[Samba] Samba 4.2.0rc4 can't authenticate users
Thomas Schulz
schulz at adi.com
Thu Feb 12 13:20:25 MST 2015
Adding a section of a debug level 5 log at the end that looks like it
might have some usefull information.
> This problem shows up on both Linux and Solaris. I am going to show
> the logs from a Fedora 2.6.25-14.fc9.i686 machine.
>
> We are using 'security = domain' with a Windows 2000 domain controller.
> We are setting 'password server = starfish2' dispite the fact that the
> documentation says that this in not necessary as we have found it to
> be necessary. We are setting 'workgroup = adi'.
>
> I installed Samba 4.2.0rc4 in the same location as a previous 4.1.7
> installation after removing everything in bin, sbin & lib. We are
> running just nmbd and smbd.
>
> Following are sections of two log files with debug set to 2. The first
> one is just after starting Samba after it had been down for about
> 20 minutes. The second is after shutting down Samba and restarting it
> about 2 minutes later. In each case I did not try to access anything
> until about 2 minutes after starting Samba
>
> The first log.
>
> 2015/02/11 15:53:38.155177, 2] ../source3/smbd/reply.c:593(reply_special)
> netbios connect: name1=BREAM 0x20 name2=TETRA 0x0
> [2015/02/11 15:53:38.155651, 2] ../source3/smbd/reply.c:634(reply_special)
> netbios connect: local=bream remote=tetra, name type = 0
> [2015/02/11 15:53:38.434732, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> [2015/02/11 15:53:38.441081, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> ------------------- Processing section stuff cut -------------------------
> [2015/02/11 15:53:38.524513, 1] ../librpc/ndr/ndr.c:604(ndr_push_error)
> ndr_push_error(5): Bad character conversion
> [2015/02/11 15:53:38.524853, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
> domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
> [2015/02/11 15:53:38.527744, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
> check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_INVALID_PARAMETER
> [2015/02/11 15:53:38.527941, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
> SPNEGO login failed: NT_STATUS_INVALID_PARAMETER
> ----------------- Logging contunues with a different file name --------------
> [2015/02/11 15:53:38.202215, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> [2015/02/11 15:53:38.207809, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> ------------------- Processing section stuff cut -------------------------
> [2015/02/11 15:53:38.344414, 1] ../librpc/ndr/ndr.c:604(ndr_push_error)
> ndr_push_error(5): Bad character conversion
> [2015/02/11 15:53:38.344762, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
> domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_INVALID_PARAMETER.
> [2015/02/11 15:53:38.347669, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
> check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_INVALID_PARAMETER
> [2015/02/11 15:53:38.347979, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
> SPNEGO login failed: NT_STATUS_INVALID_PARAMETER
>
>
> *********** The second log: ****************
>
> [2015/02/11 15:57:06.212318, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> [2015/02/11 15:57:06.218904, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> ------------------- Processing section stuff cut -------------------------
> [2015/02/11 15:57:06.249431, 2] ../source3/libsmb/namequery.c:1356(name_query_validator)
> Got a positive name query response from 192.168.2.178 ( 192.168.2.178 )
> [2015/02/11 15:57:06.324185, 1] ../librpc/ndr/ndr.c:578(ndr_pull_error)
> ndr_pull_error(11): Pull bytes 8 (../librpc/ndr/ndr_basic.c:234)
> [2015/02/11 15:57:06.324577, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
> domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_BUFFER_TOO_SMALL.
> [2015/02/11 15:57:06.327510, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
> check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_BUFFER_TOO_SMALL
> [2015/02/11 15:57:06.327704, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
> SPNEGO login failed: NT_STATUS_BUFFER_TOO_SMALL
> [2015/02/11 15:57:06.387160, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> [2015/02/11 15:57:06.391843, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> ------------------- Processing section stuff cut -------------------------
> [2015/02/11 15:57:06.485269, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
> domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
> [2015/02/11 15:57:06.488256, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
> check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_ACCESS_DENIED
> [2015/02/11 15:57:06.488526, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
> SPNEGO login failed: NT_STATUS_ACCESS_DENIED
> [2015/02/11 15:57:06.551853, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> [2015/02/11 15:57:06.556682, 2] ../source3/smbd/sesssetup.c:551(setup_new_vc_session)
> setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
> ------------------- Processing section stuff cut -------------------------
> [2015/02/11 15:57:06.639993, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
> domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_ACCESS_DENIED.
> [2015/02/11 15:57:06.642980, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
> check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_ACCESS_DENIED
> [2015/02/11 15:57:06.643253, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
> SPNEGO login failed: NT_STATUS_ACCESS_DENIED
*********** Part of a debug level 5 log ************
[2015/02/12 14:39:33.993426, 5] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send)
rpc_api_pipe: host STARFISH2
[2015/02/12 14:39:33.996657, 5] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send)
rpc_read_send: data_to_read: 64
[2015/02/12 14:39:33.997205, 1] ../librpc/ndr/ndr.c:578(ndr_pull_error)
ndr_pull_error(11): Pull bytes 8 (../librpc/ndr/ndr_basic.c:234)
[2015/02/12 14:39:33.997493, 0] ../source3/auth/auth_domain.c:302(domain_client_validate)
domain_client_validate: unable to validate password for user schulz in domain ADI to Domain controller STARFISH2. Error was NT_STATUS_BUFFER_TOO_SMALL.
[2015/02/12 14:39:34.000494, 5] ../source3/auth/auth.c:252(auth_check_ntlm_password)
check_ntlm_password: winbind authentication for user [schulz] FAILED with error NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.000731, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [schulz] -> [schulz] FAILED with error NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.000797, 5] ../source3/auth/auth_ntlmssp.c:188(auth3_check_password)
Checking NTLMSSP password for ADI\schulz failed: NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.000902, 5] ../auth/ntlmssp/ntlmssp_server.c:455(ntlmssp_server_check_password)
../auth/ntlmssp/ntlmssp_server.c:455: Checking NTLMSSP password for ADI\schulz failed: NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.001104, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
SPNEGO login failed: NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.001242, 4] ../source3/smbd/sec_ctx.c:421(pop_sec_ctx)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2015/02/12 14:39:34.001319, 5] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order)
check lock order 1 for /opt/local/samba4/var/lock/smbXsrv_session_global.tdb
[2015/02/12 14:39:34.001540, 5] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor)
release lock order 1 for /opt/local/samba4/var/lock/smbXsrv_session_global.tdb
[2015/02/12 14:39:34.001695, 3] ../source3/smbd/error.c:82(error_packet_set)
NT error packet at ../source3/smbd/sesssetup.c(267) cmd=115 (SMBsesssetupX) NT_STATUS_BUFFER_TOO_SMALL
[2015/02/12 14:39:34.001775, 5] ../source3/lib/util.c:168(show_msg)
[2015/02/12 14:39:34.001813, 5] ../source3/lib/util.c:178(show_msg)
size=35
smb_com=0x73
smb_rcls=35
smb_reh=0
smb_err=49152
smb_flg=136
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=26523
smb_mid=128
smt_wct=0
smb_bcc=0
[2015/02/12 14:39:34.004257, 5] ../source3/lib/util_sock.c:132(read_fd_with_timeout)
read_fd_with_timeout: blocking read. EOF from client.
[2015/02/12 14:39:34.004335, 5] ../source3/smbd/process.c:553(receive_smb_talloc)
receive_smb_raw_talloc failed for client ipv4:192.168.2.23:2401 read error = NT_STATUS_END_OF_FILE.
[2015/02/12 14:39:34.004465, 4] ../source3/smbd/sec_ctx.c:316(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2015/02/12 14:39:34.004530, 5] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2015/02/12 14:39:34.004585, 5] ../source3/auth/token_util.c:639(debug_unix_user_token)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
Tom Schulz
Applied Dynamics Intl.
schulz at adi.com
More information about the samba
mailing list