[Samba] Migration Samba3 -> Samba4: Accessing domain member server is not working

Rowland Penny rowlandpenny241155 at gmail.com
Mon Jul 6 08:03:20 UTC 2015


On 06/07/15 08:53, Roland Schwingel wrote:
>
> Good morning Rowland and samba list ...
>
> Rowland Penny wrote on 03.07.2015 18:36:32:
>
> > From: Rowland Penny <rowlandpenny241155 at gmail.com>
> > To: samba at lists.samba.org,
> > Date: 03.07.2015 18:40
> > Subject: Re: [Samba] Migration Samba3 -> Samba4: Accessing domain
> > member server is not working
> > Sent by: samba-bounces at lists.samba.org
> >
> > On 03/07/15 16:31, Roland Schwingel wrote:
> > > Hi ...
> > >
> > > When trying to migrate from samba3 to samba 4.2.2 I am facing a 
> severe
> > > problem that bugs me for hours now. I cannot get a samba 4.2.2
> > > fileserver to work with a samba 4.2.2 PDC as a domain member.
> > >
> ...
> > Hi, there was some changes made when 4.2.0 came out, these changes may
> > be your problem, see here:
> >
> > https://www.samba.org/samba/history/samba-4.2.0.html
> >
> > Under the heading:  Winbindd/Netlogon improvements
>
> Thanks for the hint. I read that and added "allow nt4 crypto = yes" to 
> my 4.2.2 PDC. This changed this a little bit but still gives me no 
> working 4.2.2 member server. Adding "require strong key = no" and 
> "client NTLMv2 auth = no" to the member servers smb.conf but it did 
> not change anything.
>
> Here is the log file on the dedicated member server of one client 
> trying to connect my member server:
>
> SID for local machine OSUSE-TEST is: 
> S-1-5-21-1853263269-3041869306-167322181
> SID for domain MYDOM is: S-1-5-21-290147797-1639656955-1287535205
> Join to 'MYDOM' is OK
> [2015/07/06 08:02:46.342573,  3] 
> ../source3/smbd/oplock.c:1306(init_oplocks)
>   init_oplocks: initializing messages.
> [2015/07/06 08:02:46.342706,  3] 
> ../source3/smbd/process.c:1879(process_smb)
>   Transaction 0 of length 159 (0 toread)
> [2015/07/06 08:02:46.342748,  3] 
> ../source3/smbd/process.c:1489(switch_message)
>   switch message SMBnegprot (pid 10895) conn 0x0
> [2015/07/06 08:02:46.343225,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [PC NETWORK PROGRAM 1.0]
> [2015/07/06 08:02:46.343263,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [LANMAN1.0]
> [2015/07/06 08:02:46.343288,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [Windows for Workgroups 3.1a]
> [2015/07/06 08:02:46.343302,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [LM1.2X002]
> [2015/07/06 08:02:46.343313,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [LANMAN2.1]
> [2015/07/06 08:02:46.343329,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [NT LM 0.12]
> [2015/07/06 08:02:46.343344,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [SMB 2.002]
> [2015/07/06 08:02:46.343358,  3] 
> ../source3/smbd/negprot.c:575(reply_negprot)
>   Requested protocol [SMB 2.???]
> [2015/07/06 08:02:46.343571,  3] 
> ../source3/smbd/smb2_negprot.c:211(smbd_smb2_request_process_negprot)
>   Selected protocol SMB2_FF
> [2015/07/06 08:02:46.344934,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'gssapi_spnego' registered
> [2015/07/06 08:02:46.344982,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'gssapi_krb5' registered
> [2015/07/06 08:02:46.344996,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'gssapi_krb5_sasl' registered
> [2015/07/06 08:02:46.356774,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'sasl-DIGEST-MD5' registered
> [2015/07/06 08:02:46.356804,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'spnego' registered
> [2015/07/06 08:02:46.356819,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'schannel' registered
> [2015/07/06 08:02:46.356831,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'naclrpc_as_system' registered
> [2015/07/06 08:02:46.356841,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'sasl-EXTERNAL' registered
> [2015/07/06 08:02:46.356852,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'ntlmssp' registered
> [2015/07/06 08:02:46.356862,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'http_basic' registered
> [2015/07/06 08:02:46.356872,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'http_ntlm' registered
> [2015/07/06 08:02:46.356883,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'krb5' registered
> [2015/07/06 08:02:46.356894,  3] 
> ../auth/gensec/gensec_start.c:885(gensec_register)
>   GENSEC backend 'fake_gssapi_krb5' registered
> [2015/07/06 08:02:46.357284,  3] 
> ../source3/smbd/negprot.c:683(reply_negprot)
>   Selected protocol SMB 2.???
> [2015/07/06 08:02:46.359312,  3] 
> ../source3/smbd/smb2_negprot.c:211(smbd_smb2_request_process_negprot)
>   Selected protocol SMB2_10
> [2015/07/06 08:02:46.990929,  3] 
> ../auth/ntlmssp/ntlmssp_util.c:34(debug_ntlmssp_flags)
>   Got NTLMSSP neg_flags=0xe2088297
> [2015/07/06 08:02:46.991652,  3] 
> ../auth/ntlmssp/ntlmssp_server.c:359(ntlmssp_server_preauth)
>   Got user=[roland] domain=[MYDOM] workstation=[DEVINTEL-100] len1=24 
> len2=314
> [2015/07/06 08:02:46.991697,  3] 
> ../source3/param/loadparm.c:3647(lp_load_ex)
>   lp_load_ex: refreshing parameters
> [2015/07/06 08:02:46.991811,  3] 
> ../source3/param/loadparm.c:564(init_globals)
>   Initialising global parameters
> [2015/07/06 08:02:46.991927,  3] 
> ../source3/param/loadparm.c:2597(lp_do_section)
>   Processing section "[global]"
> [2015/07/06 08:02:46.992040,  2] 
> ../source3/param/loadparm.c:2614(lp_do_section)
>   Processing section "[testshare]"
> [2015/07/06 08:02:46.992111,  3] 
> ../source3/param/loadparm.c:1495(lp_add_ipc)
>   adding IPC service
> [2015/07/06 08:02:46.994597,  3] 
> ../source3/libsmb/namequery.c:3103(get_dc_list)
>   get_dc_list: preferred server list: "PDCHOST, subnet-ldap"
> [2015/07/06 08:02:46.994804,  3] 
> ../source3/libsmb/namequery.c:2323(resolve_hosts)
>   resolve_hosts: Attempting host lookup for name subnet-ldap<0x20>
> [2015/07/06 08:02:47.022939,  3] 
> ../source3/libsmb/namequery_dc.c:207(rpc_dc_name)
>   rpc_dc_name: Returning DC PDCHOST (192.168.9.3) for domain MYDOM
> [2015/07/06 08:02:47.023024,  3] 
> ../source3/lib/util_sock.c:617(open_socket_out_send)
>   Connecting to 192.168.9.3 at port 445
> [2015/07/06 08:02:47.083675,  3] 
> ../source3/auth/auth.c:178(auth_check_ntlm_password)
>   check_ntlm_password:  Checking password for unmapped user 
> [MYDOM]\[roland]@[DEVINTEL-100] with the new password interface
> [2015/07/06 08:02:47.083721,  3] 
> ../source3/auth/auth.c:181(auth_check_ntlm_password)
>   check_ntlm_password:  mapped user is: [MYDOM]\[roland]@[DEVINTEL-100]
> [2015/07/06 08:02:47.083862,  3] 
> ../source3/libsmb/namequery.c:3103(get_dc_list)
>   get_dc_list: preferred server list: "PDCHOST, subnet-ldap"
> [2015/07/06 08:02:47.084734,  3] 
> ../source3/libsmb/namequery_dc.c:207(rpc_dc_name)
>   rpc_dc_name: Returning DC PDCHOST (192.168.9.3) for domain MYDOM
> [2015/07/06 08:02:47.084963,  3] 
> ../source3/lib/util_sock.c:617(open_socket_out_send)
>   Connecting to 192.168.9.3 at port 445
> [2015/07/06 08:02:47.188335,  0] 
> ../source3/auth/auth_domain.c:302(domain_client_validate)
>   domain_client_validate: unable to validate password for user roland 
> in domain MYDOM to Domain controller PDCHOST. Error was 
> NT_STATUS_LOCK_NOT_GRANTED.
> [2015/07/06 08:02:47.189817,  2] 
> ../source3/auth/auth.c:315(auth_check_ntlm_password)
>   check_ntlm_password:  Authentication for user [roland] -> [roland] 
> FAILED with error NT_STATUS_LOCK_NOT_GRANTED
> [2015/07/06 08:02:47.189854,  2] 
> ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg)
>   SPNEGO login failed: NT_STATUS_LOCK_NOT_GRANTED
> [2015/07/06 08:02:47.190446,  3] 
> ../source3/smbd/server_exit.c:246(exit_server_common)
>   Server exit (NT_STATUS_CONNECTION_RESET)
>
> So the problem is appearing here:
> [2015/07/06 08:02:47.188335,  0] 
> ../source3/auth/auth_domain.c:302(domain_client_validate)
>   domain_client_validate: unable to validate password for user roland 
> in domain MYDOM to Domain controller PDCHOST. Error was 
> NT_STATUS_LOCK_NOT_GRANTED.
>
> Why on earth is this happening? When my win7 testmachine is trying
> to access the 4.2.2 PDC directly everything is fine and easy. So I 
> believe the setup of the PDC is correct.
>
> In the first 2 lines of the log I see the SIDs dumped.
> Both for my domain and for my member server.
>
> SID for local machine OSUSE-TEST is: 
> S-1-5-21-1853263269-3041869306-167322181
> SID for domain MYDOM is: S-1-5-21-290147797-1639656955-1287535205
> Join to 'MYDOM' is OK
>
> According to my LDAP the sid for my test member server (OSUSE-TEST) 
> should be S-1-5-21-290147797-1639656955-1287535205-61405

Just what do you mean by 'According to my LDAP' ?
Have *you* set the SID somewhere?


>
> Is this maybe a problem? Or is this just the real local sid not the 
> domain sid of this machine?

The local SID is *never* the domain SID, you should use the domain SID.

Rowland

>
> Where shall I look on my 4.2.2 PDC to get more infos on the auth 
> problem? The logfiles for the member server are empty on my PDC.
>
> Thanks for all your help! I hope this can be resolved soon!
>
> Roland




More information about the samba mailing list