[Samba] Samba 4.2.0rc4 can't authenticate users

Thu Feb 12 09:44:15 MST 2015

This problem shows up on both Linux and Solaris. I am going to show
the logs from a Fedora 2.6.25-14.fc9.i686 machine.

We are using 'security = domain' with a Windows 2000 domain controller.
We are setting 'password server = starfish2' dispite the fact that the
documentation says that this in not necessary as we have found it to
be necessary. We are setting 'workgroup = adi'.

I installed Samba 4.2.0rc4 in the same location as a previous 4.1.7
installation after removing everything in bin, sbin & lib. We are
running just nmbd and smbd.

Following are sections of two log files with debug set to 2. The first
one is just after starting Samba after it had been down for about
20 minutes. The second is after shutting down Samba and restarting it
about 2 minutes later. In each case I did not try to access anything
until about 2 minutes after starting Samba

The first log.

2015/02/11 15:53:38.155177,  2] ../source3/smbd/reply.c:593(reply_special)
  netbios connect: name1=BREAM          0x20 name2=TETRA          0x0
[2015/02/11 15:53:38.155651,  2] ../source3/smbd/reply.c:634(reply_special)
  netbios connect: local=bream remote=tetra, name type = 0
[2015/02/11 15:53:38.434732,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2015/02/11 15:53:38.441081,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:53:38.524513,  1] ../librpc/ndr/ndr.c:604(ndr_push_error)
  ndr_push_error(5): Bad character conversion
[2015/02/11 15:53:38.524853,  0] ../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
[2015/02/11 15:53:38.527744,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_INVALID_PARAMETER
[2015/02/11 15:53:38.527941,  2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_INVALID_PARAMETER
----------------- Logging contunues with a different file name --------------
[2015/02/11 15:53:38.202215,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2015/02/11 15:53:38.207809,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:53:38.344414,  1] ../librpc/ndr/ndr.c:604(ndr_push_error)
  ndr_push_error(5): Bad character conversion
[2015/02/11 15:53:38.344762,  0] ../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
[2015/02/11 15:53:38.347669,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_INVALID_PARAMETER
[2015/02/11 15:53:38.347979,  2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_INVALID_PARAMETER

*********** The second log: ****************

[2015/02/11 15:57:06.212318,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2015/02/11 15:57:06.218904,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.249431,  2] ../source3/libsmb/namequery.c:1356(name_query_validator)
  Got a positive name query response from 192.168.2.178 ( 192.168.2.178 )
[2015/02/11 15:57:06.324185,  1] ../librpc/ndr/ndr.c:578(ndr_pull_error)
  ndr_pull_error(11): Pull bytes 8 (../librpc/ndr/ndr_basic.c:234)
[2015/02/11 15:57:06.324577,  0] ../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_BUFFER_TOO_SMALL.
[2015/02/11 15:57:06.327510,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_BUFFER_TOO_SMALL
[2015/02/11 15:57:06.327704,  2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_BUFFER_TOO_SMALL
[2015/02/11 15:57:06.387160,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2015/02/11 15:57:06.391843,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.485269,  0] ../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
[2015/02/11 15:57:06.488256,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.488526,  2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.551853,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2015/02/11 15:57:06.556682,  2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
------------------- Processing section stuff cut -------------------------
[2015/02/11 15:57:06.639993,  0] ../source3/auth/auth_domain.c:302(domain_client_validate)
  domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
[2015/02/11 15:57:06.642980,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_ACCESS_DENIED
[2015/02/11 15:57:06.643253,  2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_ACCESS_DENIED

Tom Schulz
Applied Dynamics Intl.
schulz at adi.com