[Samba] Failed to establish your Kerberos Ticket cache due time differences with the domain controller

Tue Jul 24 08:40:31 UTC 2018

I did re-read the whole thread again. 

Im running out of options.. 

When i look at : 
https://wiki.samba.org/index.php/PAM_Offline_Authentication 
You can do these last checks. 

Run the :  Testing offline authentication as show on the wiki. 

Debian normaly does not have /etc/security/pam_winbind.conf, check if its there if so backup it remove it. 

Check if these packages are installed. 
libpam-krb5
libpam-winbind
libnss-winbind 

Now edit : 
/usr/share/pam-configs/winbind 

And change it to : (see debug debug_state)
Auth:
        [success=end default=ignore]    pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass debug debug_state
Auth-Initial:
        [success=end default=ignore]    pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login debug debug_state

Run : pam-auth-update 
And login again. 

Lets see what you get of that debug output. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Roy 
> Eastwood via samba
> Verzonden: dinsdag 24 juli 2018 0:54
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Failed to establish your Kerberos 
> Ticket cache due time differences with the domain controller
> 
> > > As roy (after logging in and getting the message:
> > > Failed to establish your Kerberos Ticket cache due time 
> differences
> > > with the domain controller.  Please verify the system time.
> > 
> > OK, I know where the message is coming from ;-)
> > 
> > samba-master/nsswitch/pam_winbind.c
> > 
> > line 1441
> > 
> > static void _pam_warn_krb5_failure(struct pwb_context *ctx,
> > 				   const char *username,
> > 				   uint32_t info3_user_flgs)
> > {
> > 	if (PAM_WB_KRB5_CLOCK_SKEW(info3_user_flgs)) {
> > 		_make_remark(ctx, PAM_ERROR_MSG,
> > 			     _("Failed to establish your 
> Kerberos Ticket cache "
> > 			       "due time differences\n"
> > 			       "with the domain controller.  "
> > 			       "Please verify the system time.\n"));
> > 		_pam_log_debug(ctx, LOG_DEBUG,
> > 			       "User %s: Clock skew when 
> getting Krb5 TGT\n",
> > 			       username);
> > 	}
> > }
> > 
> > So it looks like you must have some difference in time 
> between the two
> > DC's
> > Try installing ntpdate on each DC and then run on each DC:
> > 
> > ntpdate -d -u 'FQDN of other DC'
> > 
> > You should get a very low 'offset', it is in seconds
> > 
> > Rowland
> 
> Ok, done that and the result on pi-dc:
> root at pi-dc:~# ntpdate -d -u debian-vb.microlynx.org
> 23 Jul 23:48:59 ntpdate[1876]: ntpdate 4.2.8p10 at 1.3728-o Sat 
> Mar 10 18:03:47 UTC
> 2018 (1)
> transmit(192.168.2.6)
> receive(192.168.2.6)
> transmit(192.168.2.6)
> receive(192.168.2.6)
> transmit(192.168.2.6)
> receive(192.168.2.6)
> transmit(192.168.2.6)
> receive(192.168.2.6)
> server 192.168.2.6, port 123
> stratum 2, precision -25, leap 00, trust 000
> refid [192.168.2.6], delay 0.02611, dispersion 0.00000
> transmitted 4, in filter 4
> reference time:    df00d7bd.5789fa50  Mon, Jul 23 2018 23:39:57.341
> originate timestamp: df00d9e1.2f172491  Mon, Jul 23 2018 23:49:05.183
> transmit timestamp:  df00d9e1.2f162fa4  Mon, Jul 23 2018 23:49:05.183
> filter delay:  0.02623  0.02611  0.02614  0.02621
>          0.00000  0.00000  0.00000  0.00000
> filter offset: -0.00029 -0.00034 -0.00034 -0.00033
>          0.000000 0.000000 0.000000 0.000000
> delay 0.02611, dispersion 0.00000
> offset -0.000345
> 
> 23 Jul 23:49:05 ntpdate[1876]: adjust time server 192.168.2.6 
> offset -0.000345
> sec
> 
> Result the other way:
> root at debian-vb:~# ntpdate -d -u pi-dc.microlynx.org
> 23 Jul 23:51:11 ntpdate[18082]: ntpdate 4.2.8p10 at 1.3728-o Sun 
> Feb 25 21:22:56
> UTC 2018 (1)
> transmit(192.168.2.4)
> receive(192.168.2.4)
> transmit(192.168.2.4)
> receive(192.168.2.4)
> transmit(192.168.2.4)
> receive(192.168.2.4)
> transmit(192.168.2.4)
> receive(192.168.2.4)
> server 192.168.2.4, port 123
> stratum 2, precision -22, leap 00, trust 000
> refid [192.168.2.4], delay 0.02605, dispersion 0.00002
> transmitted 4, in filter 4
> reference time:    df00d7ae.eb5aa9d1  Mon, Jul 23 2018 23:39:42.919
> originate timestamp: df00da65.41ba9acc  Mon, Jul 23 2018 23:51:17.256
> transmit timestamp:  df00da65.417e786b  Mon, Jul 23 2018 23:51:17.255
> filter delay:  0.02612  0.02605  0.02606  0.02606
>          0.00000  0.00000  0.00000  0.00000
> filter offset: 0.000586 0.000634 0.000598 0.000606
>          0.000000 0.000000 0.000000 0.000000
> delay 0.02605, dispersion 0.00002
> offset 0.000634
> 
> 23 Jul 23:51:17 ntpdate[18082]: adjust time server 
> 192.168.2.4 offset 0.000634
> sec
> 
> I would say the clocks are pretty much the same :-)
> 
> Thanks for all your help.
> 
> Roy
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 