[Samba] How to use kerberos as the default auth in AD config?

Shyam Kaushik shyam at zadarastorage.com
Tue Aug 14 13:48:42 UTC 2018

Thanks Rowland for your pointers!

I'm sorry to just mention it as win2k. This is actually a Windows 2016
server on which we want to get AD/"Protected Users" working. I will try
pam_winbind & get back if this solves the issue.


On Tue, 14 Aug 2018 09:25:29 +0100
Rowland Penny via samba <samba at lists.samba.org> wrote:

> On Mon, 13 Aug 2018 17:32:05 -0700
> Luke Barone via samba <samba at lists.samba.org> wrote:
> > Well, you know, a 2010 EOL-date isn't that old... :P
> >
> It is, if you think of it in dog-years, it's 70 years :-)
> Rowland

Now the security updates have been released, I can tell you how to fix
the problem, upgrade ;-)

   Vulnerability that allows authentication via NTLMv1 even if disabled.


-----Original Message-----
From: Shyam Kaushik [mailto:shyam at zadarastorage.com]
Sent: 13 August 2018 19:25
To: 'samba at lists.samba.org'
Cc: Lev Vainblat
Subject: How to use kerberos as the default auth in AD config?

Hi Folks,

We have samba(4.8) deployed with following key parms
        security = ADS
        realm = TEST
        client NTLMv2 auth = No
        ntlm auth = disabled

We have a win2k user configured as a "Protected User"

When this user tries to connect to samba/winbind, we get this error out &
client is not able to connect

	[2018/08/13 13:46:50.019094,  2, pid=7845, class=auth]
	  check_ntlm_password:  Authentication for user [protecteduser] ->
[protecteduser] FAILED with error NT_STATUS_ACCOUNT_RESTRICTION,

we can confirm the following behaviour (password hidden)
	root at test-01:~# wbinfo -a TEST\protecteduser%XXXX'
	plaintext password authentication failed
	Could not authenticate user TEST\protecteduser%XXXX with plaintext
	challenge/response password authentication failed
	wbcAuthenticateUserEx(TEST\protecteduser): error code was
	error message was: Account restriction
	Could not authenticate user TEST\protecteduser with

Whereas Kerberos auth works ok
	root at test-01:~# wbinfo --krb5auth 'TEST\protecteduser%XXXX'
	plaintext kerberos password authentication for
[TEST\protecteduser%XXXX] succeeded (requesting cctype: FILE)
	credentials were put in: FILE:/tmp/krb5cc_0

when we have a regular user from the same win2k client that is not part of
"Protected User", plaintext/NTLM auth works ok

	root at test-01:~# wbinfo -a 'TEST\normaluser%XXXX'
	plaintext password authentication succeeded
	challenge/response password authentication succeeded

& client is able to work with samba share. Question is how do we force
samba to do only KRB auth & not attempt at NTLM auth as its showing up in
error with auth_check_ntlm_password? Any help appreciated!



More information about the samba mailing list