[Samba] bad encryption type in AD domain authentication

Ivo Bellin Salarin ivo.bellinsalarin at gmail.com
Mon May 4 12:16:09 GMT 2009


Hello,

I'm trying to access a samba share using an ADS user credentials. I always
get an error, and the debug traces (log level = 5) are giving me the output
in the follow.
I have searched the samba ML archives, and I have found the thread
http://lists.samba.org/archive/samba/2004-April/084545.html
but, before asking the system admin to apply the eventual KB fixes, I would
like to know if the problem is really the same: *what are the codes 296 and
471* which can be found in the follow? *do they show the algorithm used to
decrypt the token*? so, is this the same problem, since the email I linked
above shows a 323 code?* is there a list of codes/algorithms, if my
hypothesis is correct*? (I've tried the samba websvn, but it isn't currently
available)

[2009/05/04 11:29:45,  3] smbd/sesssetup.c:reply_spnego_negotiate(802)
  reply_spnego_negotiate: Got secblob of size 1445
[2009/05/04 11:29:45,  3]
libads/kerberos_verify.c:ads_secrets_verify_ticket(296)
  ads_secrets_verify_ticket: enc type [23] failed to decrypt with error
Decrypt integrity check failed
[2009/05/04 11:29:45,  3] libads/kerberos_verify.c:ads_verify_ticket(471)
  ads_verify_ticket: krb5_rd_req with auth failed (Bad encryption type)
[2009/05/04 11:29:45,  1] smbd/sesssetup.c:reply_spnego_kerberos(350)
  Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
[2009/05/04 11:29:45,  3] smbd/error.c:error_packet_set(61)
  error packet at smbd/sesssetup.c(352) cmd=115 (SMBsesssetupX)
NT_STATUS_LOGON_FAILURE

and
[2009/05/04 11:29:51,  3]
libads/kerberos_verify.c:ads_secrets_verify_ticket(296)
  ads_secrets_verify_ticket: enc type [23] failed to decrypt with error
Decrypt integrity check failed
[2009/05/04 11:29:51,  3] libads/kerberos_verify.c:ads_verify_ticket(471)
  ads_verify_ticket: krb5_rd_req with auth failed (Bad encryption type)


-- 
pgp.mit.edu:0A4D0FDD
http://www.nilleb.com


More information about the samba mailing list