[Samba] Very strange behaviour of the NAS

[Lars Hanke]

Recently I suddenly lose all permissions both for SMB and NFS4 on my 
Synology NAS.And similarly after poking some time in muddy waters, it 
suddenly works again. The NAS runs Samba 3.6.9.

What I found, when the permissions were gone:

1. id user still working, didn't work last time so I assume a caching 
issue here

2. wbinfo -u same as above. This time still worked, last time only 
reported local accounts

3. wbinfo -t
checking the trust secret for domain AD via RPC calls failed
error code was NT_STATUS_NO_TRUST_SAM_ACCOUNT (0xc000018b)
failed to call wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR
Could not check secret

4. net ads testjoin
kerberos_kinit_password URDABORN$@AD.MICROSULT.DE failed: Client not 
found in Kerberos database
kerberos_kinit_password URDABORN$@AD.MICROSULT.DE failed: Client not 
found in Kerberos database
Join to domain is not valid: Improperly formed account name

5. kinit Administrator
Password for Administrator at AD.MICROSULT.DE:
Warning: Your password will expire in 2 hours on Mon Jan 26 21:38:17 2015

Oops, so I changed the password using a different client, which was OK 
during that time. After I tried on that client:

6. kinit -c tmp.tkt Administrator
Password for Administrator at AD.MICROSULT.DE:
Warning: Your password will expire in 41 days on Mon Mar  9 19:07:20 2015

Alright, this was to expect. Back on the NAS even after restarting Samba:

7. kinit Administrator
Password for Administrator at AD.MICROSULT.DE:
Warning: Your password will expire in 2 hours on Mon Jan 26 21:38:17 2015

Oops - well, close eyes and continue. We have a valid password for 
another 2 hours ...:(


8. net ads leave -U Administrator
Enter Administrator's password:
Failed to leave domain: failed to leave realm: No such file or directory

Which directory is ittalking about? So we try to join, since it might 
take over the account.

9. net ads join -U Administrator
Enter Administrator's password:
Using short domain name -- AD
Joined 'URDABORN' to realm 'ad.microsult.de'
DNS Update for urdaborn.ad.microsult.de failed: ERROR_DNS_INVALID_MESSAGE
DNS update failed!

Well, checked the DNS that it still serves forward and reverse mapping 
of the NAS and it does. The NAS unfortunately neither has hst nor dig.

10. kinit Administrator
Password for Administrator at AD.MICROSULT.DE:
Warning: Your password will expire in 2 hours on Mon Jan 26 21:38:17 2015

11. net ads testjoin
Join is OK

12. wbinfo -t
checking the trust secret for domain AD via RPC calls succeeded

Okay,write this question to the list ...

13. kinit Administrator
Password for Administrator at AD.MICROSULT.DE:
Warning: Your password will expire in 41 days on Mon Mar  9 19:07:20 2015

This log is somewhat shortened. I iterated the commands shown here and 
several restarts of samba. 8.-13. are exactly how I typed.

This is not solved, since something quite similar happened yesterday. I 
may have fixed it by joining the domain using the DSM GUI. If this now 
happens every day or each lifetime of a ticket, I'm in deep trouble. 
Moreover the NAS worked flawlessly for a couple of months until 
yesterday. I'm not aware of any recent changes before yesterday.

Any ideas how to circle the issue?

Thanks,
  - lars.