[Samba] Authenticating Samba 3.4.2 vs WinServer 2008R2

[Bober, Mark]

Here's some things from log level 99:

[2009/10/12 09:43:53, 10] lib/util.c:2626(name_to_fqdn)
  name_to_fqdn: lookup for HOSTNAME -> hostname.domain.wustl.edu.
[2009/10/12 09:43:53, 10]
libads/kerberos_verify.c:220(ads_keytab_verify_ticket)
  ads_keytab_verify_ticket:
krb5_rd_req_return_keyblock_from_keytab(host/hostname.domain.wustl.edu at D
OMAIN.WUSTL.EDU) failed: Wrong principal in request
 [2009/10/12 09:43:53, 10]
libads/kerberos_verify.c:220(ads_keytab_verify_ticket)
  ads_keytab_verify_ticket:
krb5_rd_req_return_keyblock_from_keytab(host/hostname at DOMAIN.WUSTL.EDU)
failed: Wrong principal in request
 [2009/10/12 09:43:53,  3]
libads/kerberos_verify.c:266(ads_keytab_verify_ticket)
  ads_keytab_verify_ticket: krb5_rd_req failed for all 12 matched keytab
principals
[2009/10/12 09:43:53,  3]
libads/kerberos_verify.c:567(ads_verify_ticket)
  ads_verify_ticket: krb5_rd_req with auth failed (Wrong principal in
request)
[2009/10/12 09:43:53, 10]
libads/kerberos_verify.c:576(ads_verify_ticket)
  ads_verify_ticket: returning error NT_STATUS_LOGON_FAILURE

I cut some of that out - it tried each name 6 times, hence the 12?
Looking at the system keytab, and the computer account in AD, everything
seems to match. FWIW, if I leave the domain and come back specifying the
remaining 2003 server as the password server, this all looks the same
and seems to work....

How much does capitalization matter? ADSIEDIT shows the
ServicePrincipalNames as

HOST/hostname.domain.wustl.edu
HOST/HOSTNAME

Where the keytab is:

host/hostname.domain.wustl.edu
host/hostname


-----Original Message-----
From: samba-bounces at lists.samba.org
[mailto:samba-bounces at lists.samba.org] On Behalf Of Dirk Jakobsmeier
Sent: Thursday, October 08, 2009 10:57 PM
To: samba at lists.samba.org
Subject: Re: [Samba] Authenticating Samba 3.4.2 vs WinServer 2008R2

Hello Mark,

Am Donnerstag 08 Oktober 2009 16:03:13 schrieb Bober, Mark:
> Hello! I'm having an odd issue between Samba and Win2k8R2. We updated
> one of our domain controllers to 2k8R2, and as such are working in a
> 2003-level AD environment. If I force the 'password server' to the
2003
> DC, then everything works fine, only working against the 2008 box has
> issues.

we have several issues here depending on one of our servers (2008). E.g.

domainnames (username at domainname) has to be written in capital lettres
when 
connecting to shares...

> \\128.252.123.123\sharename <file:///\\128.252.123.123\sharename>
> 
> And it works as expected - my clients are in the same domain, no
> password is asked for, etc.
> 
> Using any form of the hostname in the URI, either \\hostname\sharename
> <file:///\\hostname\sharename>  or \\hostname.domain.name\sharename
> <file:///\\hostname.domain.name\sharename>  in the URI will
continually
> prompt for a password.  Using 'smbclient' with the names in the URI on
> the Samba box itself works fine.

> 
> log level = 1
> 

did you try to set this to a higher level (and restart samba)? I always
use 99 
so i get large logfiles with nearly all informations i need. The
clientlog 
(log.clienthostname or log.clientip) could be interresting.

-- 

Dirk
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba