[Samba] Nobody can log on from a trusted domain, EXCEPT my own account
in [Samba]
|
Prev: [Samba] Attribute ms-DS-User-Account-Disabled in samba4
Next: [Samba] Windows 7 only connects if joined to the domain
From: Diego Zuccato on 25 Feb 2010 11:20 Hello. The one of "strange problems" is here again. This time it's even stranger. I've setup a lab based on Mandriva 2010.0. I use winbind for authentication. I just installed ONE machine, then cloned it on the others, changing IP, name, and rejoining. We have two main domains (PERSONALE and STUDENTI). Machines have to be joined to PERSONALE, but the majority of users are students (accounts in STUDENTI). Well, on SOME machines, it works well. On others I can logon with my student account, but other students can't. The student account I use is NOT the one I used to join'em, so it shouldn't be cached. If I request an "ls -l" of /home/STUDENTI/ I see that the ONLY UID that gets resolved is my own (STUDENTI\diego.zuccato2) while the others are numeric. With that account I can log on, too. I installed samba-winbins-3.4.3-2mdv2010.0 on all the machines. AD is hosted on Windows servers outside of my control, but it should be in "native mode". I already tried to rejoin the misbehaving machines, with no luck. When another student tries to login, I can see this message in log.winbindd (if I run it with -d 10): ads_sasl_spnego_bind: got server principal name = edge$@STUDENTI.DIR.UNIBO.IT ads_krb5_mk_req: krb5_get_credentials failed for edge$@STUDENTI.DIR.UNIBO.IT (Cannot find KDC for requested realm) ads_sasl_spnego_krb5_bind failed with: Cannot find KDC for requested realm, calling kinit kerberos_kinit_password: as STR00160-11-13$@PERSONALE.DIR.UNIBO.IT using [MEMORY:winbind_ccache] as ccache and config [(null)] ads_krb5_mk_req: krb5_get_credentials failed for edge$@STUDENTI.DIR.UNIBO.IT (Cannot find KDC for requested realm) kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot find KDC for requested realm ads_connect for domain STUDENTI failed: Cannot find KDC for requested realm refresh_sequence_number: failed with NT_STATUS_UNSUCCESSFUL store_cache_seqnum: success [STUDENTI][4294967295 @ 1267108652] refresh_sequence_number: STUDENTI seq number is now -1 error getting user info for sid S-1-5-21-790525478-1035525444-682003330-???????? Storing response for pid 3622, len 3496 s3_event: Destroying timer event 0xb8128398 "async_request_timeout_handler" Retrieving response for pid 3622 query_user returned an error Could not query domain STUDENTI SID S-1-5-21-790525478-1035525444-682003330-??????? Does it ring a bell to someone? Tks! -- Diego Zuccato Servizi Informatici Dip. di Astronomia - Università di Bologna Via Ranzani, 1 - 40126 Bologna - Italy tel.: +39 051 20 95786 mail: diego.zuccato(a)unibo.it -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba |