[Samba] Samba4 Kerberos Authentication Error

[Rowland Penny]

On Wed, 5 Dec 2018 12:19:39 -0500
Marco Shmerykowsky PE <marco at sce-engineers.com> wrote:

> 
> 
> --
> 
> Marco J. Shmerykowsky, PE, F.ASCE
> marco at sce-engineers.com
> 
> -----------------------------------------
>     Shmerykowsky Consulting Engineers
>       Structural Analysis & Design
>      102 West 38th Street, 2nd Floor
>          New York, New York 10018
> Tel. (212) 719-9700 Fax. (212) 719-4822
>        http://www.sce-engineers.com
> -----------------------------------------
> 
> On 12/5/2018 12:11 PM, Rowland Penny via samba wrote:
> > On Wed, 5 Dec 2018 11:33:01 -0500
> > Marco Shmerykowsky PE via samba <samba at lists.samba.org> wrote:
> > 
> >>
> >> The Realm matches the DNS.
> >>
> >> hostname -d returns -> internal.company.com
> >>
> >> domain name is internal.company.com
> >>
> >> I can ping both internal.company.com and
> >> machine254.internal.company.com both resolve to the IP of
> >> MACHINE254
> >>
> >> I checked winbind using the commands on the following page & all
> >> returned as expected.
> >>
> >> https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member#Testing_the_Winbindd_Connectivity
> >>
> > 
> > You have never said what OS you are using, but check /etc/krb5.conf.
> > Does it start with an 'include' line ?
> > If so remove it
> > 
> > Can you post the following files
> > 
> > /etc/hostname
> > /etc/hosts
> > etc/resolv.conf
> > /etc/krb5.conf
> > /etc/nsswitch.conf
> > 
> > Rowland
> 
> Server: Fedora 29 with Samba 4.9.2
> Client: Windows 10 version 1803 Build 17134.441
> 
> /etc/hostname:
> 
> machine254
> 
> /etc/hosts:
> 
> 127.0.0.1   localhost localhost.localdomain localhost4 
> localhost4.localdomain4
> ::1         localhost localhost.localdomain localhost6 
> localhost6.localdomain6
> 192.168.0.251   machine254.internal.company.com   machine254
> 
> /etc/resolv.conf:
> 
> # Generated by NetworkManager 
> 
> nameserver 192.168.0.251
> 
> /etc/krb5.conf:
> 
>          default_realm = INTERNAL.COMPANY.COM 
> 
>          dns_lookup_realm = false 
> 
>          dns_lookup_kdc = true
> 
> /etc/nsswitch.conf:
> 
> # Generated by authselect on Fri Jun  1 19:19:08 2018 
> 
> # Do not modify this file manually. 
> 
>  
> 
> passwd:      sss files systemd winbind 
> 
> group:       sss files systemd winbind 
> 
> netgroup:   sss files 
> 
> automount:  sss files 
> 
> services:   sss files 
> 
> sudoers:    files sss 
> 
>  
> 
> shadow:     files 
> 
> ethers:     files 
> 
> netmasks:   files 
> 
> networks:   files 
> 
> protocols:  files 
> 
> rpc:        files 
> 
> hosts:      files dns myhostname 
> 
>  
> 
> aliases:    files nisplus 
> 
> bootparams: nisplus [NOTFOUND=return] files 
> 
> publickey:  nisplus
> 
> ---
> This email has been checked for viruses by AVG.
> https://www.avg.com
> 

Are you using the OS's Samba packages ?
If so, you should be aware that they are deemed experimental and do not
fully work, they have problems and this could be another one of them.

Rowland