[Samba] Problem after update version 4.15.0

[Rowland Penny]

On Wed, 2021-09-29 at 10:48 +0200, Rainer Meier via samba wrote:
> Hello
> 
> On 29.09.2021 10:08, L.P.H. van Belle via samba wrote:
> > This.
> > > ../../source4/auth/ntlm/auth.c:241(auth_check_password_send)
> > >     auth_check_password_send: Checking password for unmapped user
> > > [CYBERDYNE]\[CYB64W10-TEST$]@[CYB64W10-TEST]
> > 
> > I would have expected
> > > [CYBERDYNE]\[CYB64W10-TEST$]@[AD.CYBERDYNE.LOCAL]
> 
> Actually right. Would expect the same. But in Samba 4.14.7 no such 
> problem appearing.
> 
> > I see this so now and then here also that, suddenly a computer/user
> > cant login.
> > Common causes..
> > 1) PC time out of sync with DC.
> 
> No, Time is NTP-Synchronized.
> 
> > 2) Computer account its password expired.
> 
> Not sure but Samba 4.14.7 does not complain at all - even if
> reverting 
> just Samba binaries I am perfectly able to log on. Passwords are 
> supposed to renew automatically as of my knowledge. The machine is
> in 
> use almost daily so it's not a machine which was not connected or
> off 
> for months.
> 
> > 3) Lots domain trust.
> 
> Right after Samba 4.15 upgrade? On 80% of my machines? And machines 
> re-gain trust after Samba downgrade? hmmm
> 
> 
> > But what does the evenlog show and i assume the same user on an
> > other computer can login?
> 
> Good point, let me try to dig up some logs from my attempts
> yesterday 
> (meanwhile my Samba is rolled back).
> 
> Here is what I found in the event logs:
> 
> Log Name:      System
> Source:        NETLOGON
> Date:          9/28/2021 9:44:07 PM
> Event ID:      3210
> Task Category: None
> Level:         Error
> Keywords:      Classic
> User:          N/A
> Computer:      cyb64w10-test.ad.cyberdyne.local
> Description:
> This computer could not authenticate with
> \\skynet.ad.cyberdyne.local, a 
> Windows domain controller for domain CYBERDYNE, and therefore this 
> computer might deny logon requests. This inability to authenticate
> might 
> be caused by another computer on the same network using the same name
> or 
> the password for this computer account is not recognized. If this 
> message appears again, contact your system administrator.
> Event Xml:
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>    <System>
>      <Provider Name="NETLOGON" />
>      <EventID Qualifiers="0">3210</EventID>
>      <Version>0</Version>
>      <Level>2</Level>
>      <Task>0</Task>
>      <Opcode>0</Opcode>
>      <Keywords>0x80000000000000</Keywords>
>      <TimeCreated SystemTime="2021-09-28T19:44:07.3916682Z" />
>      <EventRecordID>24124</EventRecordID>
>      <Correlation />
>      <Execution ProcessID="0" ThreadID="0" />
>      <Channel>System</Channel>
>      <Computer>cyb64w10-test.ad.cyberdyne.local</Computer>
>      <Security />
>    </System>
>    <EventData>
>      <Data>CYBERDYNE</Data>
>      <Data>\\skynet.ad.cyberdyne.local</Data>
>      <Binary>220000C0</Binary>
>    </EventData>
> </Event>
> 
> 
> Again, this completely disappeared after rolling back, without
> domain 
> re-join or anything else. Samba 4.15 seems just to refuse
> authentication 
> for no good reason.
> 

There could be a problem here, I have just found this:
https://bbs.archlinux.org/viewtopic.php?id=270003

Very similar problem, if not the same.

Rowland