[Samba] Samba Member NT_STATUS_NETWORK_SESSION_EXPIRED

Tue Oct 4 11:24:40 UTC 2016

same as my post
http://samba.2283325.n4.nabble.com/Samba-loose-the-user-forward-as-member-Server-td4708430.html


Am 04.10.2016 um 09:09 schrieb Oliver Werner via samba:
> so i add the pam yesterday and now after 10 hours no  connection to member is possible. :(
>
> Same errors in logs i send yesterday
> OLIVER WERNER
> Systemadministrator
>
>
>
>> Am 03.10.2016 um 18:54 schrieb Rowland Penny via samba <samba at lists.samba.org>:
>>
>> On Mon, 3 Oct 2016 17:56:07 +0200
>> Oliver Werner <oliver.werner at kontrast.de <mailto:oliver.werner at kontrast.de>> wrote:
>>
>>> hey,
>>>
>>> now after observe last changes on the weekend… i have also the issue.
>>>
>>> After 10 hours i can’t connect to the shares on my member server.
>>>
>>> On Log of DC i found this:
>>>
>>> [2016/10/02 20:35:45.601265,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: AS-REQ PL0024$@HQ.KONTRAST from ipv4:<member-ip>:55578 for
>>> krbtgt/HQ.KONTRAST at HQ.KONTRAST [2016/10/02 20:35:45.605069,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: No preauth found, returning PREAUTH-REQUIRED --
>>> PL0024$@HQ.KONTRAST [2016/10/02 20:35:45.605960,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: AS-REQ PL0024$@HQ.KONTRAST from ipv4:<member-ip>:52659 for
>>> krbtgt/HQ.KONTRAST at HQ.KONTRAST [2016/10/02 20:35:45.610083,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: Client sent patypes: encrypted-timestamp [2016/10/02
>>> 20:35:45.610128,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: Looking for PKINIT pa-data -- PL0024$@HQ.KONTRAST
>>> [2016/10/02 20:35:45.610144,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: Looking for ENC-TS pa-data -- PL0024$@HQ.KONTRAST
>>> [2016/10/02 20:35:45.610200,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: ENC-TS Pre-authentication succeeded -- PL0024$@HQ.KONTRAST
>>> using arcfour-hmac-md5 [2016/10/02 20:35:45.617582,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: AS-REQ authtime: 2016-10-02T20:35:45 starttime: unset
>>> endtime: 2016-10-03T06:35:45 renew till: 2016-10-09T20:35:45
>>> [2016/10/02 20:35:45.617699,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96,
>>> aes128-cts-hmac-sha1-96, des3-cbc-sha1, des3-cbc-md5,
>>> arcfour-hmac-md5, using arcfour-hmac-md5/arcfou r-hmac-md5
>>> [2016/10/02 20:35:45.617748,
>>> 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>> Kerberos: Requested flags: renewable, forwardable [2016/10/02
>>> 20:35:45.619243,
>>> 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
>>> Terminating connection - 'ldapsrv_call_loop:
>>> tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED‘
>>>
>>>
>>> That looks ok, yes? When i see it means my member got a new ticket?
>>> But i found this on member:
>>>
>>> [2016/10/03 17:50:03.311002, 10, pid=26714, effective(0, 0), real(0,
>>> 0),
>>> class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request)
>>> child_process_request: request fn NDRCMD [2016/10/03 17:50:03.311015,
>>> 10, pid=26714, effective(0, 0), real(0, 0),
>>> class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd)
>>> winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (HQKONTRAST)
>>> [2016/10/03 17:50:03.311064, 10, pid=26714, effective(0, 0), real(0,
>>> 0),
>>> class=winbind] ../source3/winbindd/winbindd_cache.c:467(fetch_cache_seqnum)
>>> fetch_cache_seqnum: success [HQKONTRAST][4294967295 @ 1475509803]
>>> [2016/10/03 17:50:03.311081,  3, pid=26714, effective(0, 0), real(0,
>>> 0),
>>> class=winbind] ../source3/winbindd/winbindd_ads.c:1493(sequence_number)
>>> ads: fetch sequence_number for HQKONTRAST [2016/10/03
>>> 17:50:03.311119, 10, pid=26714, effective(0, 0), real(0, 0),
>>> class=winbind] ../source3/winbindd/winbindd_ads.c:230(ads_cached_connection)
>>> ads_cached_connection [2016/10/03 17:50:03.311191,
>>> 3] ../source3/libsmb/namequery.c:3117(get_dc_list) get_dc_list:
>>> preferred server list: "vl0227.hq.kontrast, *" [2016/10/03
>>> 17:50:03.321144,  3] ../source3/libads/ldap.c:618(ads_connect)
>>> Successfully contacted LDAP server  <DC-IP> [2016/10/03
>>> 17:50:03.321230,  3] ../source3/libsmb/namequery.c:3117(get_dc_list)
>>> get_dc_list: preferred server list: "vl0227.hq.kontrast,
>>> *" [2016/10/03 17:50:03.323699,
>>> 3] ../source3/libsmb/namequery.c:3117(get_dc_list) get_dc_list:
>>> preferred server list: "vl0227.hq.kontrast, *" [2016/10/03
>>> 17:50:03.328830,  3] ../source3/libsmb/namequery.c:3117(get_dc_list)
>>> get_dc_list: preferred server list: "vl0227.hq.kontrast,
>>> *" [2016/10/03 17:50:03.332100,
>>> 3] ../source3/libads/ldap.c:618(ads_connect) Successfully contacted
>>> LDAP server <DC-IP> [2016/10/03 17:50:03.332177,
>>> 3] ../source3/libsmb/namequery.c:3117(get_dc_list) get_dc_list:
>>> preferred server list: "vl0227.hq.kontrast, *" [2016/10/03
>>> 17:50:03.335277,  3] ../source3/libsmb/namequery.c:3117(get_dc_list)
>>> get_dc_list: preferred server list: "vl0227.hq.kontrast,
>>> *" [2016/10/03 17:50:03.343177,
>>> 3] ../source3/libads/ldap.c:618(ads_connect) Successfully contacted
>>> LDAP server  <DC-IP>5 [2016/10/03 17:50:03.343268,
>>> 3] ../source3/libads/ldap.c:661(ads_connect) Connected to LDAP server
>>> vl0227.hq.kontrast [2016/10/03 17:50:03.350195,
>>> 3] ../source3/libads/sasl.c:733(ads_sasl_spnego_bind)
>>> ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2 [2016/10/03
>>> 17:50:03.350226,
>>> 3] ../source3/libads/sasl.c:733(ads_sasl_spnego_bind)
>>> ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2 [2016/10/03
>>> 17:50:03.350238,
>>> 3] ../source3/libads/sasl.c:733(ads_sasl_spnego_bind)
>>> ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10 [2016/10/03
>>> 17:50:03.379973,
>>> 0] ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
>>> gss_init_sec_context failed with [ The context has expired: Success]
>>> [2016/10/03 17:50:03.380079,
>>> 1] ../auth/gensec/spnego.c:623(gensec_spnego_create_negTokenInit)
>>> SPNEGO(gse_krb5) creating NEG_TOKEN_INIT failed:
>>> NT_STATUS_INTERNAL_ERROR [2016/10/03 17:50:03.380131,
>>> 0] ../source3/libads/sasl.c:785(ads_sasl_spnego_bind) kinit succeeded
>>> but ads_sasl_spnego_gensec_bind(KRB5) failed: An internal error
>>> occurred. [2016/10/03 17:50:03.380176,  1, pid=26714, effective(0,
>>> 0), real(0, 0),
>>> class=winbind] ../source3/winbindd/winbindd_ads.c:136(ads_cached_connection_connect)
>>> ads_connect for domain HQKONTRAST failed: An internal error occurred.
>>> [2016/10/03 17:50:03.380272,  3, pid=26714, effective(0, 0), real(0,
>>> 0),
>>> class=winbind] ../source3/winbindd/winbindd_ads.c:1493(sequence_number)
>>> ads: fetch sequence_number for HQKONTRAST [2016/10/03
>>> 17:50:03.380291, 10, pid=26714, effective(0, 0), real(0, 0),
>>> class=winbind] ../source3/winbindd/winbindd_ads.c:230(ads_cached_connection)
>>> ads_cached_connection
>>>
>>>
>>> may this helps to find the problem :/
>> I have searched the logs on my DCs and a domain member and do not have
>> anything like the above in any of them.
>>
>> It is now 19 days uptime on the domain member and this isn't unusual,
>> it only went down last time because of a power problem.
>>
>> I repeat, I do not have this problem and the only difference between
>> your setup and mine (as far as I can see) is the PAM setup.
>>
>> Rowland
>>
>> -- 
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba <https://lists.samba.org/mailman/options/samba>

Mit freundlichen Grüßen,
René Fuchs


-- 
***********************************************
aixTeMa(®) Digitale Loesungen GmbH
René Fuchs
Philipsstr. 8, 52068 Aachen, Germany
Tel.: +49 241 70515-1323, Fax: +49 241 70515-15
mailto:admins at aixtema.de

WWW: http://www.aixtema.de
Shop: http://shop.aixtema.de

Geschaeftsfuehrer: Oliver Rossbruch
HRB 8201, Amtsgericht Aachen
USt.-Id-Nr. DE 210 906 744
St.-Nr. 201/5942/3737, Finanzamt Aachen Stadt
***********************************************