[Samba] Samba 4 "Classic PDC" trusts fail with Win 2012 domain but succeed Win 2008

[Gaiseric Vandal]

I noticed that smbclient worked on some solaris 11 machines but not 
others.  The issue a slightly different version of libarchive on the 
machine (0.12 vs 0.13), even though I thought all machines had been 
patched to the same level.  So I decided to recompile.

When recompiling samba 4.4.7 on solaris 11  I saw the following warning

     Checking for header krb5.h                                   : no


The fix for this in Solaris 11 with gcc 4.8.x is

     export C_INCLUDE_PATH=/usr/include:/usr/include/kerberosv5
     export CPLUS_INCLUDE_PATH=/usr/include:/usr/include/kerberosv5


When compling samba 3, if memory serves, I would get a little summary of 
which features were enabled and which were not.

I don't think kerberos is requires for domain trusts?  I know that 
Active Directory does use kerberos but , when trusts are involved, Samba 
in classic mode "thinks" that the Windows domain controller is an NT4 
machine.    So whether krb5.h was found or not it shouldn't matter.

Thanks






On 11/22/16 17:53, Gaiseric Vandal wrote:
> I am not sure if this is relevant
>
>     root at sambaPDC:~# /usr/local/samba/bin/net rpc trustdom establish
>     DomainB
>
>     Enter DOMAINA$'s password:
>     Could not connect to server DomainB_DC
>     Trust to domain DomainB established
>     root at sambaPDC:~#
>
>
>     root at sambaPDC:~# /usr/local/samba/bin/net rpc trustdom establish
>     DomainC
>
>     Enter DOMAINA$'s password:
>     Could not connect to server DomainC_DC
>     Trust to domain DomainC established
>     root at sambaPDC:~#
>
>
>     root at sambaPDC:~# /usr/local/samba/bin/net rpc trustdom list -U
>     Administrator
>     Trusted domains list:
>
>     DOMAINA      S-1-5-21-xxxx-xxxx-xxxx
>     DOMAINB      S-1-5-21-xxxx-xxxx-xxxx
>
>     Trusting domains list:
>
>     DOMAINA      S-1-5-21-xxxx-xxxx-xxxx
>     DOMAINB       S-1-5-21-xxxx-xxxx-xxxx
>
>
>
> I MAY have seen  "could not connect to server..." errors in the past 
> even when trusts did work.
>
>
>
> On 11/22/16 13:40, Gaiseric Vandal wrote:
>> In summary
>>
>>  * DomainA    Samba classic domain-  PDC and BDC are running Samba 
>> 4.4.7.  The PDC is called "SambaPDC."
>>  * DomainB    Windows AD domain , level 2008, domain controller is 
>> Windows 2012   or 2012R2 (you are correct that there are not primary 
>> and backup controllers in AD)
>>  * DomainC    Windows AD domain, level 2008, domain controllers are  
>> Windows 2008
>>
>>
>> I need to get trusts established between DomainA and DomainB. (I 
>> don't actually need trusts between DomainA and DomainC, but hoped it 
>> might flush out a working configuration)
>>
>>
>>
>> I can not  setup trusts between DomainA and DomainB in either 
>> direction.     The domain controller of domainB  just complains that 
>> it cannot establish an RPC connection to DomainA's PDC (The PDC on 
>> domainA has winbind errors relating to domain C.)  (On the DomainA 
>> PDC, wbinfo isn't showing trusted users from domainC and I see errors 
>> in the winbind log.)
>>
>>
>>
>> I can partially setup trusts between DomainA and DomainC.   The 
>> domain controller of domainC  thinks two way trusts are enabled (can 
>> verify them)  and I am able to grant DomainA users access to files on 
>> DomainC servers.  (On the DomainA PDC, wbinfo isn't showing trusted 
>> users from domainC and I see errors in the winbind log.)
>>
>>
>> Wondering if I should have complied Samba using "--without-ad-dc" 
>> option.
>>
>>
>>
>>
>>
>> On 11/22/16 12:43, Rowland Penny via samba wrote:
>>> See inline comments:
>>>
>>> On Tue, 22 Nov 2016 12:04:57 -0500
>>> Gaiseric Vandal via samba <samba at lists.samba.org> wrote:
>>>
>>>> I am trying to configuring  Samba 4 classic PDC to trust  Windows
>>>> 2012 domain "DomainB" -  the PDC is running Windows 2012 but the
>>>> forest and domain functional levels are still Windows 2008. On the
>>>> Win 2012 PDC I try to set up an incoming trust, but it fails with
>>>> "The local security authority is unable to obtain an RPC connection
>>>> to the active directory domain controller SAMBAPDC .  "
>>> Can we confirm what I think the above means:
>>>
>>> You have a NT4-style PDC
>>> You have 'DomainB' in which there is a Windows 2012 AD DC running as
>>> domain functional level 2008 (This is NOT a PDC)
>>> You are trying to set up a trust between the PDC and the AD DC
>>>
>>>>
>>>>
>>>> I have an third domain "DomainC"  -   the PDC is running Windows
>>>> 2008 , and  the forest and domain functional levels are still Windows
>>>> 2008. On that PDC I am able to configure and verify an incoming trust.
>>>>
>>> Again, you have an AD DC running windows 2008 and you can configure a
>>> trust, but you don't say between what.
>>>> I am guessing some recent security patch that applies to Windows 2012
>>>> but not to Windows 2008 is the issue?
>>>>
>>> Sounds like it.
>>>> Since samba is a configured as a classic domain, I would have
>>>> expected the Windows 2012 DC to see the samba domain as an NT4 domain.
>>>>
>>> Should do, but microsoft seems to be trying to make it harder, see
>>> here:
>>>
>>> https://social.technet.microsoft.com/Forums/en-US/f2bf83d8-6dcc-45de-a99d-fe5d83a83e12/can-i-join-an-nt4-workstation-to-a-windows-2012-domain?forum=winserverDS
>>>
>>>> I have tried setting the following in smb.conf
>>>>
>>>>      server services = +smb -s3fs
>>>>      dcerpc endpoint servers = +winreg +srvsvc
>>> They will not do anything on a PDC, they are meant for an AD DC
>>>
>>> Rowland
>>>
>>
>