So, an update on this - I left the server for a day, and Samba has stopped authenticating. Samba log says:
[2017/03/09 10:21:48.814799, 3] smbd/process.c:1609(process_smb) Transaction 9 of length 2670 (0 toread) [2017/03/09 10:21:48.814904, 3] smbd/process.c:1414(switch_message) switch message SMBsesssetupX (pid 20958) conn 0x0 [2017/03/09 10:21:48.814945, 3] smbd/sesssetup.c:1347(reply_sesssetup_and_X) wct=12 flg2=0xc807 [2017/03/09 10:21:48.814973, 2] smbd/sesssetup.c:1293(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2017/03/09 10:21:48.815008, 3] smbd/sesssetup.c:1074(reply_sesssetup_and_X_spnego) Doing spnego session setup [2017/03/09 10:21:48.815040, 3] smbd/sesssetup.c:1116(reply_sesssetup_and_X_spnego) NativeOS=[] NativeLanMan=[] PrimaryDomain=[] [2017/03/09 10:21:48.815093, 3] smbd/sesssetup.c:662(reply_spnego_negotiate) reply_spnego_negotiate: Got secblob of size 2524 [2017/03/09 10:21:48.817915, 3] libads/kerberos_verify.c:297(ads_keytab_verify_ticket) libads/kerberos_verify.c:297: krb5_rd_req failed for all 40 matched keytab principals [2017/03/09 10:21:48.817969, 3] libads/kerberos_verify.c:638(ads_verify_ticket) libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Success) [2017/03/09 10:21:48.818024, 1] smbd/sesssetup.c:344(reply_spnego_kerberos) Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE! sssd shows that adcli has been run: (Wed Mar 8 16:18:26 2017) [sssd[be[AD]]] [ad_machine_account_password_renewal_done] (0x1000): --- adcli output start--- * Found realm in keytab: EXAMPLE.COM * Found computer name in keytab: SERVER * Found service principal in keytab: host/SERVER * Found service principal in keytab: host/server.example.com * Found host qualified name in keytab: host/server.example.com * Found service principal in keytab: RestrictedKrbHost/SERVER * Found service principal in keytab: RestrictedKrbHost/server.example.com * Using fully qualified name: server.example.com * Using domain name: example.com * Calculated computer account name from fqdn: SERVER * Using domain realm: example.com * Sending netlogon pings to domain controller: cldap://10.20.30.40 * Received NetLogon info from: dc1.example.com * Wrote out krb5.conf snippet to /tmp/adcli-krb5-m5MrZa/krb5.d/adcli-krb5-conf-FYuKkI * Authenticated as default/reset computer account: SERVER * Looked up short domain name: EXAMPLE * Using fully qualified name: server.example.com * Using domain name: example.com * Using computer account name: SERVER * Using domain realm: example.com * Using fully qualified name: server.example.com * Enrolling computer name: SERVER * Generated 120 character computer password * Using keytab: FILE:/etc/krb5.keytab * Found computer account for SERVER$ at: CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com * Retrieved kvno '32' for computer account in directory: CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com * Password not too old, no change needed * Modifying computer account: userAccountControl ! Couldn't set userAccountControl on computer account: CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com: Insufficient access * Updated existing computer account: CN=SERVER,OU=Non-Windows,OU=Servers,DC=example,DC=com ---adcli output end--- So, adcli updated the keytab, but Samba auth still stopped working? Cheers, John On 8 March 2017 at 17:13, Sumit Bose <[email protected]> wrote: > On Wed, Mar 08, 2017 at 04:28:06PM +0000, John Beranek wrote: >> On 8 March 2017 at 16:09, John Beranek <[email protected]> wrote: >> > On 8 March 2017 at 16:07, John Beranek <[email protected]> wrote: >> >> On 8 March 2017 at 14:59, Sumit Bose <[email protected]> wrote: >> >>> On Wed, Mar 08, 2017 at 02:09:09PM +0000, John Beranek wrote: >> >>>> On 8 March 2017 at 13:40, Mote, Todd <[email protected]> wrote: >> >>>> > Does on my rhel 6 boxes. I'm not in front of a computer at the >> >>>> > moment, but >> >>>> > there is a log where you can see it. Sssd_domain.log I think. I'll >> >>>> > look >> >>>> > when I get to work and let you know. Might search the list archive >> >>>> > too I'm >> >>>> > pretty sure I asked about it when adcli was still in the .7’s. >> >>>> >> >>>> Hmm, just reading a list thread from September 2016 where it's >> >>>> suggested that adcli doesn't get on well with Samba,entitled "samba >> >>>> 4.2.11, 4.2.14 and sssd?" http://bit.ly/2n60x4r >> >>>> >> >>>> I wonder if having adcli installed, but using "net ads join" to join >> >>>> the domain is still troublesome... >> >>> >> >>> Maybe adcli does not lead to the expected result because you use >> >>> 'kerberos method = secrets and keytab'. adcli can only update the keytab >> >>> but not the host password stored in Samba's secrets.tdb. So chances are >> >>> that even if the keys in the keytab are updated Samba will still use the >> >>> old one from secrets.tdb. Have you tried to use 'kerberos method = >> >>> system keytab'? >> >> >> >> Thanks Sumit, no change with just the config change, would I need to >> >> clear out the Samba database after the change? >> > >> > Getting the following, which may answer that question: >> > >> > [2017/03/08 16:04:56.947025, 0] >> > libads/kerberos_util.c:101(ads_kinit_password) >> > kerberos_kinit_password [email protected] failed: Preauthentication >> > failed >> > [2017/03/08 16:04:56.947192, 3] >> > printing/nt_printing_ads.c:639(check_published_printers) >> > ads_connect failed: Preauthentication failed >> >> Cleared all Samba databases and re-joined the domain with adcli. >> >> I can now access the server via SMB from Windows, and also with >> smbclient, but only by using '-k'. >> >> Using Username/Password I get: >> >> session setup failed: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > ok, for this the plain text host password form secrets.tdb is needed. > The only way I can see now is to enhance adcli to update the password in > secrets.tdb as well if requested. Feel free to open an RFE either with > adcli itself or on bugzilla.redhat.com for the adcli component. > > bye, > Sumit > >> >> In the Samba log: >> >> Connecting to 10.20.30.40 at port 445 >> [2017/03/08 16:25:57.230010, 0] >> rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common) >> get_schannel_session_key: could not fetch trust account password for >> domain 'EXAMPLE' >> [2017/03/08 16:25:57.230740, 0] >> rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel) >> cli_rpc_pipe_open_schannel: failed to get schannel session key from >> server DC1.EXAMPLE.COM for domain EXAMPLE. >> [2017/03/08 16:25:57.230827, 0] >> auth/auth_domain.c:193(connect_to_domain_password_server) >> connect_to_domain_password_server: unable to open the domain client >> session to machine DC1.EXAMPLE.COM. Error was : >> NT_STATUS_CANT_ACCESS_DOMAIN_INFO. >> [2017/03/08 16:25:57.231268, 0] >> auth/auth_domain.c:292(domain_client_validate) >> domain_client_validate: Domain password server not available. >> [2017/03/08 16:25:57.231362, 2] auth/auth.c:330(check_ntlm_password) >> check_ntlm_password: Authentication for user [johnb] -> [johnb] >> FAILED with error NT_STATUS_CANT_ACCESS_DOMAIN_INFO >> [2017/03/08 16:25:57.231419, 3] smbd/error.c:81(error_packet_set) >> error packet at smbd/sesssetup.c(124) cmd=115 (SMBsesssetupX) >> NT_STATUS_CANT_ACCESS_DOMAIN_INFO >> [2017/03/08 16:25:57.231670, 3] smbd/server_exit.c:181(exit_server_common) >> Server exit (failed to receive smb request) >> >> John >> >> -- >> John Beranek To generalise is to be an idiot. >> http://redux.org.uk/ -- William Blake >> _______________________________________________ >> sssd-users mailing list -- [email protected] >> To unsubscribe send an email to [email protected] > _______________________________________________ > sssd-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake _______________________________________________ sssd-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
