I had a perfectly good setup with samba being a domain member, and domain users accessing their shares, since beta1. A month and several updates from M$ later, clients were no longer able to log on to the samba machine. I know this must be related to the updates, since there have been absolutely no configuration / application modifications on the linux box, and clients who forgot to install the patches were still able to login.
Hint for the docs: the bloody windows update rewrote the rtfm signorseal registry key, but that can be enforced globally from the domain controller.
Now I'm trying with the latest beta - or first stable, as you call it since yesterday :)
Status:
- linux box joins fine the AD
- kinit -v, smbclient -k, net ads whatever work as expected, no errors
- no one can login to the samba box. Win 2k/xp report the username/password is incorrect, and the logs state:
[2003/09/25 20:20:01, 3] smbd/process.c:process_smb(890)
Transaction 10 of length 250
[2003/09/25 20:20:01, 3] smbd/process.c:switch_message(685)
switch message SMBsesssetupX (pid 343)
[2003/09/25 20:20:01, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X(579)
wct=12 flg2=0xc807
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(476)
Doing spnego session setup
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(500)
NativeOS=[Windows 2002 2600 Service Pack 1] NativeLanMan=[Windows 2002 5.1]
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_spnego_negotiate(385)
Got OID 1 3 6 1 4 1 311 2 2 10
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_spnego_negotiate(388)
Got secblob of size 50
[2003/09/25 20:20:01, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(33)
Got NTLMSSP neg_flags=0xe008b297
[2003/09/25 20:20:01, 3] smbd/process.c:process_smb(890)
Transaction 11 of length 338
[2003/09/25 20:20:01, 3] smbd/process.c:switch_message(685)
switch message SMBsesssetupX (pid 343)
[2003/09/25 20:20:01, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X(579)
wct=12 flg2=0xc807
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(476)
Doing spnego session setup
[2003/09/25 20:20:01, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(500)
NativeOS=[Windows 2002 2600 Service Pack 1] NativeLanMan=[Windows 2002 5.1]
[2003/09/25 20:20:01, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(286)
Got user=[Thatsme] domain=[Mydomain] workstation=[Mine] len1=24 len2=24
[2003/09/25 20:20:01, 3] auth/auth.c:check_ntlm_password(216)
check_ntlm_password: Checking password for unmapped user [EMAIL PROTECTED] with the new password interface
[2003/09/25 20:20:01, 3] auth/auth.c:check_ntlm_password(219)
check_ntlm_password: mapped user is: [EMAIL PROTECTED]
[2003/09/25 20:20:01, 3] smbd/sec_ctx.c:push_sec_ctx(256)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2003/09/25 20:20:01, 3] smbd/uid.c:push_conn_ctx(287)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2003/09/25 20:20:01, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2003/09/25 20:20:01, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2003/09/25 20:20:01, 3] auth/auth_util.c:make_server_info_info3(1009)
User Thatsme does not exist, trying to add it
[2003/09/25 20:20:01, 0] auth/auth_util.c:make_server_info_info3(1017)
make_server_info_info3: pdb_init_sam failed! ... I don't understand this one ..
[2003/09/25 20:20:01, 2] auth/auth.c:check_ntlm_password(309)
check_ntlm_password: Authentication for user [Thatsme] -> [Thatsme] FAILED with error NT_STATUS_NO_SUCH_USER
... and I definitely have a domain logon ..
[2003/09/25 20:20:04, 3] smbd/process.c:timeout_processing(1099) timeout_processing: End of file from client (client has disconnected).
I tried raising the debug level info and got some interesting lines:
[2003/09/25 23:03:09, 10] libads/kerberos_verify.c:ads_verify_ticket(310)
ads_verify_ticket: enc type [16] failed to decrypt with error Bad encryption type
[2003/09/25 23:03:09, 10] libads/kerberos_verify.c:ads_verify_ticket(303)
ads_verify_ticket: enc type [3] decrypted message !
[2003/09/25 23:03:09, 10] passdb/secrets.c:secrets_named_mutex_release(709)
secrets_named_mutex: released mutex for replay cache mutex
[2003/09/25 23:03:09, 10] libsmb/clikrb5.c:get_krb5_smb_session_key(385)
Got KRB5 session key of length 8
...
[2003/09/25 23:03:09, 3] smbd/sesssetup.c:reply_spnego_kerberos(178) Ticket name is [EMAIL PROTECTED] [2003/09/25 23:03:09, 5] lib/username.c:Get_Pwnam(288) Finding user MYDOMAIN.COM\Thatsme [2003/09/25 23:03:09, 5] lib/username.c:Get_Pwnam_internals(223) Trying _Get_Pwnam(), username as lowercase is mydomain.com\thatsme
..and uppercase, and combinations, with and without the domain name appended..
[2003/09/25 23:03:10, 1] smbd/sesssetup.c:reply_spnego_kerberos(218)
Username Thatsme is invalid on this system
[2003/09/25 23:03:10, 3] smbd/error.c:error_packet(94)
error string = No such file or directory
[2003/09/25 23:03:10, 3] smbd/error.c:error_packet(113)
error packet at smbd/sesssetup.c(220) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE
-- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
