[Samba] SPN problem after update 4.13.8 to 4.13.14
Nikita Druba
admin at npo-lencor.ru
Tue Nov 16 11:18:42 UTC 2021
Hi!
I'm use FreeBSD 12.2 and samba 4.13.8 as DC. All worked fine many years,
but after update to version 4.13.14, I have some troubles with issuing
kerberos tickets for ldap service at my DC. When I downgrades samba
back, all work fine again.
Some strings from log.samba:
[2021/11/16 09:22:47.366807, 3]
./../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ SERVER$@SAMDOM.LOCAL from ipv4:10.110.2.4:55018 for
LDAP/dc.samdom.local/samdom.local at SAMDOM.LOCAL [renewable, forwardable]
[2021/11/16 09:22:47.367805, 3]
./../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: samba_kdc_fetch: message2entry failed
[2021/11/16 09:22:47.367864, 3]
./../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Server not found in database:
LDAP/dc.samdom.local/samdom.local at SAMDOM.LOCAL: no such entry found in hdb
[2021/11/16 09:22:47.367900, 3]
./../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Failed building TGS-REP to ipv4:10.110.2.4:55018
[2021/11/16 09:22:47.368163, 3]
./../source4/smbd/service_stream.c:67(stream_terminate_connection)
stream_terminate_connection: Terminating connection -
'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED'
When I check SPNs for my DC:
# samba-tool spn list dc$
dc$
User CN=dc,OU=Domain Controllers,DC=samdom,DC=local has the following
servicePrincipalName:
HOST/DC
HOST/dc.samdom.local
GC/dc.samdom.local/samdom.local
E3512235-4B66-1531-A004-00C02D98DCD2/eaa984a7-cbbf-4d33-894f-6e838dc29369/samdom.local
HOST/dc.samdom.local/SAMDOM
ldap/dc.samdom.local/SAMDOM
ldap/dc.samdom.local
HOST/dc.samdom.local/samdom.local
ldap/dc.samdom.local/samdom.local
ldap/eaa984a7-cbbf-4d33-894f-6e838dc29369._msdcs.samdom.local
ldap/DC
RestrictedKrbHost/DC
RestrictedKrbHost/dc.samdom.local
ldap/dc.samdom.local/DomainDnsZones.samdom.local
ldap/dc.samdom.local/ForestDnsZones.samdom.local
What is wrong in my case?
Tnax in advance.
More information about the samba
mailing list