-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Jeremy Allison wrote: | On Wed, Mar 17, 2004 at 11:31:40AM -0800, Tom Dickson wrote: | |>-----BEGIN PGP SIGNED MESSAGE----- |>Hash: SHA1 |> |>Jeremy Allison wrote: |>| On Wed, Mar 17, 2004 at 09:26:45AM -0800, Tom Dickson wrote: |>| |>|>-----BEGIN PGP SIGNED MESSAGE----- |>|>Hash: SHA1 |>|> |>|>I've joined Samba to the domain, and everything seems to work fine. |>|>Clients can login to their windows 2000 machines and access the Samba |>|>server, which authenticates using kerberos to the 2003 AD controller. |>|> |>|>However, if I logon ON the 2003 AD controller, it can't access the Samba |>|>server. The same user logged onto any of the clients does work fine. |>|>Changing the passwords and rebooting things does not seem to help. |>|> |>|>Am I missing something easy? I can get logs and config files if needed. |>| |>| |>| Debug 10 logs from the smbd would help. |>| |>| Jeremy. |>| |>| . |>| |>Ok. See attached! Thank you! | | | Ok, looking at this it looks like you have a problem with encryption | types. Are you sure it's using krb5 to allow clients access ? It may | be falling back to NTLMSSP. What does your krb5.conf look like ? What | version of MIT Kerberos are you using ? | | Jeremy. | | . | Here's the krb5.conf setup from a similar machine that shows the same problem against Windows 2003.
more /etc/krb5.conf
[libdefaults]
~ default_realm = NETBENCHDOMAIN.LOCAL
#
[realms]
~ NETBENCHDOMAIN.LOCAL = {
~ kdc = NBSERVER.NETBENCHDOMAIN.LOCAL
~ }
#
[domain_realms]
~ .kerberos.server = NETBENCHDOMAIN.LOCAL
#===eof===
ls /usr/kerberos/lib/ libcom_err.so.3 libgssapi_krb5.so.2 libkadm5clnt.so.5 libkrb4.so.2 libcom_err.so.3.0 libgssapi_krb5.so.2.2 libkadm5clnt.so.5.0 libkrb4.so.2.0 libdes425.so.3 libgssrpc.so.3 libkadm5srv.so.5 libkrb5.so.3 libdes425.so.3.0 libgssrpc.so.3.0 libkadm5srv.so.5.0 libkrb5.so.3.1 libdyn.so.1 libk5crypto.so.3 libkdb5.so.3 libpty.so.1 libdyn.so.1.0 libk5crypto.so.3.0 libkdb5.so.3.1 libpty.so.1.2
I don't know how to find out the version any closer than than.
Another thing I noticed that if I connect to the IP address of the machine, it sometimes works, but not when connecting to the netbios name.
How do I verify that it is using krb5 for the clients, which seem to work just fine? It also seems that sometimes it just starts working after a long time.
- -Tom -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFAXyyE2dxAfYNwANIRAuonAJ0UIg1wnXAFAAK5Ttft2eKZskNkOgCfd5en NFVwpl+JE/qLQJ1Fl8OqFrY= =0rlM -----END PGP SIGNATURE----- -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
