[Samba] smbclient kerberos auth fails
Aurélien Aptel
aaptel at suse.com
Sat Apr 14 13:19:59 UTC 2018
Hi,
I rarely deal with kerberos but everytime I do it's painful...
I have a Windows Server 2016 VM at foo-ad.foo.com. It has the AD role
and it owns the FOO.COM domain. I added a *AD* account FOO\aaptel%aaptel.
PS C:\share> get-aduser aaptel
DistinguishedName : CN=aaptel,CN=Users,DC=foo,DC=com
Enabled : True
GivenName :
Name : aaptel
ObjectClass : user
ObjectGUID : 97c32e32-593c-4d88-a183-268798016eeb
SamAccountName : aaptel
SID : S-1-5-21-1780990686-3015222812-3597832517-1105
Surname :
UserPrincipalName : aaptel at foo.com
I can login with AD accounts from a linux machine using ntlmssp with
-U FOO\aaptel%aaptel
-U FOO.COM\aaptel%aaptel
-U aaptel%aaptel (weirdly this works)
they all work fine.
Now to use kerberos on the same linux machine I've done:
* make sure time is ntp sync'd on the client
* add the AD ip address in resolv.conf (i can resolve foo.com and
foo-ad.foo.com fine)
* set /etc/krb5.conf to:
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = true
default_realm = FOO.COM
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = FILE:/var/log/krb5/def.log
* run kinit aaptel at FOO.COM, type pw, ok
* klist output:
Ticket cache: DIR::/run/user/1000/krb5cc/tktEOK9Bs
Default principal: aaptel at FOO.COM
Valid starting Expires Service principal
04/14/2018 13:49:22 04/14/2018 23:49:22 krbtgt/FOO.COM at FOO.COM
renew until 04/15/2018 13:49:21
At this point I think it should work, but I get:
$ smbclient //foo.com/share -k
SPNEGO(gse_krb5) creating NEG_TOKEN_INIT for cifs/foo.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT
session setup failed: NT_STATUS_INVALID_PARAMETER
I've attached a network trace with SMB, DNS and kerberos traffic.
-------------- next part --------------
Adding KRB5_TRACE=/dev/stderr to the env I get:
KRB5_TRACE=/dev/stderr smbclient //foo.com/share -k
[14620] 1523708816.549070: Getting credentials aaptel at FOO.COM -> cifs/foo.com at FOO.COM using ccache DIR::/run/user/1000/krb5cc/tkt
[14620] 1523708816.549204: Retrieving aaptel at FOO.COM -> cifs/foo.com at FOO.COM from DIR::/run/user/1000/krb5cc/tkt with result: -1765328243/Matching credential not found
[14620] 1523708816.549239: Retrieving aaptel at FOO.COM -> krbtgt/FOO.COM at FOO.COM from DIR::/run/user/1000/krb5cc/tkt with result: 0/Success
[14620] 1523708816.549244: Starting with TGT for client realm: aaptel at FOO.COM -> krbtgt/FOO.COM at FOO.COM
[14620] 1523708816.549249: Requesting tickets for cifs/foo.com at FOO.COM, referrals on
[14620] 1523708816.549289: Generated subkey for TGS request: aes256-cts/8C96
[14620] 1523708816.549350: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[14620] 1523708816.549445: Encoding request body and padata into FAST request
[14620] 1523708816.549489: Sending request (1552 bytes) to FOO.COM
[14620] 1523708816.601328: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.601424: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.601458: Initiating TCP connection to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.625955: Sending TCP request to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.661357: Received answer (295 bytes) from stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.694851: Response was not from master KDC
[14620] 1523708816.694885: Decoding FAST response
[14620] 1523708816.694959: TGS request result: -1765328377/Server not found in Kerberos database
[14620] 1523708816.694966: Requesting tickets for cifs/foo.com at FOO.COM, referrals off
[14620] 1523708816.694991: Generated subkey for TGS request: aes256-cts/73FA
[14620] 1523708816.695028: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[14620] 1523708816.695096: Encoding request body and padata into FAST request
[14620] 1523708816.695160: Sending request (1552 bytes) to FOO.COM
[14620] 1523708816.745857: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.745934: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.745989: Initiating TCP connection to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.770008: Sending TCP request to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.805500: Received answer (295 bytes) from stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.840186: Response was not from master KDC
[14620] 1523708816.840218: Decoding FAST response
[14620] 1523708816.840268: TGS request result: -1765328377/Server not found in Kerberos database
[14620] 1523708816.840651: Getting credentials aaptel at FOO.COM -> cifs/foo.com at COM using ccache DIR::/run/user/1000/krb5cc/tkt
[14620] 1523708816.840710: Retrieving aaptel at FOO.COM -> cifs/foo.com at COM from DIR::/run/user/1000/krb5cc/tkt with result: -1765328243/Matching credential not found
[14620] 1523708816.840758: Retrieving aaptel at FOO.COM -> krbtgt/COM at COM from DIR::/run/user/1000/krb5cc/tkt with result: -1765328243/Matching credential not found
[14620] 1523708816.840796: Retrieving aaptel at FOO.COM -> krbtgt/FOO.COM at FOO.COM from DIR::/run/user/1000/krb5cc/tkt with result: 0/Success
[14620] 1523708816.840803: Starting with TGT for client realm: aaptel at FOO.COM -> krbtgt/FOO.COM at FOO.COM
[14620] 1523708816.840841: Retrieving aaptel at FOO.COM -> krbtgt/COM at COM from DIR::/run/user/1000/krb5cc/tkt with result: -1765328243/Matching credential not found
[14620] 1523708816.840849: Requesting TGT krbtgt/COM at FOO.COM using TGT krbtgt/FOO.COM at FOO.COM
[14620] 1523708816.840867: Generated subkey for TGS request: aes256-cts/0E2E
[14620] 1523708816.840899: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[14620] 1523708816.840949: Encoding request body and padata into FAST request
[14620] 1523708816.840999: Sending request (1548 bytes) to FOO.COM
[14620] 1523708816.893032: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.893107: Resolving hostname foo-ad.foo.com.
[14620] 1523708816.893161: Initiating TCP connection to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.919222: Sending TCP request to stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.946685: Received answer (290 bytes) from stream 2620:113:80c0:8080:9c9a:3fbc:4160:b896:88
[14620] 1523708816.976231: Response was not from master KDC
[14620] 1523708816.976265: Decoding FAST response
[14620] 1523708816.976299: TGS request result: -1765328377/Server not found in Kerberos database
SPNEGO(gse_krb5) creating NEG_TOKEN_INIT for cifs/foo.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT
session setup failed: NT_STATUS_INVALID_PARAMETER
Any help welcome.
Cheers,
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
More information about the samba
mailing list