We recently switched our win2k domain to a native mode. We upgraded our
Solaris 9 samba server from 2.2.8 to version 3.0.2a and configured MIT
Kerberos version 1.3.2
I was able to join to machine as a domain member without any problems:
./net ads join -U moshe
moshe password:
[2004/03/30 13:26:46, 0] libads/ldap.c:ads_add_machine_acct(1006)
Host account for shark already exists - modifying old account
Using short domain name -- MYCOMPANY
Joined 'SHARK' to realm 'CORP.MYCOMPANY.COM'
kinit and klist also work without any problems.
When I am trying to browse the samba shares from Win/XP machine I am getting
the following in the samba log:
[2004/03/30 11:15:26, 3] libads/kerberos_verify.c:ads_verify_ticket(323)
ads_verify_ticket: enc type [3] failed to decrypt with error Decrypt
integrity check failed
[2004/03/30 11:15:26, 3] libads/kerberos_verify.c:ads_verify_ticket(330)
ads_verify_ticket: krb5_rd_req with auth failed (Bad encryption type)
[2004/03/30 11:15:26, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
Failed to verify incoming ticket!
[2004/03/30 11:15:26, 3] smbd/error.c:error_packet(94)
error string = No such file or directory
[2004/03/30 11:15:26, 3] smbd/error.c:error_packet(118)
error packet at smbd/sesssetup.c(174) cmd=115 (SMBsesssetupX)
NT_STATUS_LOGON_FAILURE
This is my krb5.conf:
[libdefaults]
default_keytab_name = /etc/krb5.keytab
default_realm = CORP.MYCOMPANY.COM
dns_lookup_kdc = false
dns_lookup_realm = false
[realms]
CORP.MYCOMPANY.COM = {
kdc = corpdc.corp.mycompany.com
default_domain = corp.mycompany.com
}
[domain_realm]
.corp.mycompany.com = CORP.MYCOMPANY.COM
corp.mycompany.com = CORP.MYCOMPANY.COM
[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log
kdc_rotate = {
# How often to rotate kdc.log. Logs will get rotated no more
# often than the period, and less often if the KDC is not used
# frequently.
period = 1d
# how many versions of kdc.log to keep around (kdc.log.0, kdc.log.1, ...)
versions = 10
}
[appdefaults]
kinit = {
renewable = true
forwardable= true
}
This is my smb.conf:
netbios name = shark
workgroup = MYCOMPANY
realm = CORP.MYCOMPANY.COM
server string = Samba Server
log file = /opt/samba3.0/var/log.%m
log level = 5
max log size = 50
security = ads
local master = no
os level = 0
domain master = no
preferred master = no
wins support = no
wins server = 10.70.130.2, 10.80.20.4
dns proxy = no
password server = corpdc.corp.mycompany.com
encrypt passwords = yes
idmap uid = 10000-20000
idmap gid = 10000-20000
template homedir = /home/%D/%U
template shell = /bin/bash
winbind separator = +
I searched this list and I found similar posting but no answer. Can someone
please help?
Thanks,
Moshe
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
