[Samba] Failed to establish your Kerberos Ticket cache due time differences with the domain controller

[Rowland Penny]

On Sat, 21 Jul 2018 18:59:08 +0100
Rowland Penny via samba <samba at lists.samba.org> wrote:

> On Sat, 21 Jul 2018 18:30:48 +0100
> Roy Eastwood via samba <samba at lists.samba.org> wrote:
> 
> > Thanks Rowland.
> > 
> > > -----Original Message-----
> > > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of
> > > Rowland Penny via samba
> > > Sent: 21 July 2018 18:04
> > > To: samba at lists.samba.org
> > > Subject: Re: [Samba] Failed to establish your Kerberos Ticket
> > > cache due time differences with the domain controller
> > > 
> > > On Sat, 21 Jul 2018 17:36:14 +0100
> > > Roy Eastwood via samba <samba at lists.samba.org> wrote:
> > > 
> > > > >
> > > > > Try restarting Samba on 'debian-vb'.
> > > > > If this doesn't help, try 'samba-tool dbcheck' and compare the
> > > > > two DC's with 'samba-tool ldapcmp'
> > > > >
> > > > > Rowland
> > > > >
> > > >
> > > > OK, have tried that but no change.   I used Louis'  script:
> > > > samba-check-db-repl.sh which includes samba-tool ldapcmp and
> > > > samba-tool drs showrepl it passes both tests.
> > > >
> > > > Roy
> > > >
> > > >
> > > 
> > > Did you run 'samba-tool dbcheck' ? Louis's script doesn't do this.
> > > 
> > > Was this machine provisioned quite a few versions ago ? and then
> > > updated in place ?
> > > 'samba-tool time' was changed at sometime (cannot just when) and a
> > > python module was replaced, but 'make install' did not remove the
> > > old python script. Check if you have:
> > > 
> > > '/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/time.py'
> > > 
> > > If you have, delete it.
> > > 
> > > Rowland
> > > 
> > Sorry, yes I ,meant to say, I ran samba-tool dbcheck and initially
> > it threw up some errors about deleted items (I had recently demoted
> > a DC after the pi-dc was joined) but these were repaired with the
> > --fix option.   I tried the samba-tool time commands afterwards
> > with the same result.    I also had to clean up all the DNS records
> > as the demote command doesn't tidy things up properly.
> > 
> > Whist this is a new domain provision with v 4.8.3, the machine has
> > had versions going back to 4.7.4 compiled and installed (albeit with
> > different domains).  I used make uninstall on the last version of
> > samba before installing 4.8.3 if that makes any difference.   I
> > checked for that time.py file and it's not in that folder (or
> > anywhere else according to find).
> > 
> > Roy
> > 
> > 
> 
> No, it wouldn't have been there, 4.7.4 isn't old enough.
> 
> When you built Samba, did you have all the correct packages installed,
> see here:
> 
> https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Debian_.2F_Ubuntu
> 
> Is Apparmor installed, or a firewall ?
> 
> Rowland
> 

Another thought, could this be an authentication problem ? try adding
'-U Administrator' and see if this helps.

Rowland