Samba ADS authentication in disjointed, multiple forest

[Scott Parrill <sparrill@xxxxxxxx>]

All,

I have recently come across a problem I have been unable to resolve.  I have been running Samba with Winbind ADS authentication for the last couple of years with good success until recently.  About 2 weeks ago, I restarted the Samba and Winbind services on a Fedora Core 3 machine runing Samba 3.0.10-1 (installed from FC3 RPMs) and the active directory authentication has started failing.

The environment is two domains sitting in separate forests: cit.univ.edu and dept.univ.edu.  (These are separate active directory forests because that is the environment dictated by the university central IT.  Cit.univ.edu is also a disjoined domain where all the computers for the domain sit in the univ.edu DNS zone.)  There is a one way trust so the dept domain can use the cit domain for user authentication to computer resources in the dept domain.  (The domain controllers for DEPT.UNIV.EDU are DCA.DEPT.UNIV.EDU and DCB.DEPT.UNIV.EDU.  The domain controllers for UNIV.EDU are DC1.UNIV.EDU, DC2.UNIV.EDU, DC3.UNIV.EDU, and DC4.UNIV.EDU.  The Samba server in the domain DEPT.UNIV.EDU is SAMBA.DEPT.UNIV.EDU.)

The last time I can verify everything was working correctly was about two months ago when the Samba server was last rebooted.  The krb5.conf that was working at the time is

[logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log

[libdefaults]
  default_realm = DEPT.UNIV.EDU
  dns_lookup_realm = true
  dns_lookup_kdc = true

[realms]
  DEPT.UNIV.EDU = {
    admin_server = dca.dept.univ.edu
    default_domain = dept.univ.edu
  }
  UNIV.EDU = {
    admin_server = dc1.univ.edu
    kdc = dc1.univ.edu
    default_domain = univ.edu
  }

[domain_realm]
  .dept.univ.edu = DEPT.UNIV.EDU
  dept.univ.edu = DEPT.UNIV.EDU
  .univ.edu = UNIV.EDU
  univ.edu = UNIV.EDU

[kdc]
  profile = "">
[appdefaults]
  pam = {
     debug = false
     ticket_lifetime = 36000
     renew_lifetime = 36000
     forwardable = true
     krb4_convert = true
  }

And Samba/Winbind was configured with the following:

security = ads
realm = DEPT.UNIV.EDU
password server = *

As of a couple of weeks ago, my Samba servers are still able to connect to the dept.univ.edu domain but unable to connect to the cit.univ.edu domain.  The command "wbinfo -g --domain UNIV" now results in a "Error looking up domain groups" error and

[2006/10/12 15:07:58, 1] libsmb/clikrb5.c:ads_krb5_mk_req(390)
  ads_krb5_mk_req: krb5_get_credentials failed for dc1$@CIT.UNIV.EDU (Server not found in Kerberos database)
[2006/10/12 15:07:58, 1] libsmb/cliconnect.c:cli_session_setup_kerberos(544)
  spnego_gen_negTokenTarg failed: Server not found in Kerberos database
[2006/10/12 15:07:58, 1] libsmb/clikrb5.c:ads_krb5_mk_req(390)
  ads_krb5_mk_req: krb5_get_credentials failed for dc1$@CIT.UNIV.EDU (Server not found in Kerberos database)
[2006/10/12 15:07:58, 1] libsmb/clikrb5.c:ads_krb5_mk_req(390)
  ads_krb5_mk_req: krb5_get_credentials failed for dc1$@CIT.UNIV.EDU (Server not found in Kerberos database)
[2006/10/12 15:07:58, 1] nsswitch/winbindd_ads.c:ads_cached_connection(81)
  ads_connect for domain UNIV failed: Server not found in Kerberos database

in the winbind.log file.

So far, my searches for a resolution to the problem have suggested a problem in correctly resolving the host name for the domain controllers.  On the host involved, the gethostbyname function correctly returns the appropriate IP address for dc1.univ.edu and the reverse lookup, with gethostbyaddr, of that IP address returns dc1.univ.edu.  (I don't manage dc1.univ.edu but those who do tell me the machine itself believes its name is also dc1.univ.edu.  Unfortunately I can't check dc1.univ.edu to make sure it is correctly resolving dca.dept.univ.edu or samba.dept.univ.edu.)

The authentication for Windows XP and Windows 2003 machines still works correctly.  I have also been having this same problem with a new server on which I installed CentOS 4.4 (with all the updates) using either Samba 3.0.10-1 from the CentOS repository or 3.0.23c installed from source downloaded from samba.org.

I have also tried the following krb5.conf with no luck:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
  default_realm = DEPT.UNIV.EDU
  dns_lookup_realm = false
  dns_lookup_kdc = false

[realms]
  DEPT.UNIV.EDU = {
    admin_server = dca.dept.univ.edu
    kdc = dca.dept.univ.edu
    kdc = dcb.dept.univ.edu
    default_domain = dept.univ.edu
  }
  UNIV.EDU = {
    admin_server = dc1.univ.edu
    kdc = dc1.univ.edu
    kdc = dc2.univ.edu
    kdc = dc3.univ.edu
    kdc = dc4.univ.edu
    default_domain = cit.univ.edu
  }
  CIT.UNIV.EDU = {
    admin_server = dc1.univ.edu
    kdc = dc1.univ.edu
    kdc = dc2.univ.edu
    kdc = dc3.univ.edu
    kdc = dc4.univ.edu
    default_domain = cit.univ.edu
  }

[domain_realm]
  .dept.univ.edu = DEPT.UNIV.EDU
  dept.univ.edu = DEPT.UNIV.EDU
  .univ.edu = CIT.UNIV.EDU
  univ.edu = CIT.UNIV.EDU
  .cit.univ.edu = CIT.UNIV.EDU
  cit.univ.edu = CIT.UNIV.EDU
  dc1.univ.edu = CIT.UNIV.EDU
  dc2.univ.edu = CIT.UNIV.EDU
  dc3.univ.edu = CIT.UNIV.EDU
  dc4.univ.edu = CIT.UNIV.EDU

[kdc]
  profile = "">
[appdefaults]
  pam = {
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
  }

The Fedora Core 3 (existing) machine is running kernel version 2.6.11-1.27_FC3smp, krb5-libs version 1.3.6-5, and Samba version 3.0.10-1 installed. (All installed from FC3 RPMs.)

The CentOS 4.4 (new) machine is running kernel version 2.6.9-42EL, krb5-libs version 1.3.4-33, and Samba 3.0.10-1.4E9 installed.  (Again, all installed from CentOS RPMs.  However, as mentioned above, I am also seeing this problem with Samba 3.0.23c installed from source on this machine.)

Any suggestions that would point me in the right direction to resolve this problem would be greatly appreciated.

Thanks,
Scott

--

---

Scott Parrill	|	When the legends die, the dreams end.
Area Technology & Communications Manager	|	When the dreams end, there is no more greatness.
Wyoming GISciences Center	|
University of Wyoming	|
Laramie, WY 82071	|	When the Legends Die
PH: (307)766-2524 FAX: (307)766-2744	|	Hal Borland
sparrill@xxxxxxxx	|

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list