting to 10.20.30.40 at port 445
> [2017/03/08 16:25:57.230010, 0]
> rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common)
> get_schannel_session_key: could not fetch trust account password for
> domain 'EXAMPLE'
> [2017/03/08 16:25:57.230740, 0]
> rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel)
> cli_rpc_pipe_open_schannel: failed to get schannel session key from
> server
DC1.EXAMPLE.COM for domain EXAMPLE.
> [2017/03/08 16:25:57.230827, 0]
> auth/auth_domain.c:193(connect_to_domain_password_server)
> connect_to_domain_password_server: unable to open the domain client
> session to machine
DC1.EXAMPLE.COM. Error was :
> NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
> [2017/03/08 16:25:57.231268, 0] auth/auth_domain.c:292(domain_client_validate)
> domain_client_validate: Domain password server not available.
> [2017/03/08 16:25:57.231362, 2] auth/auth.c:330(check_ntlm_password)
> check_ntlm_password: Authentication for user [johnb] -> [johnb]
> FAILED with error NT_STATUS_CANT_ACCESS_DOMAIN_INFO
> [2017/03/08 16:25:57.231419, 3] smbd/error.c:81(error_packet_set)
> error packet at smbd/sesssetup.c(124) cmd=115 (SMBsesssetupX)
> NT_STATUS_CANT_ACCESS_DOMAIN_INFO
> [2017/03/08 16:25:57.231670, 3] smbd/server_exit.c:181(exit_server_common)
> Server exit (failed to receive smb request)
>
> John
>
> --
> John Beranek To generalise is to be an idiot.
>
http://redux.org.uk/ -- William Blake
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
--
John Beranek To generalise is to be an idiot.
http://redux.org.uk/ -- William Blake