[Samba] AD member ticket verify errors

Tue Nov 30 13:05:54 GMT 2004

On Mon, 2004-11-29 at 17:36 -0800, John Stile wrote: 
> On Mon, 2004-11-29 at 16:48 -0800, Jeremy Allison wrote:
> > On Mon, Nov 29, 2004 at 01:26:36PM -0800, John Stile wrote:
> > > I installed samba-3.0.9-1 on RedHat-AS3, configured it as a member
> > > server, and joined the domain.  wbinfo -u and -g work.  When I brows to
> > > the samba share from Windows XP client, I see the shares, and my home
> > > directory is listed, but I am prompted for a password when I try to use
> > > the share.  No password works.  The samba log for the client session
> > > shows: 'smbd/sesssetup.c:reply_spnego_kerberose(173) Failed to verify
> > > incoming ticket!'  
> > > 
> > > Is this a common problem?
> > > 
> > > The system has RedHat rpm's:
> > >   krb5-libs-1.2.7-28
> > >   krb5-workstation-1.2.7-28
> > >   krb5-devel-1.2.7-28
> > 
> > You're going to need krb5 1.3 or later for the correct enctype.
> 
> Is there an rpm available for RedHat AS?
I got it working but only after some bad practices.
My verbose notes follow:
------------------------ 
Downloaded source rpm for fedora :
  wget http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/SRPMS/krb5-1.3.1-6.src.rpm
     # NOTE: tried krb5-1.3.4-5.src.rpm  but it failed.
-------------------------
Rebuild kerberose (first try):
 rpmbuild --rebuild krb5-1.3.1-6.src.rpm
    error: Failed build dependencies:
           bison is needed by krb5-1.3.1-6
           e2fsprogs-devel >= 1.33 is needed by krb5-1.3.1-6
           libtermcap-devel is needed by krb5-1.3.1-6
-------------------------
Install needed packages:  
 up2date -i bison e2fsprogs-devel libtermcap-devel    
   #Note: version of e2fsprogs too old. need to upgrade
-------------------------
Download newer version of e2fsprogs:  
  wget  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/SRPMS/e2fsprogs-1.34-1.src.rpm
  rpmbuild --rebuild e2fsprogs-1.34-1.src.rpm
  rpm -U /usr/src/redhat/RPMS/i386/e2fsprogs-1.34-1.i386.rpm
  rpm -U /usr/src/redhat/RPMS/i386/e2fsprogs-devel-1.34-1.i386.rpm
-------------------------
Rebuild kerberose (second try)
  rpmbuild --rebuild krb5-1.3.1-6.src.rpm
-------------------------
Install new kerberose
  rpm -U /usr/src/redhat/RPMS/i386/krb5-*

        error: Failed dependencies:
        libcom_err.so.3 is needed by (installed) <everything under the sun>
-------------------------
Since I know we are upgrading existing requiremetns, I think it's ok to use --nodeps   
   rpm -Uhiv --nodeps /usr/src/redhat/RPMS/i386/krb5-*
-------------------------
Rebuilding latest samba rpm from samba.org to ensure linking against kerberose
   rpmbuild --rebuild samba-3.0.9-1.src.rpm   
-------------------------
Install samba
   rpm -i /usr/src/redhat/RPMS/i386/samba-3.0.9-1.i386.rpm
       Installing stack version of /etc/pam.d/samba...
-------------------------
Create my /etc/samba/smb.conf
  [global]
   server string = Samba Server
   workgroup = MYREALM
   realm = MYREALM.MY.DOMAIN.COM
   security = ADS
   map to guest = Bad User
   password server = *
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   preferred master = no
   local master = no
   domain master = no
   os level = 33
   wins server = 128.32.68.75 128.32.67.118
   ldap ssl = no
   idmap uid = 10000-20000
   idmap gid = 10000-20000
   winbind enum users = yes
   winbind enum groups = yes
   winbind separator = +
   winbind use default domain = Yes
<shares snipped>
-------------------------
Create the /etc/krb5.conf
 [logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
 [libdefaults]
  ticket_lifetime = 24000
  default_realm = MYREALM.MY.DOMAIN.COM
  dns_lookup_realm = true
  dns_lookup_kdc = true
 [realms]
  MYREALM.MY.DOMAIN.COM = {
   kdc = hcs-ad-a.myrealm.my.domain.com:88
   admin_server = hcs-ad-a.myrealm.my.domain.com:749
   default_domain = myrealm.my.domain.com
  }

 [domain_realm]
  .myrealm.domain.com = MYREALM.MY.DOMAIN.COM
  myrealm.domain.com = MYREALM.MY.DOMAIN.COM
  .myrealm.my.domain.com = MYREALM.MY.DOMAIN.COM
  myrealm.my.domain.com = MYREALM.MY.DOMAIN.COM
 [kdc]
  profile = /var/kerberos/krb5kdc/kdc.conf
 [appdefaults]
  pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
  }
-------------------------
Starting winbind fails:
  /etc/init.d/winbind start
     Starting Winbind services: winbindd: error while loading shared libraries: libcom_err.so.3: cannot open shared object file: No such file or directory                                                          [FAILED]
-------------------------
It looks like the new verison of kerberose doesn't supply libcom_err.so.3
  whereis libcom_err.so.3
       libcom_err.so: /lib/libcom_err.so.2 /usr/lib/libcom_err.so
  ls -alF /lib/libcom_err.so.2*
       lrwxrwxrwx    1 root   root    17 Nov 30 02:53 /lib/libcom_err.so.2 -> libcom_err.so.2.1*
       -rwxr-xr-x    1 root   root 18472 Nov 30 02:52 /lib/libcom_err.so.2.1*
  ldconfig  -p |grep libcom
        libcom_err.so.2 (libc6) => /lib/libcom_err.so.2
        libcom_err.so (libc6) => /usr/lib/libcom_err.so
-------------------------
Hackit:
  cd /lib/
  ln -s libcom_err.so.2 libcom_err.so.3
-------------------------
Starting winbind succeds:
  /etc/init.d/winbind start
-------------------------
Test: Can winbind get users and groups from AD
   wbinfo -u 
   wbinfo -g
-------------------------
Test: Can we get user and groups from winbind via nss (/etc/nsswitch.conf)
   getent passwd  
   getent group    
-------------------------
Test: Test kerberos communication with AD
   net ads info 
-------------------------
Test: local time vs. AD time ( critical for kerberose tickets, <5sec diff )
   net time
      Tue Nov 30 04:59:46 2004
   date
      Tue Nov 30 04:59:49 PST 2004
-------------------------
Test: From a windows XP client, 
      Successfully brows the shares and can access them.