samba error: reply_spnego_kerberos: check_sacl([computer name here]) failed

[nicole30329]

We currently have a Windows 2K3 domain controller, and an OS X server as a file server. The server has been added via Open Directory, so we have a “magic triangle” type setup. Our clients are Windows XP and 10.4.8 Mac users.

Multiple times a day, my windows users get kicked off of the shares, and when they try to access them, they are prompted for a username/password (which shouldn’t happen). Even if they enter their username and password, it won’t let them in. But if they literally sit there and wait for 2 minutes, it resolves itself. I had it happen to me this morning, and I was able to track down what happened on the server log. I will paste it below. But I will say that I’ve searched this forum and one other person has had the exact same thing occur, and someone suggested that he lengthen the life of the Kerberos sessions on the server. I opened the Kerberos app on the server end, but there aren’t any tickets showing, despite the fact that there are at least 20+ windows clients currently active.

How can I lengthen the life of my Windows users’ Kerberos tickets (if that is the resolution)?

Here is the log from my session this morning:

[2007/02/14 09:25:33, 2] /SourceCache/samba/samba-100.5/samba/source/lib/module.c:do_smb_load_module(63)
Module ‘/usr/lib/samba/vfs/darwin_acls.so’ loaded
[2007/02/14 09:25:33, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/service.c:make_connection_snum(648)
10.104.17.203 (10.104.17.203) connect to service Public initially as user ANTFARM\nhamilton (uid=243202915, gid=1910073968) (pid 11798)
[2007/02/14 09:25:35, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/service.c:make_connection_snum(648)
10.104.17.203 (10.104.17.203) connect to service IT initially as user ANTFARM\nhamilton (uid=243202915, gid=1910073968) (pid 11798)
[2007/02/14 09:25:36, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(261)
Username ANTFARM\IT-NHAMILTONP$ is invalid on this system
[2007/02/14 09:25:36, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(265)
Lookup trust account via passdb (ANTFARM\IT-NHAMILTONP$)
[2007/02/14 09:25:36, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(271)
trust account found via passdb fullname(IT-NHAMILTONP)
[2007/02/14 09:25:36, 1] pdb_ods.c:odssam_getgrgid(2870)
odssam_getgrgid: gid [99]
[2007/02/14 09:25:36, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(333)
reply_spnego_kerberos: check_sacl(ANTFARM\IT-NHAMILTONP$, smb) failed
[2007/02/14 09:25:38, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/service.c:make_connection_snum(648)
10.104.17.203 (10.104.17.203) connect to service CREATIVE initially as user ANTFARM\nhamilton (uid=243202915, gid=1910073968) (pid 11798)
[2007/02/14 09:25:38, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(261)
Username ANTFARM\IT-NHAMILTONP$ is invalid on this system
[2007/02/14 09:25:38, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(265)
Lookup trust account via passdb (ANTFARM\IT-NHAMILTONP$)
[2007/02/14 09:25:38, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(271)
trust account found via passdb fullname(IT-NHAMILTONP)
[2007/02/14 09:25:38, 1] /SourceCache/samba/samba-100.5/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(333)
reply_spnego_kerberos: check_sacl(ANTFARM\IT-NHAMILTONP$, smb) failed
[2007/02/14 09:25:47, 0] /SourceCache/samba/samba-100.5/samba/source/lib/util_sock.c:get_peer_addr(1016)
getpeername failed. Error was Socket is not connected
[2007/02/14 09:25:47, 2] /SourceCache/samba/samba-100.5/samba/source/passdb/pdb_interface.c:make_pdb_methods_name(654)
No builtin backend found, trying to load plugin
[2007/02/14 09:25:47, 2] /SourceCache/samba/samba-100.5/samba/source/passdb/pdb_interface.c:make_pdb_methods_name(654)
No builtin backend found, trying to load plugin
[2007/02/14 09:25:47, 2] /SourceCache/samba/samba-100.5/samba/source/lib/module.c:do_smb_load_module(63)
Module ‘/usr/lib/samba/pdb/opendirectorysam.so’ loaded
[2007/02/14 09:25:47, 2] /SourceCache/samba/samba-100.5/samba/source/lib/module.c:do_smb_load_module(63)
Module ‘/usr/lib/samba/pdb/opendirectorysam.so’ loaded
[2007/02/14 09:25:47, 2] /SourceCache/samba/samba-100.5/sam

[nicole30329]

Ok I figured it out. Access on the OS X server was set for NTLMv2 & Kerberos only.
Stinkin’ XP is set for NTLM and LM by default. Once I enabled NTLM on the OS X server, I haven’t received any more complaints regarding disconnects, and I personally haven’t experienced it either.

To answer your questions thought, our network is very simple. We have one OS X server for file sharing/storage, and the permissions are very simple. The OSX server is set for “Connected to a Directory System” and we use the single login method, which actually works quite well now that this glitch has been fixed.

[Author]

Posts