[Samba] net ads join fails

[Roman Dilken]

Hi,

i've got a problem joining a domain with samba 4.1.17 on freebsd.

Everytime I try it, the join fails with a core dump.
Debugging it, it seems that it is stuck on authentication. Kerberos
works, I get credentials, but if I try to join the domain, it fails.

The problem seems to be somwhere in this debug-output:

1. net ads join:

Doing spnego session setup (blob length=96)
got OID=1.2.840.48018.1.2.2
got OID=1.2.840.113554.1.2.2
got OID=1.3.6.1.4.1.311.2.2.10
got principal=not_defined_in_RFC4178 at please_ignore
kerberos_kinit_password: as Administrator using [MEMORY:cliconnect] as
ccache and config [(null)]
cli_session_setup_spnego: using target hostname not SPNEGO principal
cli_session_setup_spnego: guessed server
principal=cifs/dc2.ad.dilken.eu at AD.DILKEN.EU
Doing kerberos session setup
ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect]
expiration Mi, 11 Mär 2015 05:00:16 CET
ads_krb5_mk_req: Ticket (cifs/dc2.ad.dilken.eu at AD.DILKEN.EU) in ccache
(MEMORY:cliconnect) is valid until: (Mi, 11 Mär 2015 05:00:16 CET -
1426046416)
Got KRB5 session key of length 16

2. samba-tool domain join

added interface nfe0 ip=192.168.2.87 bcast=192.168.2.255
netmask=255.255.255.0
added interface nfe0 ip=192.168.2.87 bcast=192.168.2.255
netmask=255.255.255.0
Socket options:
        SO_KEEPALIVE = 0
        SO_REUSEADDR = 0
        SO_BROADCAST = 0
        TCP_NODELAY = 4
        TCP_KEEPCNT = 0
        TCP_KEEPIDLE = 0
        TCP_KEEPINTVL = 0
        IPTOS_LOWDELAY = 0
        IPTOS_THROUGHPUT = 0
        SO_REUSEPORT = 0
        SO_SNDBUF = 66608
        SO_RCVBUF = 66608
        SO_SNDLOWAT = 2048
        SO_RCVLOWAT = 1
        SO_SNDTIMEO = 0
        SO_RCVTIMEO = 0
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gssapi_krb5
Received smb_krb5 packet of length 292
Received smb_krb5 packet of length 1293
Received smb_krb5 packet of length 1310
Received smb_krb5 packet of length 1288
gensec_gssapi: credentials were delegated
GSSAPI Connection will have no cryptographic protection
Bus error (Speicherabzug geschrieben)

Any hints? I try the whole day but I don't find where the failure is..

Oh, and via samba36, it worked.. I think there is some issue with krb5?

my smb4.conf:

[global]

        netbios name = fileserver
        workgroup = AD
        security = ADS
        realm = AD.DILKEN.EU
        dedicated keytab file = /usr/local/etc/krb5.keytab
        nsupdate command = /usr/local/bin/samba-nsupdate -g
        server role = member server
        winbind refresh tickets = yes
        #socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072
SO_SNDBUF=131072

        use sendfile = true

        idmap_ldp:use rfc2307 = yes
        idmap config *:backend = tdb
        idmap config *:range = 2000-9999
        idmap config AD:backend = ad
        idmap config AD:schema_mode = rfc2307
        idmap config AD:range = 10000-99999

        winbind nss info = rfc2307
        winbind trusted domains only = no
        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes

        log level = 10

        read only = no
        inherit permissions = No
        inherit acls = No
        inherit owner = No
        force unknown acl user = No
        store dos attributes = Yes
        map read only = No
        vfs objects = zfsacl

And krb5.conf:
[libdefaults]
        default_realm = AD.DILKEN.EU
        dns_lookup_realm = true
        dns_lookup_kdc = true
        forwardable = true
        ticket_lifetime = 24h
        renew_lifetime = 7d




Greetings,

Roman