Bug 756316

Summary: regression in samba credential verification
Product: [Fedora] Fedora Reporter: Daniel <daniel.distler>
Component: sambaAssignee: Guenther Deschner <gdeschner>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: asn, brian.dudek, gdeschner, jlayton, ssorce
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-13 14:26:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Daniel 2011-11-23 08:48:08 UTC
Description of problem:
In Fedora 15 it was possible to browse samba shares without giving a proper domain (e.g. leaving just the default value of MYGROUP). This doesn't work any more in Fedora 16 and you always have to figure out the right domain manually in order to browse samba shares.

Version-Release number of selected component (if applicable):
samba-client-1:3.6.1-74.fc16.x86_64
samba-common-1:3.6.1-74.fc16.x86_64

How reproducible:
always

Steps to Reproduce:
1. run "smbclient -U username //server/share" on Fedora 15
2. run "smbclient -U username //server/share" on Fedora 16
3. run "smbclient -U domainname/username //server/share" on Fedora 16
  
Actual results:
1 and 3 succeed, 2 fails with NT_STATUS_LOGON_FAILURE

Expected results:
1-3 succeed

Additional info:
The default of MYGROUP is just wrong most of the times; it might never have been intended to work and it might just be some inconsistency which finally got fixed in Fedora 16; but it still leads to confusion and breaks existing setups. E.g. if the used domain was accidentally wrong (using lower case instead of upper, a simple typo or something similar) it used to work in Fedora 15 and the same setup will complain about invalid credentials in Fedora 16.
cf http://forums.fedoraforum.org/showthread.php?p=1530634

Would it be possible to use the default domain of the server (as shown by "smbclient -L server") as the default value for authentications instead of the value from the clients /etc/samba/smb.conf file (or may be try both internally if no explicit domain is given / the default is used)?
This way the user won't have to figure out the proper domain manually most of the times and it should lead to more "it just works" experiences for desktop users.

Comment 1 Guenther Deschner 2011-11-28 15:27:05 UTC
Can you please provide the output of testparm so we can see your configuration ?

Comment 2 Daniel 2011-11-28 15:35:35 UTC
on Fedora 16 testparm prints:

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
	workgroup = MYGROUP
	server string = Samba Server Version %v
	log file = /var/log/samba/log.%m
	max log size = 50
	idmap config * : backend = tdb
	cups options = raw

[homes]
	comment = Home Directories
	read only = No
	browseable = No

[printers]
	comment = All Printers
	path = /var/spool/samba
	printable = Yes
	print ok = Yes
	browseable = No

do you also need an output of Fedora 15, where it worked without explicit domain?

Comment 3 Brian Dudek 2011-12-12 19:40:24 UTC
I also see this in F16 but I don't know that being explicit with domain name is a "bad" thing but this does cause some confusion when using Nautilus.  Connect to Server...when making a Windows Share connection user name must be specified as domain/share or the connection will fail.  When the connection fails this is Samba server error log:

[2011/12/12 12:03:13.765720,  0] auth/auth_domain.c:327()
  domain_client_validate: unable to validate password for user dudek in domain mydomain to Domain controller MYDC. Error was NT_STATUS_WRONG_PASSWORD.

These are my F16 bits:
samba-client-3.6.1-75.fc16.x86_64
nautilus-3.2.1-2.fc16.x86_64

I have no F15 systems to test with.


So it looks like (as for smbclient) F16 works like RHEL 6.1 (which uses samba-client-3.5.6-86.el6_1.4.x86_64) AND F11 (which uses samba-client-3.4.7-0.50.fc11.i586)

All three system produce this:

[dudek@pinkerton ~]$ smbclient -U dudek //server/scratch
Enter dudek's password: 
session setup failed: NT_STATUS_LOGON_FAILURE

* in this case there is no Samba server log messages reporting an error

[dudek@pinkerton ~]$ smbclient -U mydomain/dudek //server/scratch
Enter mydomain/dudek's password: 
Domain=[MYDOMAIN] OS=[Unix] Server=[Samba 3.5.5]


The same connection success and failure pattern when specifying a (or not) a domain is also seen when connecting to a Windows 2008 share server.

I'm not sure we have an smbclient issue per se but there is a Nautilus implication.

Comment 4 Fedora End Of Life 2013-01-16 13:35:29 UTC
This message is a reminder that Fedora 16 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 16. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '16'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 16's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 16 is end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" and open it against that version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 5 Fedora End Of Life 2013-02-13 14:26:20 UTC
Fedora 16 changed to end-of-life (EOL) status on 2013-02-12. Fedora 16 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.