[Samba] Can't mount samba drive or join domain with W2K3 server

[Adam Rosi-Kessel]

Please cc me on replies.

My employer recently upgraded to W2K3.  I have no control over the
employer's set up and limited access to information.  Under the old
server, everything was working fine.  Now I can't mount the shared drive
anymore.

I'm running Debian sid; samba 3.0.6-3.

################################################
# mount shared_drive
cli_negprot: SMB signing is mandatory and we have disabled it.
13681: protocol negotiation failed
SMB connection failed
################################################

I have added to smb.conf:

################################################
client use spnego = yes
client signing = mandatory 
################################################

This makes no difference.

I never had to join the domain/workgroup before, but I thought I would
try it as I've seen that suggested in some postings.  That doesn't work
either (output slightly sanitized for confidentiality):

################################################
# net join -l -n my_computer_name -I shared_server_ip_address -U my_username
my_username's password:
[2004/09/02 10:44:17, 0] utils/net_ads.c:ads_startup(183)
  ads_connect: No such file or directory
[2004/09/02 10:44:17, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2004/09/02 10:44:17, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2004/09/02 10:44:17, 0] utils/net_rpc_join.c:net_rpc_join_newstyle(319)
  Error domain join verification (reused connection):
NT_STATUS_INVALID_COMPUTER_NAME

Unable to join domain <domain_name>.
################################################

I tried adding a workgroup and realm line to /etc/samba/smb.conf:

realm = <domain_name>
workgroup = <domain_name>

Now I get:

################################################
# net join -l -n my_computer_name -I shared_server_ip_address -U my_username
my_username's password:
[2004/09/02 10:45:59, 0] libads/kerberos.c:ads_kinit_password(136)
  kerberos_kinit_password my_username at my_domain failed: Improper format of
Kerberos configuration file
[2004/09/02 10:45:59, 0] utils/net_ads.c:ads_startup(183)
  ads_connect: Improper format of Kerberos configuration file
[2004/09/02 10:45:59, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2004/09/02 10:46:00, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2004/09/02 10:46:00, 0] utils/net_rpc_join.c:net_rpc_join_newstyle(319)
  Error domain join verification (reused connection):
NT_STATUS_INVALID_COMPUTER_NAME

Unable to join domain <domain_name>.
################################################

If I type the wrong password, it says "The username or password was not
correct." So it's clearly getting through one stage of authentication.

I am limited in my ability to ask IT staff here any questions, so I
basically need to figure this out on my own.

Any suggestions?
-- 
Adam Rosi-Kessel
http://adam.rosi-kessel.org