Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine.

Here's Samba's log of the error (I've replaced the name of my domain for privacy):

[2014/07/04 15:09:48.437798,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ Administrator@mydomain.com from ipv4:10.8.0.14:36394 for krbtgt/mydomain.com@mydomain.com
[2014/07/04 15:09:48.442161,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2014/07/04 15:09:48.442329,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(ietf) pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442438,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(win2k) pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442539,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442658,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
[2014/07/04 15:09:48.535053,  3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/07/04 15:09:48.535219,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]

However, if I try to login locally, there's no problem:

# smbclient //localhost/netlogon -U Administrator
Enter Administrator's password: 
Domain=[MYDOMAIN] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
smb: \> ls
  .                                   D        0  Mon May 26 12:54:45 2014
  ..                                  D        0  Mon May 26 12:56:28 2014

                36484 blocks of size 8388608. 27650 blocks available
smb: \> 

# kinit
Password for administrator@MYDOMAIN.COM: 
Warning: Your password will expire in 5 days on jue 10 jul 2014 14:47:07 ART
# klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@MYDOMAIN.COM

Valid starting     Expires            Service principal
04/07/14 16:38:31  05/07/14 02:38:31  krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
        renew until 05/07/14 16:38:24

What can be the problem? What does the error "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ" mean?

Here's some additional information that could be important.

Information about the Server:

  • OS: Ubuntu Server 14.04
  • Samba version: 4.1.6-Ubuntu
  • Kerberos version: Kerberos 5 release 1.12

Contents of smb.conf

# Global parameters
[global]
        workgroup = MYDOMAIN
        realm = MYDOMAIN.COM
        netbios name = COLLIE
        server role = active directory domain controller
        dns forwarder = 10.1.1.1
        idmap_ldb:use rfc2307 = yes
        log level = 3

[netlogon]
        path = /var/lib/samba/sysvol/huntmob.com/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

# Sharing general
[files] 
path = /var/lib/samba/usershares/files
read only = no

[todos]
path = /var/lib/samba/usershares/todos
read only = no

[dbox]
path = /var/lib/samba/usershares/dbox
read only = no

Information about the Windows client

During this installation stage I'm working with a Virtual Machine running Windows 7 Professional, which is hosted by a Kubuntu box which connects through a VPN to the office where the Samba server is.

I know this is a little messed up but it's just for this stage, the Samba server will only serve local Windows machines. However, I don't think that this is what's causing the problem, since the Window box seems to be reaching the Samba server just fine.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

According to the MS-KILE documentation

When clients perform a password-based initial authentication, they MUST supply the PA-ENC-TIMESTAMP pre-authentication type when they construct the initial AS request.

You're Windows client apparently is not doing this.

I am not pertaining to know the Windows side very well, but perhaps there are 'compatibility mode' options for authentication which should not be enabled for Samba 4 to work.

share|improve this answer
    
Thanks for the link. I had to drop this because we found another limitation on our network that made us look for a different approach, so I couldn't get another Windows client to test. –  El Barto Jul 16 at 17:42
    
I finally could set up a new Windows VM and could connect to the Domain just fine. Evidently there was something weird about my other VM, so I marked this as resolved. Thanks! –  El Barto Jul 21 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.