Debian Bug report logs - #821811
samba: badlock patch breaks trust relationship

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Christian Kreidl <debian@chk.cksf.de>

To: submit@bugs.debian.org

Subject: samba: badlock patch breaks trust relationship

Date: Tue, 19 Apr 2016 15:54:17 +0200

Package: samba
Version: 2:3.6.6-6+deb7u9
Severity: grave

Hi!

Upgrading samba to version 2:3.6.6-6+deb7u9, containing the badlock patch, causes trust relationship
of Win7 domain members and samba PDC to fail. Users can't log in anymore.

Downgrading to the previous version 2:3.6.6-6+deb7u7 fixes the problem immediately, without
rejoining clients to the domain.

Samba error:
Apr 18 13:32:25 srv01 smbd[29622]:   _netr_ServerAuthenticate3: netlogon_creds_server_check failed.
Rejecting auth request from client pc02 machine account pc02$

Win7 message: "The trust relationship between this workstation and the primary domain failed"


See also these bug reports:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
https://bugzilla.redhat.com/show_bug.cgi?id=1326918

Thanks!

Christian

Message #10 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Michael Prokop <mika@debian.org>

To: Christian Kreidl <debian@chk.cksf.de>, 821811@bugs.debian.org

Subject: Re: Bug#821811: samba: badlock patch breaks trust relationship

Date: Wed, 20 Apr 2016 08:00:18 +0200

[Message part 1 (text/plain, inline)]

* Christian Kreidl [Tue Apr 19, 2016 at 03:54:17PM +0200]:

> Upgrading samba to version 2:3.6.6-6+deb7u9, containing the badlock patch, causes trust relationship
> of Win7 domain members and samba PDC to fail. Users can't log in anymore.

> Downgrading to the previous version 2:3.6.6-6+deb7u7 fixes the problem immediately, without
> rejoining clients to the domain.

> Samba error:
> Apr 18 13:32:25 srv01 smbd[29622]:   _netr_ServerAuthenticate3: netlogon_creds_server_check failed.
> Rejecting auth request from client pc02 machine account pc02$

> Win7 message: "The trust relationship between this workstation and the primary domain failed"

> See also these bug reports:
> https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
> https://bugzilla.redhat.com/show_bug.cgi?id=1326918

I can confirm this one:

| [2016/04/20 07:50:57.851691,  0] rpc_server/netlogon/srv_netlog_nt.c:976(_netr_ServerAuthenticate3)
|  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client FOOBAR0042 machine account FOOBAR0042$

Downgrading to 2:3.6.6-6+deb7u7 fixes the problem.

regards,
-mika-

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>

To: 821811@bugs.debian.org

Cc: Debian LTS <debian-lts@lists.debian.org>

Subject: Re: Bug#821811: samba: badlock patch breaks trust relationship

Date: Fri, 29 Apr 2016 14:55:43 +0200

[Message part 1 (text/plain, inline)]

Dear Samba maintainers,

Any updates about this bug?

LTS Team, anyone could help to handle it?

According to comment#17 in
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
Andreas Schneider prepared a fix for 3.6.25.

Cheers,

Santiago

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Marco Gaiarin <gaio@sv.lnf.it>

To: 821811@bugs.debian.org

Subject: Another confirmation...

Date: Fri, 6 May 2016 11:16:32 +0200

I manage some samba 3.6 network on wheezy, and i can confirm this bug:
i was forced to rollback to pre-badlock samba version, because, sooner
or later, all clients (windows 7 pro) refuse the user logon.

Error it is not everitime the same. I get (sorry for italian... damned
microsoft that translate log messages!):

 May  5 16:31:16 GIUSEPPE microsoft-windows-security-auditing[failure] 4625 Accesso di un account non riuscito.Soggetto:#011ID sicurezza:#011#011S-1-5-18#011Nome account:#011#011GIUSEPPE$#011Dominio account:#011#011ACPN#011ID accesso:#011#0110x3e7Tipo di accesso:#011#011#0117Account il cui accesso non <E8> riuscito:#011ID sicurezza:#011#011S-1-0-0#011Nome account:#011#011ramona#011Dominio account:#011#011ACPNInformazioni sull'errore:#011Motivo dell'errore:#011#011%2304#011Stato:#011#011#0110xc000018d#011Stato secondario:#011#0110x0Informazioni sul processo:#011ID processo chiamante:#0110x228#011Nome processo chiamante:C:\Windows\System32\lsass.exeInformazioni di rete:#011Nome workstation:#011GIUSEPPE#011Indirizzo di rete di origine:#011-#011Porta di origine:#011#011-Informazioni di autenticazione dettagliate:#011Processo di accesso:#011#011Negotiat#011Pacchetto di autenticazione:#011Negotiate#011Servizi transitati:#011-#011Nome pacchetto (solo NTLM):#011-#011Lunghezza chiave:#011#0110Questo evento viene generato quando una richiesta diaccesso non ha esito positivo. Viene generato nel computerin cui <E8> stato tentato l'accesso.Il campo Soggetto indica l'account nel sistema l
 May  5 16:31:16 GIUSEPPE netlogon[error] 3210 Autenticazione non riuscita con \\RITA, un controller didominio di Windows per il dominio ACPN, pertanto <E8>possibile che le richieste di accesso vengano negate.L<92>impossibilit<E0> di autenticare pu<F2> essere dovuta al mancatoriconoscimento di un altro computer connesso alla stessarete tramite lo stesso nome o la stessa password perl<92>account di questo computer. Se questo messaggio vienevisualizzato di nuovo, contattare l'amministratore disistema.

(eg, roughly 'trust relationshipt not valid'), but also:

 May  5 17:42:27 GIUSEPPE netlogon[error] 5783 L'installazione della sessione sul controller di dominio diWindows NT o di Windows 2000 \\RITA per il dominio ACPN nonrisponde.  La chiamata RPC corrente effettuata da Netlogonsu \\GIUSEPPE a \\RITA <E8> stata annullata.

(eg, roughly 'domain not found').


Note that if i remove the trust relationship on the workstation, and then i
rejoin it, the join work. But still there's no auth at subsequent
reboot (eg, join works but is ineffective).

I've tried all combination of:

	ntlm auth = 
	server signing = 
	client signing = 
	client ipc signing = 

but nothing work.


Thanks.

Message #35 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@orangeseeds.org>

To: Santiago Ruano Rincón <santiagorr@riseup.net>, 821811@bugs.debian.org

Cc: Debian LTS <debian-lts@lists.debian.org>, pkg-samba-maint@lists.alioth.debian.org

Subject: Re: Bug#821811: samba: badlock patch breaks trust relationship

Date: Wed, 18 May 2016 15:47:40 -0400

On 2016-04-29 08:55:43, Santiago Ruano Rincón wrote:
> Dear Samba maintainers,
>
> Any updates about this bug?
>
> LTS Team, anyone could help to handle it?
>
> According to comment#17 in
> https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
> Andreas Schneider prepared a fix for 3.6.25.

Hi again!

Should the LTS team prepare a regression update to the wheezy version at
least?

It seems things have been resolved on the Ubuntu side of things.

A.

-- 
We live in capitalism. Its power seems inescapable.  So did the divine
right of kings. Any human power can be resisted and changed by human
beings. Resistance and change often begin in art, and very often in
our art—the art of words. - Ursula Le Guin

Message #40 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Andrew Bartlett <abartlet@samba.org>

To: Antoine Beaupré <anarcat@orangeseeds.org>, 821811@bugs.debian.org, Santiago Ruano Rincón <santiagorr@riseup.net>

Cc: pkg-samba-maint@lists.alioth.debian.org, Debian LTS <debian-lts@lists.debian.org>

Subject: Re: [Pkg-samba-maint] Bug#821811: samba: badlock patch breaks trust relationship

Date: Mon, 23 May 2016 22:28:22 +1200

On Wed, 2016-05-18 at 15:47 -0400, Antoine Beaupré wrote:
> On 2016-04-29 08:55:43, Santiago Ruano Rincón wrote:
> > Dear Samba maintainers,
> > 
> > Any updates about this bug?
> > 
> > LTS Team, anyone could help to handle it?
> > 
> > According to comment#17 in
> > https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
> > Andreas Schneider prepared a fix for 3.6.25.
> 
> Hi again!
> 
> Should the LTS team prepare a regression update to the wheezy version
> at
> least?

That would be a good idea at this point.

I'm happy to review things, just not had the time to switch back on to
debian matters.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Message #45 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>

To: Andrew Bartlett <abartlet@samba.org>

Cc: 821811@bugs.debian.org, pkg-samba-maint@lists.alioth.debian.org, Debian LTS <debian-lts@lists.debian.org>, 820982@bugs.debian.org

Subject: Re: [Pkg-samba-maint] Bug#821811: samba: badlock patch breaks trust relationship

Date: Thu, 26 May 2016 11:40:19 +0200

[Message part 1 (text/plain, inline)]

El 23/05/16 a las 22:28, Andrew Bartlett escribió:
> On Wed, 2016-05-18 at 15:47 -0400, Antoine Beaupré wrote:
> > On 2016-04-29 08:55:43, Santiago Ruano Rincón wrote:
> > > Dear Samba maintainers,
> > > 
> > > Any updates about this bug?
> > > 
> > > LTS Team, anyone could help to handle it?
> > > 
> > > According to comment#17 in
> > > https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
> > > Andreas Schneider prepared a fix for 3.6.25.
> > 
> > Hi again!
> > 
> > Should the LTS team prepare a regression update to the wheezy version
> > at
> > least?
> 
> That would be a good idea at this point.
> 
> I'm happy to review things, just not had the time to switch back on to
> debian matters.
> 
> Andrew Bartlett

Hi,

To the current package in git, I have added some patches imported from
the Ubuntu package, versions 2:3.6.25-0ubuntu0.12.04.3 and
2:3.6.25-0ubuntu0.12.04.4. The debdiff is attached. Andrew, could you
please take a look on it? Also, test package is available at:

    deb https://people.debian.org/~santiago/debian santiago-wheezy/
    deb-src https://people.debian.org/~santiago/debian santiago-wheezy/

Please, test them. I don't have the infrastructure to actually verify
they solve the regressions. So, if somebody else would like to claim
this package, please do it!

Cheers,

Santiago

[samba_3.6.6-6+deb7u10~2.debdiff (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #50 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Vincent McIntyre <vincent.mcintyre@csiro.au>

To: 821811@bugs.debian.org

Subject: Re: Bug#821811: samba: badlock patch breaks trust relationship

Date: Thu, 9 Jun 2016 11:28:28 +1000

I can confirm that after downgrading these packages

   samba samba-common samba-common-bin libwbclient0 
     smbclient samba-tools

to version 2:3.6.6-6+deb7u7 and then upgrading with

   apt-get -t santiago-wheezy install samba samba-common \
    samba-common-bin libwbclient0 smbclient samba-tools

the system continued to work without issue; it remained joined to
the domain and users could connect as normal.

Note that this system was not running winbind, it was not installed.

Vince

Message #55 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Andrew Bartlett <abartlet@samba.org>

To: Santiago Ruano Rincón <santiagorr@riseup.net>, 821811@bugs.debian.org

Cc: pkg-samba-maint@lists.alioth.debian.org, Debian LTS <debian-lts@lists.debian.org>, 820982@bugs.debian.org

Subject: Re: Bug#821811: [Pkg-samba-maint] Bug#821811: samba: badlock patch breaks trust relationship

Date: Fri, 10 Jun 2016 09:03:11 +1200

[Message part 1 (text/plain, inline)]

On Thu, 2016-05-26 at 11:40 +0200, Santiago Ruano Rincón wrote:
> El 23/05/16 a las 22:28, Andrew Bartlett escribió:
> > 
> > On Wed, 2016-05-18 at 15:47 -0400, Antoine Beaupré wrote:
> > > 
> > > On 2016-04-29 08:55:43, Santiago Ruano Rincón wrote:
> > > > 
> > > > Dear Samba maintainers,
> > > > 
> > > > Any updates about this bug?
> > > > 
> > > > LTS Team, anyone could help to handle it?
> > > > 
> > > > According to comment#17 in
> > > > https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572122
> > > > Andreas Schneider prepared a fix for 3.6.25.
> > > Hi again!
> > > 
> > > Should the LTS team prepare a regression update to the wheezy
> > > version
> > > at
> > > least?
> > That would be a good idea at this point.
> > 
> > I'm happy to review things, just not had the time to switch back on
> > to
> > debian matters.
> > 
> > Andrew Bartlett
> Hi,
> 
> To the current package in git, I have added some patches imported
> from
> the Ubuntu package, versions 2:3.6.25-0ubuntu0.12.04.3 and
> 2:3.6.25-0ubuntu0.12.04.4. The debdiff is attached. Andrew, could you
> please take a look on it? Also, test package is available at:
> 
>     deb https://people.debian.org/~santiago/debian santiago-wheezy/
>     deb-src https://people.debian.org/~santiago/debian santiago-
> wheezy/
> 
> Please, test them. I don't have the infrastructure to actually verify
> they solve the regressions. So, if somebody else would like to claim
> this package, please do it!

Given that we have a confirmation that this addresses the issue, and
that the patches match the recommendations from upstream, I approve
this update.  Please go ahead and push it out.

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba

[signature.asc (application/pgp-signature, inline)]

Message #60 received at 821811@bugs.debian.org (full text, mbox, reply):

From: "C. Grill" <c.grill@ecka-granules.com>

To: 821811@bugs.debian.org

Subject: #821811 samba: badlock patch breaks trust relationship

Date: Fri, 10 Jun 2016 15:37:05 +0200

Hi,

upgrading the packages to 3.6.6-6+deb7u10 solved the above described issues.

thanks for the fix.

Regards,

Claus

Message #65 received at 821811-done@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: Vincent McIntyre <vincent.mcintyre@csiro.au>, 821811-done@bugs.debian.org

Subject: Re: [Pkg-samba-maint] Bug#821811: samba: badlock patch breaks trust relationship

Date: Sat, 11 Jun 2016 05:35:33 +0200

Version: 2:3.6.6-6+deb7u10

2016-06-09 3:28 GMT+02:00 Vincent McIntyre <vincent.mcintyre@csiro.au>:
> I can confirm that after downgrading these packages
>
>    samba samba-common samba-common-bin libwbclient0
>      smbclient samba-tools
>
> to version 2:3.6.6-6+deb7u7 and then upgrading with
>
>    apt-get -t santiago-wheezy install samba samba-common \
>     samba-common-bin libwbclient0 smbclient samba-tools
>
> the system continued to work without issue; it remained joined to
> the domain and users could connect as normal.
>
> Note that this system was not running winbind, it was not installed.


Thanks for your feedback. I'm closing this bug then.

Regards
-- 
Mathieu Parent

Message #70 received at 821811@bugs.debian.org (full text, mbox, reply):

From: Marco Gaiarin <gaio@sv.lnf.it>

To: 821811@bugs.debian.org

Subject: Still bug present... and 'client ipc signing' reported as not valid option...

Date: Thu, 23 Jun 2016 12:22:53 +0200

I've tried to update to latest version, 2:3.6.6-6+deb7u10, but as
previous version after some hours/days all client refuse to
authenticate users, seems to me because was not able to update the
machine account password (so join get invalid).

Also, a note, as stated in subject, testparm say me that 'client ipc
signing' is a invalid option, and this sound strange to me, because
that option are cited in changelog.


Anyway, rolled back to 2:3.6.6-6+deb7u7 (pre-badlock), now all work as
expected.


Thanks.

Send a report that this bug log contains spam.