[Samba] winbind & kerberos question

[Stefan Kania]

I think it's not a configuration error it must have someting to do with
winbind it self. I would say that winbind is trying to get a new ticket
from the domain where the maschine is member of. The parameter Rowland
was posting:
'winbind scan trusted domains = yes'
should fix this problem (it did in 4.12 and 4.13) that was the last time
I've configured a trust with more then two domains. I would open a
bug-report.


Am 27.06.22 um 12:45 schrieb Andreas Hauffe via samba:
> Dear list,
> 
> I'm having trouble with refreshing kerberos tickets with winbind. Our
> clients are openSUSE Leap 15.4 clients with a separately build samba
> 4.16.2 and they are domain members of an AD domain named
> ilrw.ing.dom.tu-dresden.de. This domain is a subdomain (two-way,
> transitive trusts) of ing.dom.tu-dresden.de, which again is a subdomain
> of dom.tu-dresden.de. User accounts are administered centrally in the
> root domain dom.tu-dresden.de. If I logon to a client with a useraccount
> I'm getting a tgt and service tickets and everything works fine, as seen
> in the klist output:
> 
> Ticketzwischenspeicher:FILE:/tmp/krb5cc_103321
> Standard-Principal:account at DOM.TU-DRESDEN.DE
> 
> Valid starting       Expires              Service principal
> 23.06.2022 17:34:16  24.06.2022 03:34:16 
> krbtgt/DOM.TU-DRESDEN.DE at DOM.TU-DRESDEN.DE
>         erneuern bis 30.06.2022 17:34:16
> 23.06.2022 17:34:16  24.06.2022
> 03:34:16LFTWORKLI06$@ILRW.ING.DOM.TU-DRESDEN.DE
>         erneuern bis 30.06.2022 17:34:16
> 
> But after a while or over night the ticket cache is deleted by winbind.
> The logs say that winbind was trying to refresh the ticket. But winbind
> tries to refresh krbtgt/ILRW.ING.DOM.TU-DRESDEN.DE at DOM.TU-DRESDEN.DE
> which is not in the cache since
> krbtgt/DOM.TU-DRESDEN.DE at DOM.TU-DRESDEN.DE is cached. This results in
> destroying the ticket cache. My question is, if this is a configuration
> error and what I have to change to avoid destroying the ticket cache?
> 
> [2022/06/23 16:24:06.069415, 10, pid=11448, effective(0, 0), real(0, 0),
> class=winbind]
> ../../source3/winbindd/winbindd_cred_cache.c:123(krb5_ticket_refresh_handler)
> 
>   krb5_ticket_refresh_handler: event called for:FILE:/tmp/krb5cc_103321,
> DOM+account
> [2022/06/23 16:24:06.069772, 10, pid=11448, effective(103321, 0),
> real(103321, 0), class=kerberos]
> ../../lib/krb5_wrap/krb5_samba.c:3867(smb_krb5_trace_cb)
>   smb_krb5_trace_cb: [11448] 1655994246.069600:
> Retrievingaccount at DOM.TU-DRESDEN.DE  ->
> krbtgt/ILRW.ING.DOM.TU-DRESDEN.DE at DOM.TU-DRESDEN.DE 
> fromFILE:/tmp/krb5cc_103321  with result: -1765328243/Matching
> credential not found (filename: /tmp/krb5cc_103321)
> [2022/06/23 16:24:06.069819,  3, pid=11448, effective(0, 0), real(0, 0),
> class=winbind]
> ../../source3/winbindd/winbindd_cred_cache.c:227(krb5_ticket_refresh_handler)
> 
>   krb5_ticket_refresh_handler: could not renew tickets: Matching
> credential not found
> [2022/06/23 16:24:06.069908, 10, pid=11448, effective(0, 0), real(0, 0),
> class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3867(smb_krb5_trace_cb)
>   smb_krb5_trace_cb: [11448] 1655994246.069602: Destroying
> ccacheFILE:/tmp/krb5cc_103321
> 
> smb.conf
> 
> [global]
>        bind interfaces only = Yes
>        dedicated keytab file = /etc/krb5.keytab
>        interfaces = lo eth0
>        kerberos method = secrets and keytab
>        realm = ILRW.ING.DOM.TU-DRESDEN.DE
>        security = ADS
>        template homedir = /home/home_ilrw/%U
>        template shell = /bin/bash
> winbind refresh tickets = yes
>        winbind separator = +
>        workgroup = ILRW
>        idmap config dom : range = 10000-9999999 # UID aus RID fuer DOM
>        idmap config dom : backend = rid
>        idmap config ilrw : range = 3000-9999 # UID aus RID fuer ILRW
>        idmap config ilrw : backend = rid
>        idmap config * : range = 2000-2999
>        idmap config * : backend = tdb
> 
> krb5.conf
> 
> [libdefaults]
>        default_realm = ILRW.ING.DOM.TU-DRESDEN.DE
>        dns_lookup_realm = false
>        dns_lookup_kdc = true
>        ticket_lifetime = 24h
>        renew_lifetime = 7d
>        forwardable = true
> 
> [realms]
>   ILRW.ING.DOM.TU-DRESDEN.DE = {
>        auth_to_local =
> RULE:[1:$0@$1](ILRW\.ING\.DOM\.TU-DRESDEN\.DE at .*)s/\.ING\.DOM\.TU-DRESDEN\.DE@/+/
> 
>        auth_to_local =
> RULE:[1:$0@$1](DOM\.TU-DRESDEN\.DE at .*)s/\.TU-DRESDEN\.DE@/+/
>        auth_to_local = DEFAULT
>   }
> 
> Regards,
> 
> 

-- 
Stefan Kania
Landweg 13
25693 St. Michaelisdonn


Signieren jeder E-Mail hilft Spam zu reduzieren und schützt Ihre
Privatsphäre. Ein kostenfreies Zertifikat erhalten Sie unter
https://www.dgn.de/dgncert/index.html