[Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Ritter, Marcel (RRZE)
marcel.ritter at fau.de
Wed Sep 2 06:42:40 UTC 2015
Hi Louis,
thanks for pointing out some of the specialities of kerberos,
however I know about these and they're not the cause of my
current problem :-(
The SPNs look fine to me (but just to mention another speciality
of NFS/kerberos/AD: Windows kerberos implementation handles
ServicePrincipalNames (SPNs) quite different from UserPrincipalNames
(UPNs) - that's the reason for the separate AD object mentioned below).
Windows (NFS) Server:
User CN=WIN12,CN=Computers,DC=mydom,DC=test has the following servicePrincipalName:
HOST/win12.mydom.test
RestrictedKrbHost/win12.mydom.test
HOST/WIN12
RestrictedKrbHost/WIN12
WSMAN/win12.mydom.test
WSMAN/win12
nfs/win12.mydom.test
nfs/WIN12
TERMSRV/win12.mydom.test
TERMSRV/WIN12
Linux (NFS) Client:
User CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test has the following servicePrincipalName:
nfs/nfsclient.mydom.test
host/nfsclient_nfs.mydom.test
The NFS Client has 2 separate objects in the samba AD:
One created by "net ads join" containing the typical HOSTNAME$
(used for winbindd) and another one for nfs/* (that's the one listed above).
The nfs/* credentials are stored in a separate keytab (that's used
by rpc.gssd). I know that newer versions of nfs-utils can also use the
HOSTNAME$ principals, but as we're in an interop test, we're trying
to make things work for as much clients/servers as possible.
Jeremy asked to open a bug on this topic and to provide logs and network
traces, so that'll be my next step.
Thanks for your comments and help,
Marcel
-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H. van Belle
Gesendet: Dienstag, 1. September 2015 15:44
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Try this on your samba DC.
amba-tool spn list PCNAME$
You should see something like:
PCNAME$$
User CN=PCNAME,CN=Computers,DC=internal,DC=domain,DC=tld has the following servicePrincipalName:
HOST/PCNAME
HOST/PCNAME.internal.domain.tld
nfs/PCNAME.internal.domain.tld
nfs/PCNAME.internal.domain.tld at YOUR_REALM
can you confirm this for both your servers which you want to use nfs on.
And host/pcname is not HOST/PCNAME
These must match depending on what the software wants.
For example, my zarafa mail server software must have : HTTP/mail....
And not http/mail....
Greetz,
Louis
-----Oorspronkelijk bericht-----
Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ritter, Marcel (RRZE)
Verzonden: dinsdag 1 september 2015 15:04
Aan: samba at lists.samba.org
Onderwerp: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi again,
I just hacked the code to also query userPrincipalName in authsam_search_account() (hardcoded my realm for now). Now the NFS client object is found, however password authentication fails:
auth_check_password_send: Checking password for unmapped user [MYDOM.TEST]\[nfs/nfsclient.mydom.test]@[]
map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[]
expr: (&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))
dn: <GUID=ca5c6126-5e81-4922-ab02-36fde71c864a>;<SID=S-1-5-21-2241806907-2227165239-2043804668-2105>;CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test
sAMAccountName: nfsclient_nfs$
userPrincipalName: nfs/nfsclient.mydom.test at MYDOM.TEST
servicePrincipalName: nfs/nfsclient.mydom.test
servicePrincipalName: host/nfsclient_nfs.mydom.test
ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
ntlm_password_check: invalid LanMan password length (0) for user nfs/nfsclient.mydom.test
Not updating badPwdCount on CN=nfsclient_nfs,CN=Computers,DC=mydom,DC=test after wrong password
auth_check_password_recv: sam_ignoredomain authentication for user [MYDOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_WRONG_PASSWORD
As the whole NFS thing is krb5 based, I guess checking NTLM passwords (with zero-length) is not the way to go ...
Any ideas / patches welcome ...
Marcel
-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE)
Gesendet: Dienstag, 1. September 2015 11:25
An: samba at lists.samba.org
Betreff: Re: [Samba] Samba 4 and MS Windows NFS Server (2012R2) - Update
Hi again,
I just started to debug things on the samba4 side:
When trying to mount the Windows NFS share, I get the following error on the samba4 dc (just grepping for nfs in the logs):
auth_check_password_send: Checking password for unmapped user [S5DOM.TEST]\[nfs/nfsclient.mydom.test]@[]
map_user_info_cracknames: Mapping user [MYDOM.TEST]\[nfs/nfsclient.mydom.test] from workstation []
auth_check_password_send: mapped user is: [MYDOM]\[nfs/nfsclient.mydom.test]@[]
expr: (&(sAMAccountName=nfs/nfsclient.mydom.test)(objectclass=user))
sam_search_user: Couldn't find user [nfs/nfsclient.mydom.test] in samdb, under DC=mydom,DC=test
auth_check_password_recv: sam_ignoredomain authentication for user [S5DOM\nfs/nfsclient.mydom.test] FAILED with error NT_STATUS_NO_SUCH_USER
From a first search, it looks like function authsam_search_account() from source4/auth/ntlm/auth_sam.c does this lookup (and fails).
I guess this search should look something like this:
(&(|(sAMAccountName=nfs/nfsclient.mydom.test)(userPrincipalName=nfs/nfsclient.mydom.test at MYDOM.TEST))(objectclass=user))
I'd like to give this a try, however I've no idea how to get the required realm name from the parameters available during authsam_search_account() call.
Please, could someone more familiar with the samba code base provide me with the required information to do this?
Bye,
Marcel
-----Ursprüngliche Nachricht-----
Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von Ritter, Marcel (RRZE)
Gesendet: Montag, 31. August 2015 08:44
An: samba at lists.samba.org
Betreff: [Samba] Samba 4 and MS Windows NFS Server (2012R2)
Hi,
has anyone out there tried to get a Windows Server 2012R2 based NFS Server running against a Samba4 active directory?
I'm currently doing some interop testing, and I cannot get a Windows Server 2012R2 based NFS server running when using samba as AD.
As far as i can tell, the setup looks good:
I've got Linux based NFS servers and clients (Ubuntu + SuSE) up and running fine (krb5 auth against samba DC), but trying to access the Windows NFS server fails.
Outside the above testbed I've tried to mount NFS shares on a different Windows Server (joined against our MS AD) and access from Linux clients works fine here, so I guess it's not MS NFS server itself that's causing the trouble.
The failing windows NFS Server reports lots of messages like:
"Server for NFS was unable to obtain security information for the GSS user account MYDOM.TEST\nfs/nfsclient.mydom.test.
Check that the user account MYDOM.TEST\nfs/nfsclient.mydom.test
is valid and meets als configured security policies. Ther may be additional information in the Windows Security event log.
MSV Status: 0xC000009A, Substatus: 0x0
S4U Status: 0xC000006D, Substatus: 0x0
"
The security log reports:
"An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: WIN12$
Account Domain: MYDOM
Logon ID: 0x3E7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: nfs/nfsclient.mydom.test
Account Domain: MYDOM.TEST
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Process Information:
Caller Process ID: 0x4
Caller Process Name:
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NfsSvr
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
"
For me it looks like Windows NFS server does some additional/different lookups that fail on a samba backend but succeed against a Windows AD, but that's just a guess.
Is there an easy way to debug LDAP lookups (and results) in Samba 4 (by setting a certain log level maybe)?
Any other ideas what could cause this?
Marcel
BTW, I've tested this with Ubuntu samba package 4.1.6, but also with latest git version of samba.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
More information about the samba
mailing list