Home / server / Questions / 610255
Accepted
El Barto
Asked: 2014-07-05 11:37:08 +0800 CST

Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from Windows

  • 772

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine.

Here's Samba's log of the error (I've replaced the name of my domain for privacy):

[2014/07/04 15:09:48.437798,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:10.8.0.14:36394 for krbtgt/[email protected]
[2014/07/04 15:09:48.442161,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2014/07/04 15:09:48.442329,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(ietf) pa-data -- [email protected]
[2014/07/04 15:09:48.442438,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(win2k) pa-data -- [email protected]
[2014/07/04 15:09:48.442539,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2014/07/04 15:09:48.442658,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
[2014/07/04 15:09:48.535053,  3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/07/04 15:09:48.535219,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]

However, if I try to login locally, there's no problem:

# smbclient //localhost/netlogon -U Administrator
Enter Administrator's password: 
Domain=[MYDOMAIN] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
smb: \> ls
  .                                   D        0  Mon May 26 12:54:45 2014
  ..                                  D        0  Mon May 26 12:56:28 2014

                36484 blocks of size 8388608. 27650 blocks available
smb: \> 

# kinit
Password for [email protected]: 
Warning: Your password will expire in 5 days on jue 10 jul 2014 14:47:07 ART
# klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting     Expires            Service principal
04/07/14 16:38:31  05/07/14 02:38:31  krbtgt/[email protected]
        renew until 05/07/14 16:38:24

What can be the problem? What does the error "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ" mean?

Here's some additional information that could be important.

Information about the Server:

  • OS: Ubuntu Server 14.04
  • Samba version: 4.1.6-Ubuntu
  • Kerberos version: Kerberos 5 release 1.12

Contents of smb.conf

# Global parameters
[global]
        workgroup = MYDOMAIN
        realm = MYDOMAIN.COM
        netbios name = COLLIE
        server role = active directory domain controller
        dns forwarder = 10.1.1.1
        idmap_ldb:use rfc2307 = yes
        log level = 3

[netlogon]
        path = /var/lib/samba/sysvol/huntmob.com/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

# Sharing general
[files] 
path = /var/lib/samba/usershares/files
read only = no

[todos]
path = /var/lib/samba/usershares/todos
read only = no

[dbox]
path = /var/lib/samba/usershares/dbox
read only = no

Information about the Windows client

During this installation stage I'm working with a Virtual Machine running Windows 7 Professional, which is hosted by a Kubuntu box which connects through a VPN to the office where the Samba server is.

I know this is a little messed up but it's just for this stage, the Samba server will only serve local Windows machines. However, I don't think that this is what's causing the problem, since the Window box seems to be reaching the Samba server just fine.

ubuntu

1 Answers

  1. Best Answer

    According to the MS-KILE documentation

    When clients perform a password-based initial authentication, they MUST supply the PA-ENC-TIMESTAMP pre-authentication type when they construct the initial AS request.

    You're Windows client apparently is not doing this.

    I am not pertaining to know the Windows side very well, but perhaps there are 'compatibility mode' options for authentication which should not be enabled for Samba 4 to work.

    • 1