Authentication Service, Mac & PC Management Service, Auditing and Monitoring Service
000001679
KB-1816: How to configure Samba to access share with CNAME or DNS alias
Applies to: All versions of Centrify-enabled Samba on all platforms
Question: You are able to access the samba share using localhost, but not able to access share with CNAME or an alias. Looking through the samba debug log, you will find similar error as below:
10] libads/kerberos_verify.c:ads_secrets_verify_ticket(302) ads_secrets_verify_ticket: enc type [3] failed to decrypt with error Bad encryption type 3] libads/kerberos_verify.c:ads_verify_ticket(477) ads_verify_ticket: krb5_rd_req with auth failed (Bad encryption type) 10] libads/kerberos_verify.c:ads_verify_ticket(486) ads_verify_ticket: returning error NT_STATUS_LOGON_FAILURE 1] smbd/sesssetup.c:reply_spnego_kerberos(350) Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE! 3] smbd/error.c:error_packet_set(61) error packet at smbd/sesssetup.c(352) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE
How do you configure Centrify agent to recognize the cname and able to access the samba share?
Answer: There are two options to fix the issue:
1) You can use the adkeytab command to add an spn by using the following syntax:
To verify, try running the adinfo --diag again will show:
Computer Account Diagnostics Joined as: nemo Key Version: 3 Service Principal Names: host/nemoalias.daniel-domain.com host/nemoalias nfs/nemo.daniel-domain.com nfs/nemo http/nemo.daniel-domain.com http/nemo host/nemo.daniel-domain.com host/nemo ftp/nemo.daniel-domain.com ftp/nemo cifs/nemo.daniel-domain.com cifs/nemo
Now, you will be able to access the samba share with cname.
or
2) For this option, you'd need to leave the domain by running adleave, then join it back to domain using --alias option with the cname. For example, run
adjoin -a nemoalias -z zone1 -u daniel.luu daniel-domain.com
Run adbindproxy.pl or adsamba.sh, depending on version, once more and try to access the share again. You might need to logout of Windows and login again to access the new samba share.