[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

L.P.H. van Belle belle at bazuin.nl
Tue Sep 1 13:43:35 UTC 2015 

Try this on your samba DC. 

amba-tool spn list PCNAME$ 

You should see something like: 

PCNAME$$
User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following servicePrincipalName:
         HOST/PCNAME
         HOST/PCNAME.internal.domain.tld
	   nfs/PCNAME.internal.domain.tld
         nfs/PCNAME.internal.domain.tld at YOUR_REALM 

can you confirm this for both your servers which you want to use nfs on. 

And host/pcname is not HOST/PCNAME 
These must match depending on what the software wants. 
For example, my zarafa mail server software must have : HTTP/mail....  
And not http/mail.... 

Greetz, 

Louis




-----Oorspronkelijk bericht-----
Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel (RRZE)
Verzonden: dinsdag 1 september 2015 15:04
Aan: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just hacked the code to also query userPrincipalName in authsam_search_account()
(hardcoded my realm for now). Now the NFS client object is found, however password
authentication fails:

  auth_check_password_send: Checking password for unmapped user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
  auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))
  dn: <GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
  sAMAccountName: nfsclient_nfs$
  userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST
  servicePrincipalName: nfs/nfsclient.mydom.test
  servicePrincipalName: host/nfsclient_nfs.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
  ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
  Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test after wrong password
  auth_check_password_recv: sam_ignoredomain authentication for user [MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD

As the whole NFS thing is krb5 based, I guess checking NTLM passwords
(with zero-length) is not the way to go ...

Any ideas / patches welcome ...

Marcel


-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE)
Gesendet: Dienstag, 1. September 2015 11:25
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update

Hi again,

I just started to debug things on the samba4 side:

When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs):

  auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
  map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
  auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[]
   expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
  sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test
  auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER

>From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails).

I guess this search should look something like this:

(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))

I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call.

Please, could someone more familiar with the samba code base provide me with the required information to do this?

Bye,
   Marcel

-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)

Hi,

has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory?

I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS  server running when using samba as AD.

As far as i can tell, the setup looks good:

I've got Linux based NFS servers and clients  (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails.

Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble.


The failing windows NFS Server reports lots of messages like:

"Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test.

Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log.

MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"

The security log reports:

"An account failed to log on.

Subject:
        Security ID:            SYSTEM
        Account Name:           WIN12$
        Account Domain:         MYDOM
        Logon ID:               0x3E7

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           nfs/nfsclient.mydom.test
        Account Domain:         MYDOM.TEST

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xC000006D
        Sub Status:             0xC0000064

Process Information:
        Caller Process ID:      0x4
        Caller Process Name:

Network Information:
        Workstation Name:
        Source Network Address: -
        Source Port:            -

Detailed Authentication Information:
        Logon Process:          NfsSvr
        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Transited Services:     -
        Package Name (NTLM only):       -
        Key Length:             0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
        - Transited services indicate which intermediate services have participated in this logon request.
        - Package name indicates which sub-protocol was used among the NTLM protocols.
        - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
"

For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess.

Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)?

Any other ideas what could cause this?

Marcel

BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

More information about the samba mailing list