[Samba] samba-tool and --kerberos

[Andrew Bartlett]

On Mon, 2015-10-19 at 14:27 +0200, mathias dufresne wrote:
> You're right, but I tried successfully -k only with smbclient which
> accept
> -U and -k together (now I'm here I must say smbclient uses -k without
> argument).
> 
> For net command I was not able to make -k nor "--kerberos yes"
> m707:~# net rpc service list  --kerberos=yes
> Could not connect to server 127.0.0.1
> The username or password was not correct.
> Connection failed: NT_STATUS_LOGON_FAILURE
> 
> m707:~# net rpc service list -S m707 -k=yes
> 
> Invalid option -k=yes: unknown option
> Usage:
>   Use 'net help rpc' to get more extensive information about 'net
> rpc'
> commands.
>   Use 'net help rap' to get more extensive information about 'net
> rap'
> commands.
>  ....
> 
> m707:~# net rpc service list -S m707 --kerberos yes
> Usage: net rpc service list
> 
> 
> Only "--kerberos=yes" seems to work:
> m707:~# *net rpc service list  --kerberos=yes -S <DCname>*
> Spooler                 "Print Spooler"
> NETLOGON                "Net Logon"
> RemoteRegistry          "Remote Registry Service"
> WINS                    "Windows Internet Name Service (WINS)"
> 
> I'll try to propose some modification of associated man pages but I'm
> quiet
> lazy...

Yes, there is a residual inconsistency between the tools with origin
'samba4' and those with origin 'samba3'.  The behaviour of -k is the
biggest one.  Because of the way the duplicates got sorted out, 'samba
-tool' is the most obvious of the differences, but you will also see
the same -k yes behaviour on smbtorture.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba