Bug 885089
| Summary: | Samba netlogon AES support incorrect | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Guenther Deschner <gdeschner> |
| Component: | samba4 | Assignee: | Andreas Schneider <asn> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.4 | CC: | jgalipea, sbose, sgoveas |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | samba4-4.0.0-49.el6.rc4 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-02-21 08:46:24 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 886216 | ||
|
Description
Guenther Deschner
2012-12-07 13:44:01 UTC
C:\Users\Administrator.WIN2K8R2.000>tracert wazwan.ipalab.qe
Tracing route to wazwan.ipalab.qe [10.65.201.162]
over a maximum of 30 hops:
1 1 ms <1 ms <1 ms 10.65.201.162
Trace complete.
C:\Users\Administrator.WIN2K8R2.000>nltest.exe /sc_change_pwd:IPALAB
I_NetLogonControl failed: Status = 1 0x1 ERROR_INVALID_FUNCTION
C:\Users\Administrator.WIN2K8R2.000>nltest.exe /sc_verify:IPALAB
Flags: b0 HAS_IP HAS_TIMESERV
Trusted DC Name \\wazwan.ipalab.qe
Trusted DC Connection Status Status = 0 0x0 NERR_Success
Trust Verification Status = 86 0x56 ERROR_INVALID_PASSWORD
The command completed successfully
C:\Users\Administrator.WIN2K8R2.000>nltest.exe /sc_change_pwd:IPALAB
I_NetLogonControl failed: Status = 1 0x1 ERROR_INVALID_FUNCTION
C:\Users\Administrator.WIN2K8R2.000>nltest.exe /dsgetdc:IPALAB
DC: \\WAZWAN
Address: \\10.65.201.162
Dom Guid: b6172dfd-6025-4ebb-9c7f-f06ac88f2716
Dom Name: IPALAB
Forest Name: ipalab.qe
Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_FOREST CLOSE_S
ITE
The command completed successfully
Im using latest available version of samba in this test samba4-4.0.0-55.el6.rc4.x86_64 ERROR_INVALID_FUNCTION very much looks like that the related call is either not implemented or somehow broken in the Samba IPA backend. I will check this during the next days and open bugs if needed, It should be fixed for FreeIPA but I think it's not a major issue. For verifying the the this fix a plain samba server with trust to the AD server is needed. Maybe Günther can give some instructions or give a link about how to set it up. Ok, for the change trust word path we can leave that for later. Its the sc_verify result that worries me. nltest.exe /sc_verify:IPALAB must not return ERROR_INVALID_PASSWORD. Regardless of what backend samba uses (e.g. ipasam or ldapsam). Steeve, can you re-setup the trust and only run the sc_verify command above? Steeve, running the "nltest.exe /sc_verify:IPALAB" command with a final Trust Verification Status = 0 0x0 NERR_Success is a sufficient prove the fix of this bug. Verified as per comments 4 and 8 Just to be 100% sure, you did also run the smbclient -S query successfully ? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0506.html |