No subject

Sun Sep 6 16:29:27 MDT 2009

=20

\\128.252.123.123\sharename <file:///\\128.252.123.123\sharename>=20

=20

And it works as expected - my clients are in the same domain, no
password is asked for, etc.

=20

Using any form of the hostname in the URI, either \\hostname\sharename
<file:///\\hostname\sharename>  or \\hostname.domain.name\sharename
<file:///\\hostname.domain.name\sharename>  in the URI will continually
prompt for a password.  Using 'smbclient' with the names in the URI on
the Samba box itself works fine.

=20

My Samba configuration is below (I may not have cleaned everything up
properly from the 3.0.x to 3.4.2 upgrade), and I'm sure there's cruft
from my troubleshooting attempts:

=20

[global]

   workgroup =3D DOMAIN

   security =3D ads

   hosts allow =3D 128.252. 172.16. 172.20.

   load printers =3D no

   log file =3D /var/log/samba/%m.log

   max log size =3D 50

   realm =3D DOMAIN.WUSTL.EDU

debug level =3D 1

log level =3D 1

domain logons =3D no

domain master =3D no

local master =3D no

socket options =3D TCP_NODELAY SO_SNDBUF=3D8192 SO_RCVBUF=3D8192
IPTOS_THROUGHPUT

strict locking =3D no

#share modes =3D yes

password level =3D 0

#use kerberos keytab =3D true

kerberos method =3D system keytab

password server =3D 2k8r2.domain.wustl.edu

encrypt passwords =3D yes

preferred master =3D no

wins support =3D yes

name resolve order =3D wins lmhosts hosts bcast

dns proxy =3D yes

=20

Below this is a debug level 3 log dump of a login that does not work.
One thing to note is that when the login works, the Samba log is named
the hostname of the client machine, when it doesn't, it's
"__ffff_172.16.123.123", or the IP address of the client. I really want
to say this has something to do with name resolving but I can't seem to
pin it down.=20

=20

The log is long,  so I'll say thanks for any help here. Thanks!

=20

[2009/10/08 08:48:12,  3] lib/access.c:362(only_ipaddrs_in_list)

  only_ipaddrs_in_list: list has non-ip address (128.252.)

[2009/10/08 08:48:12,  3] lib/access.c:396(check_access)

  check_access: hostnames in host allow/deny list.

[2009/10/08 08:48:12,  2] lib/access.c:406(check_access)

  Allowed connection from __ffff_172.16.24.49 (::ffff:172.16.24.49)

 [2009/10/08 08:48:12,  3] smbd/process.c:1459(process_smb)

  Transaction 0 of length 159 (0 toread)

[2009/10/08 08:48:12,  3] smbd/process.c:1273(switch_message)

  switch message SMBnegprot (pid 21043) conn 0x0

[2009/10/08 08:48:12,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx =3D 0

 [2009/10/08 08:48:12,  3] smbd/negprot.c:387(reply_nt1)

  using SPNEGO

[2009/10/08 08:48:12,  3] smbd/negprot.c:672(reply_negprot)

  Selected protocol NT LM 0.12

[2009/10/08 08:48:12,  3] smbd/process.c:1459(process_smb)

  Transaction 1 of length 1928 (0 toread)

[2009/10/08 08:48:12,  3] smbd/process.c:1273(switch_message)

  switch message SMBsesssetupX (pid 21043) conn 0x0

[2009/10/08 08:48:12,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx =3D 0

[2009/10/08 08:48:12,  3] smbd/sesssetup.c:1404(reply_sesssetup_and_X)

  wct=3D12 flg2=3D0xc807

[2009/10/08 08:48:12,  2] smbd/sesssetup.c:1360(setup_new_vc_session)

  setup_new_vc_session: New VC =3D=3D 0, if NT4.x compatible we would =
close
all old resources.

[2009/10/08 08:48:12,  3]
smbd/sesssetup.c:1160(reply_sesssetup_and_X_spnego)

  Doing spnego session setup

[2009/10/08 08:48:12,  3]
smbd/sesssetup.c:1202(reply_sesssetup_and_X_spnego)

  NativeOS=3D[] NativeLanMan=3D[] PrimaryDomain=3D[]

[2009/10/08 08:48:12,  3] smbd/sesssetup.c:786(reply_spnego_negotiate)

  reply_spnego_negotiate: Got secblob of size 1783

[2009/10/08 08:48:12,  3]
libads/kerberos_verify.c:266(ads_keytab_verify_ticket)

  ads_keytab_verify_ticket: krb5_rd_req failed for all 12 matched keytab
principals

[2009/10/08 08:48:12,  3]
libads/kerberos_verify.c:567(ads_verify_ticket)

  ads_verify_ticket: krb5_rd_req with auth failed (Wrong principal in
request)

[2009/10/08 08:48:12,  1] smbd/sesssetup.c:342(reply_spnego_kerberos)