[Samba] Samba 4.6.2 member server errors

[L.P.H. van Belle]

Hai, 

You googled with the wrong words i think. 

1 search, 6 words. 4e link and 5e link, for explanation and solution.  ;-) 
Based on your question, what i experianced and what i found with google. 

https://support.oneidentity.com/authentication-services/kb/92515 
Dont look at the product here, but its an exact match on the error code. 
They say, source of the problem is AD out of sync. 

And now im thinking, i had such a problem also due to an out of sync AD database. 
Here/how the out of sync happend i never found out. 
Can you check if you DC's are in sync? 

The other i found 
https://groups.google.com/forum/#!topic/comp.protocols.kerberos/g-s76WeWyUU 
Is a problem in the keytab files, and, i did replace my keytab file, which solved 90% of my problem. 
The 10% left over problem, a nfs keytab caching related thing, only involved my user account, so low prio for me.
Here the solution is to replace all keytab files. I did only the member server.
And that verifies it to me.

So i dont have an exact solution, only one big advice, 
if you upgrade make sure you db replication is in sync and you checked all ADDC Db's. 


Greetz, 

Louis



 

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Tom 
> Diehl via samba
> Verzonden: donderdag 12 oktober 2017 7:01
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Samba 4.6.2 member server errors
> 
> Hi,
> 
> I have 2 samba AD DC's running 4.7.0 and 2 member servers 
> running 4.6.2.
> 
> Everything seems to be working OK except that I see the 
> following errors
> over and over again in the winbind log on one of the member servers:
> 
> [2017/10/12 00:53:52.351095,  2] 
> ../auth/kerberos/kerberos_pac.c:96(check_pac_checksum)
>    check_pac_checksum: PAC Verification failed: Decrypt 
> integrity check failed (-1765328353)
> [2017/10/12 00:53:52.871160,  2] 
> ../auth/kerberos/kerberos_pac.c:96(check_pac_checksum)
>    check_pac_checksum: PAC Verification failed: Decrypt 
> integrity check failed (-1765328353)
> [2017/10/12 00:53:54.588468,  2] 
> ../auth/kerberos/kerberos_pac.c:96(check_pac_checksum)
>    check_pac_checksum: PAC Verification failed: Decrypt 
> integrity check failed (-1765328353)
> 
> Can someone tell me what this means and if I should 
> troubleshoot this further?
> 
> My Google foo has not been helpful.
> 
> Regards,
> 
> -- 
> Tom			me at tdiehl.org
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>