[Samba] New options "sync machine password to keytab"/ "client ldap sasl wrapping"
pfilipensky at samba.org
pfilipensky at samba.org
Wed Feb 19 10:22:14 UTC 2025
Hi Christian,
On 2/18/25 3:28 PM, Christian Naumer via samba wrote:
> This is from the man page of Samba:
>
> "This path is relative to private dir if the path does not start with
> a/."
>
> Having said that this is wat We have on our DCs:
>
>
> tls enabled = yes
> tls keyfile = tls/server_de.key
> tls certfile = tls/server.pem
> tls cafile = tls/ca.pem
> tls priority = SECURE192:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3
>
> The problem is only on the member servers and only when using:
>
> net ads changetrustpw
>
>
> The DCs are on 4.20.7-SerNet-RedHat-7.el8. So not on the latest as the
> file servers.
>
> Have you tried "net ads changetrustpw" on a member with "sync machine
> password to keytab" in the smb.conf?
Yes, "net ads changetrustpw" is part of upstream tests:
https://gitlab.com/samba-team/samba/-/blob/ccc3b2b2fba7b5d223c79bffc0f655490aed19cf/source3/script/tests/test_update_keytab.sh#L601
Does the issue happens also with samba 4.21.3?
Kind regards,
Pavel
>
>
>
> Regards
>
> Christian
>
>
>
>
> Am 18.02.25 um 15:21 schrieb Sami Hulkko via samba:
>> My penny on it:
>>
>> tls enabled = Yes
>> tls cafile = /var/lib/samba/private/tls/ca.crt
>> tls certfile = /var/lib/samba/private/tls/dc.crt
>> tls crlfile = /var/lib/samba/private/tls/pki.crl
>> tls dh params file = /var/lib/samba/private/tls/dh.pem
>> tls keyfile = /var/lib/samba/private/tls/secure/dc.key
>>
>> Works and needs absolute paths.
>>
>> # tls priority = NORMAL:-VERS-TLS1.0:-VERS-TLS1.1
>>
>> opt out old ciphers is possible.
>>
>> SH
>>
>> On 18/02/2025 14:38, Christian Naumer via samba wrote:
>>> Hi all,
>>> some additional info. If I supply a CRL file in the smb.conf like this:
>>>
>>> #tls verify peer = ca_and_name
>>> tls crlfile = tls/root.crl.pem
>>>
>>> And comment "tls verify peer" which then uses the default "tls
>>> verify peer = as_strict_as_possible"
>>>
>>> the "gensec_gse_client_prepare_ccache" error is not logged during
>>> "normal" password change. However, the behaviour of "net ads
>>> changetrustpw" is still the same.
>>>
>>> Any thoughts on this?
>>>
>>> Regards
>>>
>>> Christian
>>>
>>>
>>> Am 18.02.25 um 12:48 schrieb Christian Naumer via samba:
>>>> Hi all,
>>>> I have been trying to use the new options "sync machine password to
>>>> keytab" and "client ldap sasl wrapping" in Samba 4.21 together with
>>>> "client ldap sasl wrapping"
>>>>
>>>> When this is set:
>>>>
>>>> client ldap sasl wrapping = ldaps (or starttls)
>>>> tls cafile = tls/ca.pem
>>>> tls verify peer = ca_and_name
>>>> sync machine password to keytab = /etc/
>>>> krb5.keytab:sync_spns:sync_kvno:machine_password
>>>>
>>>>
>>>>
>>>> And I do a:
>>>>
>>>> net ads changetrustpw
>>>>
>>>>
>>>> I get this:
>>>>
>>>>
>>>> Changing password for principal: host$@DOMAIN.COM
>>>> gensec_gse_client_prepare_ccache: Kinit for HOST$@DOMAIN.COM to
>>>> access ldap/dc2.domain.com failed: Preauthentication failed:
>>>> NT_STATUS_LOGON_FAILURE
>>>> pw2kt_get_dc_info: Failed to refresh keytab, ads_connect() returned
>>>> Invalid credentials
>>>> secrets_finish_password_change: Sync of machine password failed.
>>>> Password change failed: An internal error occurred.
>>>>
>>>>
>>>> The keytab is still updated with the new KVNO and the machine
>>>> password in AD is updated. However the new KVNO is appended to the
>>>> keytab. There are two new KVNOs in the keytab as if the password
>>>> was updated twice.
>>>>
>>>>
>>>> When I remove the ldaps/startrls options from the smb.confI get
>>>> this result:
>>>>
>>>> Changing password for principal: host$@DOMAIN.COM
>>>> Password change for principal host$@DOMAIN.COM succeeded.
>>>>
>>>>
>>>> The keytab is updated with the new KVNO and the machine password in
>>>> AD is updated. In the keytab there are then always 3 KVNOs the
>>>> current and the two previous ones.
>>>>
>>>> Additional info. If I wait for the machine password to timeout and
>>>> winbind changes the password. This "works" as far as the keytab has
>>>> only one additional KVNO and all other KVNOs more then the current
>>>> and the last two are removed. However the error
>>>>
>>>> gensec_gse_client_prepare_ccache: Kinit for HOST$@DOMAIN.COM to
>>>> access ldap/dc2.domain.com failed: Preauthentication failed:
>>>> NT_STATUS_LOGON_FAILURE
>>>>
>>>> is still logged.
>>>>
>>>> Should I file a bug for this? I can reproduce this also on a Debian
>>>> 12 system.
>>>>
>>>> Regards
>>>>
>>>> Christian
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Samba version is 4.21.4-SerNet-RedHat-6.el8 just updated with the
>>>> release this morning.
>>>>
>>>> Here is the rest of the global section:
>>>>
>>>> [global]
>>>> netbios name = HOST
>>>> server string = Daten
>>>> security = ADS
>>>> realm = HQ.DOMAIN.COM
>>>> workgroup = DOMAIN-02
>>>> disable netbios = yes
>>>> smb ports = 445
>>>> interfaces = eth0
>>>> bind interfaces only = yes
>>>> server min protocol = SMB2
>>>> client min protocol = SMB2
>>>> log level = 1 auth_audit:5
>>>> client ldap sasl wrapping = starttls
>>>> tls cafile = tls/ca.pem
>>>> tls verify peer = ca_and_name
>>>> logging = syslog only
>>>> sync machine password to keytab = /etc/
>>>> krb5.keytab:sync_spns:sync_kvno:machine_password
>>>> writeable =YES
>>>> map acl inherit = yes
>>>> store dos attributes = yes
>>>> inherit acls = Yes
>>>> vfs objects = acl_xattr full_audit
>>>> full_audit:success = pwrite write unlinkat renameat
>>>> full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
>>>> full_audit:priority = NOTICE
>>>> full_audit:facility = local7
>>>> full_audit:failure = none
>>>> apply group policies = yes
>>>> username map = /etc/samba/smbusers
>>>>
>>>> interfaces = lo eth0
>>>> bind interfaces only = Yes
>>>> ##idmap##
>>>> # Default idmap config used for BUILTIN and local windows
>>>> accounts/groups
>>>> idmap config *:backend = tdb
>>>> idmap config *:range = 1000000-2000000
>>>>
>>>> # idmap config for domain DOMAIN-02
>>>> idmap config DOMAIN-02:backend = ad
>>>> idmap config DOMAIN-02:range = 500-65555
>>>> idmap config DOMAIN-02:unix_nss_info = yes
>>>> idmap config DOMAIN-02:schema_mode = rfc2307
>>>> winbind enum users = yes
>>>> winbind enum groups = yes
>>>> winbind use default domain = Yes
>>>> machine password timeout = 604800
>>>> winbind reconnect delay = 5
>>>> winbind refresh tickets = yes
>>>> min domain uid = 500
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>
>
More information about the samba
mailing list