[Samba] some users cannot authenticate against ADS

André Welter welter at bitbone.de
Tue Sep 11 10:04:50 GMT 2007


Hi everyone,

this one is giving me headaches for a while now and I could not get
anything useful from the usual sources.
So maybe someone on this list can give me any ideas:

There is a samba server
    Version 3.0.22
    on Ubuntu Dapper
    see below for configuration details)
and it is configured to authenticate against a Windows 2000 Server
    Ver. 5.0.2.195
    preped for ADS 2003 and Exchange 2003
    domain runs in "native" mode
    defined as global catalog

wbinfo -u shows all ADS users

wbinfo -t, wbinfo -D 'Domain' are all successful

winbind is running

/etc/nsswitch.conf has 'files winbind' for passwd, shadow and group.

nscd has been activated and deactivated.

The problem is, some Windows users trying to access shares or printers
on the samba server cannot connect but some can. The only difference in
the smbd logs (log level 3) I spotted is this:

    smbd/sesssetup.c:reply_spnego_kerberos(303)
  Username DOMAIN/someuser is invalid on this system

for users that can't connect.

When trying on the samba server:

    rpcclient -c 'lookupnames somename' -Usomeuser localhost -d 3

for a not working account, I get (IPs and names changed):

added interface ip=1.2.3.5 bcast=1.2.255.255 nmask=255.255.0.0
lp_load: refreshing parameters
Initialising global parameters
params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
Processing section "[global]"
Password:
Connecting to host=localhost
Connecting to 127.0.0.1 at port 445
Doing spnego session setup (blob length=128)
got OID=1 2 840 113554 1 2 2
got OID=1 2 840 48018 1 2 2
got OID=1 3 6 1 4 1 311 2 2 10
got principal=cifs/principal.sub.domain.test at SUB.DOMAIN.TEST
Got challenge flags:
Got NTLMSSP neg_flags=0x60890235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x60080215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x60080215
SPNEGO login failed: Logon failure
failed session setup with NT_STATUS_LOGON_FAILURE
Cannot connect to server.  Error was NT_STATUS_LOGON_FAILURE

The same command still on the samba server but with the ads servers IP:

    rpcclient -c 'lookupnames somename' -Usomeuser 1.2.3.4 -d 3

added interface ip=1.2.3.5 bcast=1.2.255.255 nmask=255.255.0.0
lp_load: refreshing parameters
Initialising global parameters
params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
Processing section "[global]"
Password:
Connecting to host=1.2.3.4
Connecting to 1.2.3.4 at port 445
Doing spnego session setup (blob length=117)
got OID=1 2 840 48018 1 2 2
got OID=1 2 840 113554 1 2 2
got OID=1 2 840 113554 1 2 2 3
got OID=1 3 6 1 4 1 311 2 2 10
got principal=principal$@SUB.DOMAIN.TEST
Got challenge flags:
Got NTLMSSP neg_flags=0x62890215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x60080215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x60080215
rpc_pipe_bind: Remote machine 1.2.3.4 pipe \lsarpc fnum 0x9 bind request
returned ok.
lsa_io_sec_qos: length c does not match size 8
rpc_pipe_bind: Remote machine 1.2.3.4 pipe \lsarpc fnum 0xa bind request
returned ok.
lsa_io_sec_qos: length c does not match size 8
somename S-<correct sid> (User: 1)

I could not make out any difference in the user accounts between working
and not working accounts.

Any suggestions would be appreciated.

Thanks in advance.

André



Samba Server configuration:
[global]
        dos charset = CP850
        unix charset = UTF-8
        display charset = LOCALE
        workgroup = SUB
        realm = SUB.DOMAIN.TEST
        netbios name = MYMACHINE
        netbios aliases =
        netbios scope =
        server string = bitkit
        interfaces =
        bind interfaces only = No
        security = ADS
        auth methods =
        encrypt passwords = Yes
        update encrypted = No
        client schannel = Auto
        server schannel = Auto
        allow trusted domains = Yes
        hosts equiv =
        map to guest = Never
        null passwords = No
        obey pam restrictions = No
        password server = 192.168.0.69
        smb passwd file = /etc/samba/smbpasswd
        private dir = /etc/samba
        passdb backend = smbpasswd
        algorithmic rid base = 1000
        root directory =
        guest account = nobody
        enable privileges = Yes
        pam password change = No
        passwd program =
        passwd chat = *new*password* %n\n *new*password* %n\n *changed*
        passwd chat debug = No
        passwd chat timeout = 2
        check password script =
        username map =
        password level = 0
        username level = 0
        unix password sync = No
        restrict anonymous = 0
        lanman auth = Yes
        ntlm auth = Yes
        client NTLMv2 auth = No
        client lanman auth = Yes
        client plaintext auth = Yes
        preload modules =
        use kerberos keytab = No
        log level = 0
        syslog = 1
        syslog only = No
        log file =
        max log size = 5000
        debug timestamp = Yes
        debug hires timestamp = No
        debug pid = No
        debug uid = No
        smb ports = 445 139
        large readwrite = Yes
        max protocol = NT1
        min protocol = CORE
        read bmpx = No
        read raw = Yes
        write raw = Yes
        disable netbios = No
        reset on zero vc = No
        acl compatibility =
        defer sharing violations = Yes
        nt pipe support = Yes
        nt status support = Yes
        announce version = 4.9
        announce as = NT
        max mux = 50
        max xmit = 16644
        name resolve order = lmhosts wins host bcast
        max ttl = 259200
        max wins ttl = 518400
        min wins ttl = 21600
        time server = No
        unix extensions = Yes
        use spnego = Yes
        client signing = auto
        server signing = No
        client use spnego = Yes
        enable asu support = Yes
        svcctl list =
        change notify timeout = 60
        deadtime = 0
        getwd cache = Yes
        keepalive = 30
        kernel change notify = Yes
        lpq cache time = 30
        max smbd processes = 0
        paranoid server security = Yes
        max disk size = 0
        max open files = 10000
        socket options = TCP_NODELAY
        use mmap = Yes
        hostname lookups = No
        name cache timeout = 660
        load printers = Yes
        printcap cache time = 750
        printcap name =
        cups server =
        iprint server =
        disable spoolss = No
        enumports command =
        addprinter command =
        deleteprinter command =
        show add printer wizard = Yes
        os2 driver map =
        mangling method = hash2
        mangle prefix = 1
        max stat cache size = 0
        stat cache = Yes
        machine password timeout = 604800
        add user script =
        rename user script =
        delete user script =
        add group script =
        delete group script =
        add user to group script =
        delete user from group script =
        set primary group script =
        add machine script =
        shutdown script =
        abort shutdown script =
        username map script =
        logon script =
        logon path = \\%N\%U\profile
        logon drive =
        logon home = \\%N\%U
        domain logons = No
        os level = 2
        lm announce = Auto
        lm interval = 60
        preferred master = Auto
        local master = Yes
        domain master = Auto
        browse list = Yes
        enhanced browsing = Yes
        dns proxy = Yes
        wins proxy = No
        wins server =
        wins support = No
        wins hook =
        wins partners =
        kernel oplocks = Yes
        lock spin count = 3
        lock spin time = 10
        oplock break wait time = 0
        add share command =
        change share command =
        delete share command =
        eventlog list =
        config file =
        preload =
        lock directory =
        pid directory = /var/run/samba
        utmp directory =
        wtmp directory =
        utmp = No
        default service =
        message command =
        get quota command =
        set quota command =
        remote announce =
        remote browse sync =
        socket address = 0.0.0.0
        homedir map = auto.home
        afs username map =
        afs token lifetime = 604800
        log nt token command =
        time offset = 0
        NIS homedir = No
        panic action =
        host msdfs = No
        enable rid algorithm = Yes
        passdb expand explicit = Yes
        idmap backend =
        idmap uid = 10000-300000
        idmap gid = 10000-300000
        template homedir = /tmp/
        template shell = /bin/false
        winbind separator = /
        winbind cache time = 300
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind trusted domains only = No
        winbind nested groups = No
        winbind max idle children = 3
        winbind nss info = template
        comment =
        path =
        username =
        invalid users =
        valid users =
        admin users =
        read list =
        write list =
        printer admin =
        force user =
        force group =
        read only = Yes
        acl check permissions = Yes
        acl group control = No
        acl map full control = Yes
        create mask = 0744
        force create mode = 00
        security mask = 0777
        force security mode = 00
        directory mask = 0755
        force directory mode = 00
        directory security mask = 0777
        force directory security mode = 00
        force unknown acl user = No
        inherit permissions = No
        inherit acls = No
        inherit owner = No
        guest only = No
        guest ok = No
        only user = No
        hosts allow =
        hosts deny =
        allocation roundup size = 1048576
        aio read size = 0
        aio write size = 0
        aio write behind =
        ea support = No
        nt acl support = Yes
        profile acls = No
        map acl inherit = No
        afs share = No
        block size = 1024
        max connections = 0
        min print space = 0
        strict allocate = No
        strict sync = No
        sync always = No
        use sendfile = No
        write cache size = 0
        max reported print jobs = 0
        max print jobs = 1000
        printable = No
        printing = bsd
        cups options =
        print command = lpr -r -P'%p' %s
        lpq command = lpq -P'%p'
        lprm command = lprm -P'%p' %j
        lppause command =
        lpresume command =
        queuepause command =
        queueresume command =
        printer name =
        use client driver = No
        default devmode = No
        force printername = No
        default case = lower
        case sensitive = Auto
        preserve case = Yes
        short preserve case = Yes
        mangling char = ~
        hide dot files = Yes
        hide special files = No
        hide unreadable = No
        hide unwriteable files = No
        delete veto files = No
        veto files =
        hide files =
        veto oplock files =
        map archive = Yes
        map hidden = No
        map system = No
        map readonly = yes
        mangled names = Yes
        mangled map =
        store dos attributes = No
        browseable = Yes
        blocking locks = Yes
        csc policy = manual
        fake oplocks = No
        locking = Yes
        oplocks = Yes
        level2 oplocks = Yes
        oplock contention limit = 2
        posix locking = Yes
        strict locking = Yes
        share modes = Yes
        dfree cache time = 0
        dfree command =
        copy =
        preexec =
        preexec close = No
        root postexec =
        available = Yes
        volume =
        fstype = NTFS
        set directory = No
        wide links = Yes
        follow symlinks = Yes
        dont descend =
        magic script =
        magic output =
        delete readonly = No
        dos filemode = No
        dos filetimes = Yes
        dos filetime resolution = No
        fake directory create times = No
        vfs objects =
        msdfs root = No
        msdfs proxy =

[Software]
        path = /opt/software/
        guest ok = Yes

[print$]
        path = /etc/samba/printer/
        valid users = @printops
        write list = @printops
        force group = "printops"
        force create mode = 0664
        force directory mode = 0775

[... stripped other shares ... ]






More information about the samba mailing list