Re: SPNEGO questions

Hi Andrews,

At 03.18 28/10/2005, Andrew Bartlett wrote:

>This was a regression. I've fixed this now.

Some news:

I can confirm to you that the SPN problem is fixed, the Samba 4
machine was joined fine to the domain, and now I am able to see the
list of the shares from a Windows 2000 machine, but I cannot connect
to any share. There is something like Samba 3 'username map' in Samba 4 ?

Another question, the SPNs created from net join are:

C:\>setspn -L vm-sarge
Registered ServicePrincipalNames for
CN=VM-SARGE,CN=Computers,DC=acmeconsulting,DC=loc:
     host/vm-sarge/ACMECONSULTING
     host/vm-sarge.acmeconsulting.loc/ACMECONSULTING
     host/vm-sarge/acmeconsulting.loc
     host/vm-sarge.acmeconsulting.loc/acmeconsulting.loc
     host/vm-sarge
     host/vm-sarge.acmeconsulting.loc

The first four are correct ?

I have tried to use Squid with ntlm_auth and Negotiate (gss-spnego), but ....

Unable to open tdb '/usr/local/samba/private/secrets.ldb'
Failed to connect to '/usr/local/samba/private/secrets.ldb'
Could not open secrets.ldb
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
INTERNAL ERROR: Signal 11 in pid 29489 (3.9.0-SVN-build-11442)
Please read the file BUGS.txt in the distribution
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
PANIC: internal error
BACKTRACE: 16 stack frames:
  #0 (ntlm_auth) [0x81f5c03]
  #1 (ntlm_auth) [0x81f5e4e]
  #2 (ntlm_auth) [0x81f5f1c]
  #3 (ntlm_auth) [0x81f5f5c]
  #4 [0xffffe420]
  #5 (ntlm_auth) [0x818c428]
  #6 (ntlm_auth) [0x818c645]
  #7 (ntlm_auth) [0x8248f18]
  #8 (ntlm_auth) [0x8249a5b]
  #9 (ntlm_auth) [0x818cc82]
  #10 (ntlm_auth) [0x804ee97]
  #11 (ntlm_auth) [0x8050058]
  #12 (ntlm_auth) [0x80500be]
  #13 (ntlm_auth) [0x80506e8]
  #14 /lib/tls/libc.so.6(__libc_start_main+0xf4) [0x40078974]
  #15 (ntlm_auth) [0x804e041]

A similar thing happens trying basic auth from command line:

vm-sarge:/usr/local/samba# ntlm_auth
--helper-protocol=squid-2.5-basic --debuglevel=10
Initialising global parameters
lp_load: refreshing parameters from /usr/local/samba/lib/smb.conf
params.c:pm_process() - Processing configuration file
"/usr/local/samba/lib/smb.conf"
Processing section "[globals]"
pm_process() returned Yes
adding hidden service IPC$
adding hidden service ADMIN$
added interface ip=172.30.128.13 bcast=172.30.128.255 nmask=255.255.255.0
AUTH backend 'sam' registered
AUTH backend 'sam_ignoredomain' registered
AUTH backend 'winbind' registered
GENSEC backend 'krb5' registered
gensec subsystem fake_gssapi_krb5 is disabled
AUTH backend 'unix' registered
GENSEC backend 'schannel' registered
AUTH backend 'name_to_ntstatus' registered
AUTH backend 'fixed_challenge' registered
GENSEC backend 'spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'ntlmssp' registered
AUTH backend 'anonymous' registered
pippo pippo
Got 'pippo pippo' from squid (length: 11).
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
INTERNAL ERROR: Signal 11 in pid 29503 (3.9.0-SVN-build-11442)
Please read the file BUGS.txt in the distribution
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
PANIC: internal error
BACKTRACE: 12 stack frames:
  #0 ntlm_auth [0x81f5c03]
  #1 ntlm_auth [0x81f5e4e]
  #2 ntlm_auth [0x81f5f1c]
  #3 ntlm_auth [0x81f5f5c]
  #4 [0xffffe420]
  #5 ntlm_auth [0x804e202]
  #6 ntlm_auth [0x804e462]
  #7 ntlm_auth [0x8050058]
  #8 ntlm_auth [0x80500be]
  #9 ntlm_auth [0x80506e8]
  #10 /lib/tls/libc.so.6(__libc_start_main+0xf4) [0x40078974]
  #11 ntlm_auth [0x804e041]
Aborted

Regards

Guido

-
========================================================
Guido Serassio
Acme Consulting S.r.l. - Microsoft Certified Partner
Via Lucia Savarino, 1 10098 - Rivoli (TO) - ITALY
Tel. : +39.011.9530135 Fax. : +39.011.9781115
Email: guido.serassio@acmeconsulting.it
WWW: http://www.acmeconsulting.it/
Received on Tue Nov 01 2005 - 10:38:22 MST