samba netlogon_creds_server_check failed. Rejecting auth request from client

Question

After an upgrade Windows 7 clients are denied access to samba.

The OS is Debian wheezy. After the upgrade to samba 2:3.6.6-6+deb7u9 no Windows client can access. I see this in the logs:

rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3) _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client

Access to the windows share from linux clients using nautilus works fine.

I tried removing a PC from the domain and entering again. It is granted access to the domain but the users still can't log in.

Any hints ?

Answer 1

Thanks to Francesc Guasch, you pointed to into the right direction. There is a problem with package 7u9 for samba on wheezy that hopefully debian will find and fix it. At the moment, to fix the domain trust is to rollback your samba version to the previous version you had installed. Look into /var/log/apt/history.log to find exactly which packages you have upgrade. This is what i ran to fix my problem. Please change the version numbers below to match your logs.

apt-get install smbclient=2:3.6.6-6+deb7u7 \
    libwbclient0=2:3.6.6-6+deb7u7 \
    samba-common=2:3.6.6-6+deb7u7 \
    samba=2:3.6.6-6+deb7u7 \
    samba-common-bin=2:3.6.6-6+deb7u7 \
    winbind=2:3.6.6-6+deb7u7 libnss-winbind=2:3.6.6-6+deb7u7

Answer 2

Andrew Bartlett from Catalyst IT gave me the hint to install "winbind". You don't have to use nss_winbind or pam_winbind. Just running winbindd is enough.

Of course, this is not a real fix, but it worked for me on two machines and I don't have to downgrade to u7.

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820981 for details.

Answer 3

I have the same problem. I use samba as domains controller and all windows clients were unable to login to domain today. Maybe this is some kind of regression with this update. I just did downgrade to deb7u7 version of these packages: libnss-winbind libpam-winbind libwbclient0 samba samba-common samba-common-bin smbclient winbind. Now I have working configuration, but I would like to see better solution.