[Samba] MS06-035 problems?

[Alan Munter]

It was a false alarm, it turns out.  The guy who was installing the
machine forgot to edit the selinux configuration on the default FC5
install.  It was in "permissive" mode, but it needed to be "disabled" in
order for it to work.

Thanks,

Alan

On Thu, 2006-07-13 at 12:52 -0500, Gerald (Jerry) Carter wrote:

> Alan Munter wrote:
> 
> > I just patched our domain controllers with MS06-035 
> > because it said it was just fixing a couple of memory
> > leak problems with SMB in srvsvc.
> > 
> > Now, this afternoon, one of my colleagues tried to 
> > join a FC5 machine to our active directory using
> > the recipe that we have been using for years
> > (which worked yesterday, according to him), and 
> > it fails on "net ads join".
> > 
> > No changes have been made to the domain controllers 
> > other than the Black Tuesday patches.
> > 
> > Here's a log dump from "net -d4 ads join".  We get the error:
> 
> What version of Samba is this 3.0.22 ?
> 
> > [2006/07/12 15:55:14, 3]
> > libads/kerberos.c:kerberos_derive_salting_principal_for_enctype(571) 
> >   verify_service_password: get_service_ticket failed: KDC has no support
> > for encryption type
> 
> Ignore that.  It's not the issue.
> 
> > Any ideas of what's going on?  Need more info?  Did MS 
> > sneak some more changes into the server service that
> > they aren't talking about in that patch?
> 
> Need more details.  What do level 10 debug logs from smbd tell you about
> the failed authentication?
> 
> 
> 
> cheers, jerry