0

I regularily mount a shared drive from a Windows 2012R2 server on a Linux machine (OpenSUSE Tumbleweed). Since last Thursday when updates where installed on the Windows server the mount fails with the error message

Aug 26 11:45:27 <linux server> kernel: CIFS: Attempting to mount //<windows server>/<share>
Aug 26 11:45:27 <linux server> kernel: CIFS: Status code returned 0xc000018d STATUS_TRUSTED_RELATIONSHIP_FAILURE
Aug 26 11:45:27 <linux server> kernel: CIFS: VFS: \\a-store Send error in SessSetup = -5
Aug 26 11:45:27 <linux server> kernel: CIFS: VFS: cifs_mount failed w/return code = -2

I tried different mount options (vers=2.0, 2.1, 3.0, sec=ntlm, ntlmssp) and different users - all with the same result. The linux server can mount shares from other servers and the shares on the windows server are accessible from (almost all) other computers. I have tried to leave the domain on join it again on both machines - without effect.

Currently I would say one of the updates on the Windows server is the cause of the issue. We have other servers running on 2012R2 which are still working fine and got updates on Thursday as well. The only difference is the language of the operating system (German / English).

Is there a way to get more information on the issue? Documentation on "STATUS_TRUSTED_RELATIONSHIP_FAILURE" is not exactly helpful.

2 Answers 2

0

Looks like an authentication issue, try this:

  1. keep an eye on the log files on your windows server to catch any relevant errors
  2. Make sure the account you are using on your Linux is authorized to access this share, local vs domain accounts
  3. try basic ping your Linux to Windows if your firewall allow this
  4. try from another Linux machine
  5. why do you say "almost all" maybe there is something common between that is blocking your Linux and the other machines that are not connecting

I hope this help

0

The problem seemed to be that I could not use Kerberos authentication. I changed from winbind to sssd to join the Windows domain and used sec=krb5 as an option on the mount.cifs command:

mount.cifs //server.tld/share /path/to/mount/point -o vers=3.0,sec=krb5

Unfortunately, this was not possible before I changed to sssd.

[Edit 2021-02-21]

I was using winbind before and changed to sssd to join the domain. I do not remember all the changes I made but from the configuration in /etc it looks like I did the following

  • added sssd config in /etc/sssd/sssd.conf
  • joined the domain using kinit and net ads join

Changes to smb.conf were not necessary.

2
  • uli, could you elaborate on how you solved this? I'm dealing with the same issue, recent update to Windows domain controller to address this vulnerability (msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1472) has caused cifs mounting of Windows shares to fail. Specifically, what steps did you take to enable krb5 usage? Did you have to make any changes on the Windows servers? Did you have to join the Linux machine to ActiveDirectory? What steps were needed to change to sssd? Any links or further info would be incredibly helpful. Feb 18, 2021 at 20:12
  • I added some details to my post above. I hope that helps. If not let me know.
    – uli
    Feb 21, 2021 at 9:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .