[Samba] DRS stopped working after upgrade from debian Jessie to Stretch

L.P.H. van Belle belle at bazuin.nl
Tue Jun 20 09:13:25 UTC 2017


Hai Baptiste,

What you can try;
Type: 
ktutil (enter)
rkt /etc/krb5.keytab 
rkt /var/lib/samba/private/krb5.keytab 
list

Now check if you see, 
host/server.internal.domain.tld at REALM
host/server at REALM
(same (both) for nfs/.. at REALM) 

And 
NETBIOSNAME$@REALM

If you see all, you can write this back to a new file. 
wkt /etc/krb5.keytab.new1
And if needed you can also cleanup the keytab file before writing. 

Now choose, of 
dedicated keytab file = /etc/krb5.keytab 

Or use the samba default in /var/lib/samba/private/krb5.keytab 
In case of the samba default 
rm /etc/krb5.keytab 
ln -sf /usr/local/samba/private/krb5.conf /etc/krb5.conf

Some extra info on the keytab things. 
https://wiki.samba.org/index.php/Generating_Keytabs 
https://wiki.samba.org/index.php/Keytab_Extraction 




Greetz, 

Louis



> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Prunk Dump via samba
> Verzonden: dinsdag 20 juni 2017 10:58
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] DRS stopped working after upgrade from 
> debian Jessie to Stretch
> 
> Thanks for the help !!!
> 
> 2017-06-19 23:58 GMT+02:00 Andrew Bartlett <abartlet at samba.org>:
> > On Mon, 2017-06-19 at 22:13 +0200, Prunk Dump via samba wrote:
> >> Hello Samba team !
> >>
> >> I'am in a very delicate situation. After an upgrade to 
> debian Stretch 
> >> my DRS stopped working.
> >
> > Have you ever had MIT krb5 installed, or is krb5kdc now running?
> >
> > Samba doesn't use /etc/krb5.keytab, so this may be related to some 
> > previous install (or may be related to how you are trying 
> to use NFS).
> >
> >
> 
> I have checked, MIT kerberos is not installed, just the "krb5-user"
> kerberos client package.
> 
> >>
> >> This seem to be a computer account problem. But I can't find any 
> >> problem in Kerberos :
> >>
> >>
> >>  --------------------------------
> >> # kinit -k FICHDC$
> >> # klist
> >> Ticket cache: FILE:/tmp/krb5cc_0
> >> Default principal: FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR
> >
> > Can you do this against the secrets.keytab in Samba's private/ dir?
> >
> > You can reset the Samba machine account pw with 
> > ./source4/scripting/devel/chgtdcpass, but:
> >  - it wont be packaged so you will have to build Samba and 
> tell it to 
> > operate against the right paths
> >  - it shouldn't be needed, upgrades shouldn't break this, and 
> > understanding the root cause would be better
> >
> > Does 'samba-tool time -P' work?  It is any different with 
> 'samba-tool 
> > time -P -k no'?  (It seems you issue is related primarily 
> to kerberos 
> > and a keytab out of sync somehow).
> >
> 
> Yes you're right ! I need to understand the root of the 
> problem as I have some other DC to upgrade the same manner. 
> And you're right authentication with the private keytab does 
> not work. But strangely it works with /etc/krb5.keytab.
> 
> --------------------------------
> --------------------------------
> ~# klist -e -k /var/lib/samba/private/secrets.keytab
> Keytab name: FILE:/var/lib/samba/private/secrets.keytab
> KVNO Principal
> ---- 
> --------------------------------------------------------------
> ------------
>    1 HOST/fichdc at NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-crc)
>    1 
> HOST/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GU
> ILLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-crc)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-crc)
>    1 HOST/fichdc at NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-md5)
>    1 
> HOST/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GU
> ILLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-md5)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-md5)
>    1 HOST/fichdc at NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR 
> (arcfour-hmac)
>    1 
> HOST/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GU
> ILLAUME-FICHET.AC-GRENOBLE.FR
> (arcfour-hmac)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (arcfour-hmac)
>    1 HOST/fichdc at NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR
> (aes128-cts-hmac-sha1-96)
>    1 
> HOST/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GU
> ILLAUME-FICHET.AC-GRENOBLE.FR
> (aes128-cts-hmac-sha1-96)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR 
> (aes128-cts-hmac-sha1-96)
>    1 HOST/fichdc at NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR
> (aes256-cts-hmac-sha1-96)
>    1 
> HOST/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GU
> ILLAUME-FICHET.AC-GRENOBLE.FR
> (aes256-cts-hmac-sha1-96)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR 
> (aes256-cts-hmac-sha1-96)
> 
> 
> ~# kinit -V -k -t /var/lib/samba/private/secrets.keytab 
> FICHDC$ Using default cache: /tmp/krb5cc_0 Using principal: 
> FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR
> Using keytab: /var/lib/samba/private/secrets.keytab
> kinit: Preauthentication failed while getting initial credentials
> 
> ~# samba-tool time -P
> ldb_wrap open of secrets.ldb
> GENSEC backend 'gssapi_spnego' registered GENSEC backend 
> 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' 
> registered GENSEC backend 'spnego' registered GENSEC backend 
> 'schannel' registered GENSEC backend 'naclrpc_as_system' 
> registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC 
> backend 'ntlmssp' registered GENSEC backend 
> 'ntlmssp_resume_ccache' registered GENSEC backend 
> 'http_basic' registered GENSEC backend 'http_ntlm' registered 
> GENSEC backend 'krb5' registered GENSEC backend 
> 'fake_gssapi_krb5' registered
> resolve_lmhosts: Attempting lmhosts lookup for name 
> fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr<0x20>
> Wrong username or password: kinit for
> FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR failed 
> (Preauthentication failed)
> 
> SPNEGO(gssapi_krb5) NEG_TOKEN_INIT failed: 
> NT_STATUS_LOGON_FAILURE Failed initial gensec_update with 
> mechanism spnego: NT_STATUS_LOGON_FAILURE
> ERROR(runtime): uncaught exception - (-1073741715, 
> "Connection to SRVSVC pipe of server 
> 'fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr'
> failed: NT_STATUS_LOGON_FAILURE")
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 176, in _run
>     return self.run(*args, **kwargs)
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/nettime.py",
> line 59, in run
>     self.outf.write(net.time(server_name)+"\n")
> 
> ~# samba-tool time -P -k no
> ldb_wrap open of secrets.ldb
> GENSEC backend 'gssapi_spnego' registered GENSEC backend 
> 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' 
> registered GENSEC backend 'spnego' registered GENSEC backend 
> 'schannel' registered GENSEC backend 'naclrpc_as_system' 
> registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC 
> backend 'ntlmssp' registered GENSEC backend 
> 'ntlmssp_resume_ccache' registered GENSEC backend 
> 'http_basic' registered GENSEC backend 'http_ntlm' registered 
> GENSEC backend 'krb5' registered GENSEC backend 
> 'fake_gssapi_krb5' registered
> resolve_lmhosts: Attempting lmhosts lookup for name 
> fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr<0x20>
> Got challenge flags:
> Got NTLMSSP neg_flags=0x62898215
> NTLMSSP: Set final flags:
> Got NTLMSSP neg_flags=0x62088215
> NTLMSSP Sign/Seal - Initialising with flags:
> Got NTLMSSP neg_flags=0x62088215
> ERROR(runtime): uncaught exception - (-1073741715, 
> "Connection to SRVSVC pipe of server 
> 'fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr'
> failed: NT_STATUS_LOGON_FAILURE")
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 176, in _run
>     return self.run(*args, **kwargs)
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/nettime.py",
> line 59, in run
>     self.outf.write(net.time(server_name)+"\n")
> 
> ~# klist -e -k /etc/krb5.keytab
> Keytab name: FILE:/etc/krb5.keytab
> KVNO Principal
> ---- 
> --------------------------------------------------------------
> ------------
>    1 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-crc)
>    1 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-md5)
>    1 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (arcfour-hmac)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-crc)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-md5)
>    1 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (arcfour-hmac)
>    2 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-crc)
>    2 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (des-cbc-md5)
>    2 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR (arcfour-hmac)
>    2 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR 
> (aes128-cts-hmac-sha1-96)
>    2 FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR 
> (aes256-cts-hmac-sha1-96)
>    2 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-crc)
>    2 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (des-cbc-md5)
>    2 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (arcfour-hmac)
>    2 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (aes128-cts-hmac-sha1-96)
>    2 
> nfs/fichdc.net.lyc-guillaume-fichet.ac-grenoble.fr at NET.LYC-GUI
> LLAUME-FICHET.AC-GRENOBLE.FR
> (aes256-cts-hmac-sha1-96)
> 
> ~# kinit -k -t /etc/krb5.keytab FICHDC$
> 
> --------------------------------
> --------------------------------
> 
> I don't know what is "KVNO". But on the "/etc/krb5.keytab" 
> there is "1" and "2" FICHDC$ principals entries. But on 
> "/var/lib/samba/private/secret.keytab" there is only "1".
> 
> And on the samba log file I have :
> 
> --------------------------------
> GSS server Update(krb5)(1) Update failed:  Miscellaneous failure (see
> text): Failed to find
> FICHDC$@NET.LYC-GUILLAUME-FICHET.AC-GRENOBLE.FR(kvno 2) in 
> keytab FILE:/var/lib/samba/private/secrets.keytab (arcfour-hmac-md5)
> --------------------------------
> 
> How "/var/lib/samba/private/secrets.keytab" is updated by samba ?
> 
> Thank you very much for the help !
> 
> Baptiste.
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 




More information about the samba mailing list