Bug 132378

Summary: "Failed to verify incoming ticket" after upgrade from previous 3.0.x release
Product: Red Hat Enterprise Linux 3 Reporter: Patrick Hopp <hopp>
Component: sambaAssignee: Jay Fenlason <fenlason>
Status: CLOSED WORKSFORME QA Contact:
Severity: high Docs Contact:
Priority: medium    
Version: 3.0CC: hopp, jfeeney, tao
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-02-12 00:22:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 132991    

Description Patrick Hopp 2004-09-11 23:53:19 UTC
Description of problem:
I've posted to a similar bug report on bugzilla.samba.org here:
https://bugzilla.samba.org/show_bug.cgi?id=1717

Having exact same problem as person who created the ticket @
samba.org.  Redhat AS 3.0, samba quit working after recent upgrade
from 3.0.4 to 3.0.6.  Log entries are on their website.  Went as far
as uninstalling samba and krb5 from the box and manually compiled krb5
1.3.5 from MIT and Samba 3.0.5, 3.0.6, and latest CVS.  Same problem
all the way around.  Samba started misbehaving for me after the large
"quarterly update".  Upgraded a bunch of packages, could be any one of
the other packages that were upgraded that created this problem, but
I'm not technical enough to determine which one.


I've posted to a similar bug report on bugzilla.samba.org here:
https://bugzilla.samba.org/show_bug.cgi?id=1717

Original samba.org post:
samba is member of a win 200 Active Directory after upgrading from
3.0.4 to 3.0.6 via rhn, user are no longer able to access shares on
samba server.

a login message box keeps popping up message "failed to verify
incoming ticket" in samba logs

i suspect samba upgrade to be responsible because an other server with
the same samba / kerberos configuration and samba 3.0.4 works perfectly

------------------
My Follow up post:

Having exact same problem as person who created the ticket @
samba.org.  Redhat AS 3.0, samba quit working after recent upgrade
from 3.0.4 to 3.0.6.  Log entries are on their website.  Went as far
as uninstalling samba and krb5 from the box and manually compiled krb5
1.3.5 from MIT and Samba 3.0.5, 3.0.6, and latest CVS.  Same problem
all the way around.  Samba started misbehaving for me after the large
"quarterly update".  Upgraded a bunch of packages, could be any one of
the other packages that were upgraded that created this problem, but
I'm not technical enough to determine which one.

Additional Info:
You can connect to \\<IP ADDRESS> just fine, but when you try
\\MACHINEname or even \\FULLy.Qualified.Host.Name you get prompted for
a username and password.

Version-Release number of selected component (if applicable):
samba-3.0.6-2.3E

How reproducible:
Everytime

Steps to Reproduce:
1.Run all RHN updates
2.Reboot
3.Attempt to connect to samba server by using \\MACHINENAME from a
windows box
  
Actual results:
User is prompted with Username/Password box.  After information is
entered correctly box remains and user can not access share.

Expected results:
Share and files would have shown up

Additional info:
Currently having this problem on a fileserver, need to fix.

Comment 1 Suzanne Hillman 2004-09-13 21:16:08 UTC
This bug is being actively investigated by the upstream Samba folks,
and they will almost certainly be able to debug the problem far faster
than we can, due to their familiarity with the code they wrote.

Comment 2 Andrew Bartlett 2004-10-14 12:38:54 UTC
The fundemental problem here is that it pretty much only matters for
systems running krb5 < 1.3.  This is why it's turned into pretty much
a RHEL3 only problem.

I don't have access to RHEL, and not much else runs krb5 1.3 these
days, but in some over-the-phone debugging I did with a different site
I still could not make it work..

Comment 3 Patrick Hopp 2004-10-27 12:25:28 UTC
This is posted on the samba buzilla site..    The patch seems to come 
from a person at RedHat..  Does that mean it will make it into samba-
3.0.8 from samba or will it be in the RedHat release only?  Or will 
it even make it into 3.0.8?

------- Additional Comment #33 From Shane McMaster 2004-10-21 14:26 
[reply] ------- 
A little bit of googling revealed this recently posted patch along 
with an
explanation

http://people.redhat.com/nalin/test/samba-3.0.8pre1-salt-3.patch

Basically it boils down to: Unjoin your server from the domain and 
make sure the
domain account is completely gone in AD users and computers and then 
rejoin it.
This is the course of action I will try since I had the problem when 
I moved
from 3.0.4 -> 3.0.7 and I have upgraded my krb5 libs to 1.3.x to try 
and resolve
my issues.

Otherwise you could try upgrading to 3.0.8pre1 from Redhat or 
backporting the
patch to 3.0.7

I will report back with any successes or failures.


Comment 4 Thomas Nickl 2005-06-16 10:15:41 UTC
believe me or not, it happened twice to me already:
the "with \\ip it works but with \\name not", and "failed to verify
incoming ticket" (perhaps with "user unknown" in log.nmbd) was SOLVED by opening
smb.conf in vi, creating smb.new in another vi like so:
vi smb.new,
then typing in the second (empty) vi:
:set paste
, then selecting as much as possible with the mouse in the first vi,
then pressing i in the second vi and inserting, then do it as necessary to paste
the entire file, then doing :wq, then:
mv smb.new smb.conf
, then /etc/init.d/smb stop and start
well, you can ignore me now, but if nothing helps (tried upgrading to newest
too), it's worth a try. and once again, this is no joke or anything!