1

After an upgrade Windows 7 clients are denied access to samba.

The OS is Debian wheezy. After the upgrade to samba 2:3.6.6-6+deb7u9 no Windows client can access. I see this in the logs:

rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3) _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client

Access to the windows share from linux clients using nautilus works fine.

I tried removing a PC from the domain and entering again. It is granted access to the domain but the users still can't log in.

Any hints ?

2
  • Unfortunately I've no answer too, but excatly the same problem. The reason is the current Windows update which fixes the badlock security hole.
    – user165737
    Apr 14, 2016 at 8:34
  • I fixed temporary downgrading to former samba. Go to /var/cache/apt/archives/ and type dpkg -i samba*u7_amd64.deb libwbclient0*u7_amd64.deb. It may need another old lib like libtalloc2. Add it to the dpkg -i as required. You can also download old packages from packages.debian.org/wheezy/samba
    – Francesc Guasch
    Apr 14, 2016 at 10:10

3 Answers 3

Reset to default
1

Thanks to Francesc Guasch, you pointed to into the right direction. There is a problem with package 7u9 for samba on wheezy that hopefully debian will find and fix it. At the moment, to fix the domain trust is to rollback your samba version to the previous version you had installed. Look into /var/log/apt/history.log to find exactly which packages you have upgrade. This is what i ran to fix my problem. Please change the version numbers below to match your logs.

apt-get install smbclient=2:3.6.6-6+deb7u7 \
    libwbclient0=2:3.6.6-6+deb7u7 \
    samba-common=2:3.6.6-6+deb7u7 \
    samba=2:3.6.6-6+deb7u7 \
    samba-common-bin=2:3.6.6-6+deb7u7 \
    winbind=2:3.6.6-6+deb7u7 libnss-winbind=2:3.6.6-6+deb7u7
1

Andrew Bartlett from Catalyst IT gave me the hint to install "winbind". You don't have to use nss_winbind or pam_winbind. Just running winbindd is enough.

Of course, this is not a real fix, but it worked for me on two machines and I don't have to downgrade to u7.

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820981 for details.

-1

I have the same problem. I use samba as domains controller and all windows clients were unable to login to domain today. Maybe this is some kind of regression with this update. I just did downgrade to deb7u7 version of these packages: libnss-winbind libpam-winbind libwbclient0 samba samba-common samba-common-bin smbclient winbind. Now I have working configuration, but I would like to see better solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .