Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 449000 - Samba server can't authenticate to NT domain after 2008-05-28 update
Summary: Samba server can't authenticate to NT domain after 2008-05-28 update
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: samba
Version: 5.2
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Guenther Deschner
QA Contact:
: 450509 (view as bug list)
Depends On:
Blocks: 450653 455418
TreeView+ depends on / blocked
Reported: 2008-05-29 20:25 UTC by Nathaniel Taylor
Modified: 2009-02-16 15:02 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-01-20 21:47:12 UTC
Target Upstream Version:

Attachments (Terms of Use)
samba config file (deleted)
2008-05-30 09:07 UTC, Nathaniel Taylor
no flags Details
samba log of client session (deleted)
2008-05-30 09:08 UTC, Nathaniel Taylor
no flags Details
always return netlogon negotiate flags (deleted)
2008-05-30 14:16 UTC, Guenther Deschner
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2009:0180 normal SHIPPED_LIVE samba bug fix and enhancement update 2009-01-20 16:05:46 UTC

Description Nathaniel Taylor 2008-05-29 20:25:32 UTC
Description of problem:

For over a year, this installation has successfully served ms-windows clients 
on a windows NT domain, after joining the domain  with the command 'net rpc 
join member -U adm'.  Simultaneous with an automatic update on 2008-05-28, 
no client could log in to the RHEL samba server.  

# smbclient  -L penguin -U nt
[2008/05/28 16:30:56, 0] 
  connect_to_domain_password_server: unable to open the domain client session 
to machine DOMCONT
Even removing all configs then trying rejoining the domain didn't work:

The same problem existed on the backup machine, running a similar
RHEL5.  There was no such problem with other systems (e.g. gentoo) and
their latest releases.  I removed all samba components and installed
from the old CDs, version samba-3.0.23c-2.x86_64; this worked fine, 
until a few minutes later it was auto-updated again.  I finally
installed the old version and turned off updates... not a nice state.

Version-Release number of selected component (if applicable):


How reproducible:

See the above description.  Clearly it's not very thoroughly tested,
since I haven't time to experiment with clean installations, different
settings, etc.  I've already wasted well over an hour.

Steps to Reproduce:

Be on my department's Windows2000 NT domain, and try updating
RHEL5 samba!  I.e. it seems a samba-3.0.28-1.el5_2.1 problem 
with NT domain controllers, but perhaps some local peculiarity

Actual results:
No authentication provided to the samba server from domain controller.

Expected results:
Samba works.

Additional info:

Comment 1 Simo Sorce 2008-05-29 22:36:11 UTC
can you attach your smb.conf file so that I can try to reproduce here?
also logs would be nice

Comment 2 Nathaniel Taylor 2008-05-30 09:07:21 UTC
Created attachment 307175 [details]
samba config file

Comment 3 Nathaniel Taylor 2008-05-30 09:08:25 UTC
Created attachment 307176 [details]
samba log of client session

Comment 4 Nathaniel Taylor 2008-05-30 09:09:07 UTC
Certainly:  here's more detail.

smb.conf is the config.
gnu.log is a log of an attempted access to samba shares.

The [ns]mb.log don't contain any details of the problem; they just have
startup times.

When I tried to (re)join the domain, in case somehow the 'trust' had been 
overwritten in the update, the following message was shown on the command line 
but nothing in the logs:

# net rpc join member -U nt.adm
[2008/05/30 10:56:14, 0] utils/net_rpc_join.c:net_rpc_join_newstyle(371)
  Error in domain join verification (credential setup failed): 
Unable to join domain EKC.KTH.SE.

According to the admin for the windows network, nothing has changed there in 
recent days.  Furthermore, everything worked with the original version from 
the CDs 1 year ago, then worked with all the updates up to then, then failed 
on this last update, then worked with regression to the old version from the 
CD, then failed with update to the new, then worked with the old again...

Comment 5 Guenther Deschner 2008-05-30 09:35:12 UTC
So, is your domain controlled by NT4 domain controllers or Windows 2000 domain
controllers ?

Comment 6 Nathaniel Taylor 2008-05-30 10:08:21 UTC
It's a single NT4 domain controller, running Windows NT 4 with current 
updates, serving a domain of Win2000 and WinXP clients. 

Sorry for the confusion.  I only knew the "NT domain" bit, and had to contact 
the windows admin to find out the full details.

Comment 7 Guenther Deschner 2008-05-30 14:16:52 UTC
Created attachment 307202 [details]
always return netlogon negotiate flags

This patch fixes it for me.

Comment 8 Nathaniel Taylor 2008-06-01 11:18:22 UTC
Thanks for the patch.  I'm very happy to leave the testing to RedHat, 
particularly if a working update to samba will come soon.  If it's of help 
that I test the patch on our network too, please would you (Simo) send me an 
rpm or details of how to get the srpm; it's 'non-obvious' to me from the rhn 
website, and it's years since I played with rpms.

Comment 9 Devin Bougie 2008-06-02 19:21:08 UTC
For what it's worth, the patch in Comment #7 fixes this issue for us, also.

Comment 10 Monty Walls 2008-06-02 20:25:29 UTC
Same problem, except I had working domain members of an NT domain stop working
until I fell back my samba version.  Current domain is pdc + 2 bdc (NT).

Comment 11 Guenther Deschner 2008-06-03 01:01:29 UTC
We will provide an offical update soon, in the meantime, you can find test rpms at:

Please let us know if it fixes this issue.

Comment 12 Nathaniel Taylor 2008-06-03 11:00:29 UTC
Yes, thanks.  These rpms 3.0.28-1.el5_2.2 don't have the authentication 
problem of 3.0.28-1.el5_2.1.

Comment 13 mattg 2008-06-03 12:13:13 UTC
As an extra data point, the patch in comment #7 fixed the problem (joining an NT
4.0 domain) for me under Fedora 8 when applied to samba-3.0.30-0.fc8

Comment 14 Monty Walls 2008-06-03 12:55:02 UTC
Fixes it for me.

Comment 15 Devin Bougie 2008-06-03 13:53:14 UTC
The RPMs posted in Comment #11 work for us, also.

Comment 16 Guenther Deschner 2008-06-09 12:27:08 UTC
*** Bug 450509 has been marked as a duplicate of this bug. ***

Comment 17 Nathaniel Taylor 2008-07-02 10:48:18 UTC
What's going on with this bug?  The working patch came out about a month ago, 
but there isn't yet a mention of an official update. Until there is, I can't 
afford to use updates.  There must be many more users than have shown up on 
this list, who can't use their samba.

Comment 24 Janne Blomqvist 2008-09-17 13:22:18 UTC
To reiterate, what's going on? It's now 3 and a half months since the one-line patch that fixes the problem came out, and yet no official update.

Comment 25 Simo Sorce 2008-09-17 14:39:14 UTC
if you are in urgent need of a patched binary I suggest you contact support and escalate the issue to get an hotfix.
The fix is scheduled to be released with the 5.3 update for now.

Comment 27 Rob Garth 2008-12-03 22:46:18 UTC
Thankyou for the RPMs, they have worked for us. Is there an ETA for the rpms to be released officially?

Comment 29 errata-xmlrpc 2009-01-20 21:47:12 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.