I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine.
Here's Samba's log of the error (I've replaced the name of my domain for privacy):
[2014/07/04 15:09:48.437798, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ Administrator@mydomain.com from ipv4:10.8.0.14:36394 for krbtgt/mydomain.com@mydomain.com
[2014/07/04 15:09:48.442161, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: 128
[2014/07/04 15:09:48.442329, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PK-INIT(ietf) pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442438, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PK-INIT(win2k) pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442539, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- Administrator@mydomain.com
[2014/07/04 15:09:48.442658, 3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
[2014/07/04 15:09:48.535053, 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/07/04 15:09:48.535219, 3] ../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
However, if I try to login locally, there's no problem:
# smbclient //localhost/netlogon -U Administrator
Enter Administrator's password:
Domain=[MYDOMAIN] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
smb: \> ls
. D 0 Mon May 26 12:54:45 2014
.. D 0 Mon May 26 12:56:28 2014
36484 blocks of size 8388608. 27650 blocks available
smb: \>
# kinit
Password for administrator@MYDOMAIN.COM:
Warning: Your password will expire in 5 days on jue 10 jul 2014 14:47:07 ART
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@MYDOMAIN.COM
Valid starting Expires Service principal
04/07/14 16:38:31 05/07/14 02:38:31 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
renew until 05/07/14 16:38:24
What can be the problem? What does the error "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ" mean?
Here's some additional information that could be important.
- I installed Samba 4 following this guide: https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO
- I followed this other guide to try to configure the Windows client, and took into account the date/time syncronization between client and server.
Information about the Server:
- OS: Ubuntu Server 14.04
- Samba version: 4.1.6-Ubuntu
- Kerberos version: Kerberos 5 release 1.12
Contents of smb.conf
# Global parameters
[global]
workgroup = MYDOMAIN
realm = MYDOMAIN.COM
netbios name = COLLIE
server role = active directory domain controller
dns forwarder = 10.1.1.1
idmap_ldb:use rfc2307 = yes
log level = 3
[netlogon]
path = /var/lib/samba/sysvol/huntmob.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
# Sharing general
[files]
path = /var/lib/samba/usershares/files
read only = no
[todos]
path = /var/lib/samba/usershares/todos
read only = no
[dbox]
path = /var/lib/samba/usershares/dbox
read only = no
Information about the Windows client
During this installation stage I'm working with a Virtual Machine running Windows 7 Professional, which is hosted by a Kubuntu box which connects through a VPN to the office where the Samba server is.
I know this is a little messed up but it's just for this stage, the Samba server will only serve local Windows machines. However, I don't think that this is what's causing the problem, since the Window box seems to be reaching the Samba server just fine.