Troubleshooting kerberos problems with SambaProvide Samba access based on LDAP info?Authenticating Windows 7 against MIT Kerberos 5Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from WindowsKerberos Authenticator Encryption Type NULLPossible to authenticate Samba via Kerberos but without domain-join?Auth fail on Samba server with LDAP backendPowerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?Windows 7 : Application cannot write to shared folder - Access deniedSet up Samba with Active Directory and local user authenticationSamba ADS: Cannot contact any KDC for requested realm
C++ logging library
Why do radiation hardened IC packages often have long leads?
What is the Leave No Trace way to dispose of coffee grounds?
Find all letter Combinations of a Phone Number
Why do the Tie-fighter pilot helmets have similar ridges as the rebels?
Was Self-modifying-code possible just using BASIC?
Is Dumbledore a human lie detector?
Why would a home insurer offer a discount based on credit score?
If absolute velocity does not exist, how can we say a rocket accelerates in empty space?
Housemarks (superimposed & combined letters, heraldry)
Do you need to let the DM know when you are multiclassing?
Use 1 9 6 2 in this order to make 75
Can you make an identity from this product?
How many sets of dice do I need for D&D?
How was the airlock installed on the Space Shuttle mid deck?
Why isn't Bash trap working if output is redirected to stdout?
Grep Match and extract
What is the reason for setting flaps 1 on the ground at high temperatures?
Rail-to-rail op-amp only reaches 90% of VCC, works sometimes, not everytime
A Salute to Poetry
If the pressure inside and outside a balloon balance, then why does air leave when it pops?
Remove border lines of SRTM tiles rendered as hillshade
Suppose leased car is totalled: what are financial implications?
What would be the way to say "just saying" in German? (Not the literal translation)
Troubleshooting kerberos problems with Samba
Provide Samba access based on LDAP info?Authenticating Windows 7 against MIT Kerberos 5Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from WindowsKerberos Authenticator Encryption Type NULLPossible to authenticate Samba via Kerberos but without domain-join?Auth fail on Samba server with LDAP backendPowerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?Windows 7 : Application cannot write to shared folder - Access deniedSet up Samba with Active Directory and local user authenticationSamba ADS: Cannot contact any KDC for requested realm
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box.
\example_servmy_share : Fails with LOGIN FAILURE
\172.16.102.19my_share : Works just fine.
When I set smbd to debug logging, I get this:
[2015/03/23 17:33:03.306499, 3] smbd/sesssetup.c:662(reply_spnego_negotiate)
reply_spnego_negotiate: Got secblob of size 1840
[2015/03/23 17:33:03.306939, 10] libads/kerberos_verify.c:386(ads_secrets_verify_ticket)
libads/kerberos_verify.c:386: found previous password
[2015/03/23 17:33:03.315587, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.319930, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320027, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.320101, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320162, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.328693, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.332985, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333065, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.333128, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333192, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333234, 3] libads/kerberos_verify.c:638(ads_verify_ticket)
libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad encryption type)
[2015/03/23 17:33:03.333264, 10] libads/kerberos_verify.c:648(ads_verify_ticket)
libads/kerberos_verify.c:648: returning error NT_STATUS_LOGON_FAILURE
Which was enough to point me at something kerberos-y. So I did a bit of tcpdumping, and learned that different login methods are negotiated for machine-name and ip-only styles. When accessing via machine-name, it attempts a kerberos login and fails. When accessing via IP-address, it attempts NTLMv2, which works just fine.
Of interest, the Win 2008 R2 machine is in a child-domain of the one the Samba server is in. However, I have lots of examples of machines in the child domain correctly accessing the Samba machine.
Confoundingly, I have an identically configured samba system (testparm shows identical [global] settings) in another AD Site that is working just fine for this machine.
I'm at a loss over where to poke next.
- Something weird on the AD DC's in those two sites?
- Obscure Samba settings I'm not seeing?
I'm not sure where to go from here.
windows-server-2008-r2 samba kerberos
edited Jan 5 '16 at 23:41
chicks
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
add a comment |
I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box.
\example_servmy_share : Fails with LOGIN FAILURE
\172.16.102.19my_share : Works just fine.
When I set smbd to debug logging, I get this:
[2015/03/23 17:33:03.306499, 3] smbd/sesssetup.c:662(reply_spnego_negotiate)
reply_spnego_negotiate: Got secblob of size 1840
[2015/03/23 17:33:03.306939, 10] libads/kerberos_verify.c:386(ads_secrets_verify_ticket)
libads/kerberos_verify.c:386: found previous password
[2015/03/23 17:33:03.315587, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.319930, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320027, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.320101, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320162, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.328693, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.332985, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333065, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.333128, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333192, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333234, 3] libads/kerberos_verify.c:638(ads_verify_ticket)
libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad encryption type)
[2015/03/23 17:33:03.333264, 10] libads/kerberos_verify.c:648(ads_verify_ticket)
libads/kerberos_verify.c:648: returning error NT_STATUS_LOGON_FAILURE
Which was enough to point me at something kerberos-y. So I did a bit of tcpdumping, and learned that different login methods are negotiated for machine-name and ip-only styles. When accessing via machine-name, it attempts a kerberos login and fails. When accessing via IP-address, it attempts NTLMv2, which works just fine.
Of interest, the Win 2008 R2 machine is in a child-domain of the one the Samba server is in. However, I have lots of examples of machines in the child domain correctly accessing the Samba machine.
Confoundingly, I have an identically configured samba system (testparm shows identical [global] settings) in another AD Site that is working just fine for this machine.
I'm at a loss over where to poke next.
- Something weird on the AD DC's in those two sites?
- Obscure Samba settings I'm not seeing?
I'm not sure where to go from here.
windows-server-2008-r2 samba kerberos
edited Jan 5 '16 at 23:41
chicks
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
Have you compared the encryptions (search forenctypesinkrb5.confandkdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.
– dawud
Mar 23 '15 at 23:36
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14
add a comment |
I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box.
\example_servmy_share : Fails with LOGIN FAILURE
\172.16.102.19my_share : Works just fine.
When I set smbd to debug logging, I get this:
[2015/03/23 17:33:03.306499, 3] smbd/sesssetup.c:662(reply_spnego_negotiate)
reply_spnego_negotiate: Got secblob of size 1840
[2015/03/23 17:33:03.306939, 10] libads/kerberos_verify.c:386(ads_secrets_verify_ticket)
libads/kerberos_verify.c:386: found previous password
[2015/03/23 17:33:03.315587, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.319930, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320027, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.320101, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320162, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.328693, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.332985, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333065, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.333128, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333192, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333234, 3] libads/kerberos_verify.c:638(ads_verify_ticket)
libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad encryption type)
[2015/03/23 17:33:03.333264, 10] libads/kerberos_verify.c:648(ads_verify_ticket)
libads/kerberos_verify.c:648: returning error NT_STATUS_LOGON_FAILURE
Which was enough to point me at something kerberos-y. So I did a bit of tcpdumping, and learned that different login methods are negotiated for machine-name and ip-only styles. When accessing via machine-name, it attempts a kerberos login and fails. When accessing via IP-address, it attempts NTLMv2, which works just fine.
Of interest, the Win 2008 R2 machine is in a child-domain of the one the Samba server is in. However, I have lots of examples of machines in the child domain correctly accessing the Samba machine.
Confoundingly, I have an identically configured samba system (testparm shows identical [global] settings) in another AD Site that is working just fine for this machine.
I'm at a loss over where to poke next.
- Something weird on the AD DC's in those two sites?
- Obscure Samba settings I'm not seeing?
I'm not sure where to go from here.
windows-server-2008-r2 samba kerberos
edited Jan 5 '16 at 23:41
chicks
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box.
\example_servmy_share : Fails with LOGIN FAILURE
\172.16.102.19my_share : Works just fine.
When I set smbd to debug logging, I get this:
[2015/03/23 17:33:03.306499, 3] smbd/sesssetup.c:662(reply_spnego_negotiate)
reply_spnego_negotiate: Got secblob of size 1840
[2015/03/23 17:33:03.306939, 10] libads/kerberos_verify.c:386(ads_secrets_verify_ticket)
libads/kerberos_verify.c:386: found previous password
[2015/03/23 17:33:03.315587, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.319930, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320027, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.320101, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.320162, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.328693, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [18] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.332985, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [17] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333065, 3] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [23] failed to decrypt with error Decrypt integrity check failed
[2015/03/23 17:33:03.333128, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [1] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333192, 10] libads/kerberos_verify.c:435(ads_secrets_verify_ticket)
libads/kerberos_verify.c:435: enc type [3] failed to decrypt with error Bad encryption type
[2015/03/23 17:33:03.333234, 3] libads/kerberos_verify.c:638(ads_verify_ticket)
libads/kerberos_verify.c:638: krb5_rd_req with auth failed (Bad encryption type)
[2015/03/23 17:33:03.333264, 10] libads/kerberos_verify.c:648(ads_verify_ticket)
libads/kerberos_verify.c:648: returning error NT_STATUS_LOGON_FAILURE
Which was enough to point me at something kerberos-y. So I did a bit of tcpdumping, and learned that different login methods are negotiated for machine-name and ip-only styles. When accessing via machine-name, it attempts a kerberos login and fails. When accessing via IP-address, it attempts NTLMv2, which works just fine.
Of interest, the Win 2008 R2 machine is in a child-domain of the one the Samba server is in. However, I have lots of examples of machines in the child domain correctly accessing the Samba machine.
Confoundingly, I have an identically configured samba system (testparm shows identical [global] settings) in another AD Site that is working just fine for this machine.
I'm at a loss over where to poke next.
- Something weird on the AD DC's in those two sites?
- Obscure Samba settings I'm not seeing?
I'm not sure where to go from here.
windows-server-2008-r2 samba kerberos
windows-server-2008-r2 samba kerberos
edited Jan 5 '16 at 23:41
chicks
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
edited Jan 5 '16 at 23:41
chicks
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
edited Jan 5 '16 at 23:41
chicks
3,09072033
edited Jan 5 '16 at 23:41
chicks
3,09072033
edited Jan 5 '16 at 23:41
chicks
3,09072033
3,09072033
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
asked Mar 23 '15 at 18:21
Blue Warrior NFBBlue Warrior NFB
431317
431317
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
Have you compared the encryptions (search forenctypesinkrb5.confandkdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.
– dawud
Mar 23 '15 at 23:36
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14
add a comment |
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
Have you compared the encryptions (search forenctypesinkrb5.confandkdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.
– dawud
Mar 23 '15 at 23:36
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
Have you compared the encryptions (search for
enctypes in krb5.conf and kdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.– dawud
Mar 23 '15 at 23:36
Have you compared the encryptions (search for
enctypes in krb5.conf and kdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.– dawud
Mar 23 '15 at 23:36
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14
add a comment |
1 Answer
1
active
oldest
votes
I witnessed same behavior which was caused by un-synchronized AD's (Active Directory) after the server running samba was re-joined to domain.
After reading https://en.wikipedia.org/wiki/Kerberos_(protocol) I concluded the error means that samba (the service) cannot decrypt the "client-to-service" Kerberos ticket received from client, because in my case it was encoded by service's old secret key. According to wikipedia, the service secret key is a hash of service password stored in AD. The re-joining to domain generated new password. Until this change was propagated to other AD's, clients were receiving from their TGS (running on unsynchronized ADs) tickets encoded with old service secret.
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f677665%2ftroubleshooting-kerberos-problems-with-samba%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I witnessed same behavior which was caused by un-synchronized AD's (Active Directory) after the server running samba was re-joined to domain.
After reading https://en.wikipedia.org/wiki/Kerberos_(protocol) I concluded the error means that samba (the service) cannot decrypt the "client-to-service" Kerberos ticket received from client, because in my case it was encoded by service's old secret key. According to wikipedia, the service secret key is a hash of service password stored in AD. The re-joining to domain generated new password. Until this change was propagated to other AD's, clients were receiving from their TGS (running on unsynchronized ADs) tickets encoded with old service secret.
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
add a comment |
I witnessed same behavior which was caused by un-synchronized AD's (Active Directory) after the server running samba was re-joined to domain.
After reading https://en.wikipedia.org/wiki/Kerberos_(protocol) I concluded the error means that samba (the service) cannot decrypt the "client-to-service" Kerberos ticket received from client, because in my case it was encoded by service's old secret key. According to wikipedia, the service secret key is a hash of service password stored in AD. The re-joining to domain generated new password. Until this change was propagated to other AD's, clients were receiving from their TGS (running on unsynchronized ADs) tickets encoded with old service secret.
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
add a comment |
I witnessed same behavior which was caused by un-synchronized AD's (Active Directory) after the server running samba was re-joined to domain.
After reading https://en.wikipedia.org/wiki/Kerberos_(protocol) I concluded the error means that samba (the service) cannot decrypt the "client-to-service" Kerberos ticket received from client, because in my case it was encoded by service's old secret key. According to wikipedia, the service secret key is a hash of service password stored in AD. The re-joining to domain generated new password. Until this change was propagated to other AD's, clients were receiving from their TGS (running on unsynchronized ADs) tickets encoded with old service secret.
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
I witnessed same behavior which was caused by un-synchronized AD's (Active Directory) after the server running samba was re-joined to domain.
After reading https://en.wikipedia.org/wiki/Kerberos_(protocol) I concluded the error means that samba (the service) cannot decrypt the "client-to-service" Kerberos ticket received from client, because in my case it was encoded by service's old secret key. According to wikipedia, the service secret key is a hash of service password stored in AD. The re-joining to domain generated new password. Until this change was propagated to other AD's, clients were receiving from their TGS (running on unsynchronized ADs) tickets encoded with old service secret.
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
answered Dec 7 '15 at 7:09
Petr GajdůšekPetr Gajdůšek
11
11
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f677665%2ftroubleshooting-kerberos-problems-with-samba%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1.) Kerberos is DNS dependent. Are all servers in this scenario using same DNS, and are DNS entries there 100% accurate? 2.) How are you specifying login credentials? Sometimes SMB shares require full domain to be specified, i.e. "mydomain.localmyuser"
– jlehtinen
Mar 23 '15 at 18:57
@jlehtinen FQDN does work, though a bit less reliably than IP does. That's new data.
– Blue Warrior NFB
Mar 23 '15 at 19:16
Have you compared the encryptions (search for
enctypesinkrb5.confandkdc..conf) being used in a working and a non-working samba environment? (klist -k -e -K -F FILE), also this link might be of interest.– dawud
Mar 23 '15 at 23:36
It took lots of time to understand the issue. AS you mentioned, it could be netbios issue. Please check you have correct host name in /etc/hosts on samba server. The FQDN of the samba should match with windows AD domain i.e domain part of hostname should be AD domain name. As windows admin to set correct hostname for your samba or correct your hostname(samba)
– user330194
Jan 5 '16 at 18:14