Can not authenticate on Windows after upgrading samba AD packages to version 2:4.13.17~dfsg-0ubuntu1.20.04.4

[r0mulux]

Starting from a working samba (2:4.13.17~dfsg-0ubuntu1.20.04.2) AD on Ubuntu focal with "server role = active directory domain controller" and windows 10 computers joined to domain, users in samba can authenticate on windows sessions.

1. Upgrade samba packages to 2:4.13.17~dfsg-0ubuntu1.20.04.4
2. Reboot windows computers
3. Create a new user in samba
4. Authentication fails on windows with created account

Note : if packages are downgraded to version 2:4.13.17~dfsg-0ubuntu1.20.04.2 and windows is reboot, authentication works again. All the steps (upgrade and downgrade) have been reproduced on several and separated Ubuntu focal servers with several Windows 10 computers (22H2 or 21H2) with same behavior.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Tom (tomjudge)]

Also seeing this regression, but can't find a way to downgrade to 2:4.13.17~dfsg-0ubuntu1.20.04.2

[r0mulux (r-marie)]

@tomjudge: indeed, packages 2:4.13.17~dfsg-0ubuntu1.20.04.2 was still available on http://archive.ubuntu.com/ubuntu/pool/main/s/samba/ yesterday, but not today.

[John Runyon (dimecadmiu)]

Well, this was a fun way to spend ~10 hours debugging something.

This worked for me, YMMV
apt-get install samba=2:4.11.6+dfsg-0ubuntu1 samba-common=2:4.11.6+dfsg-0ubuntu1 samba-common-bin=2:4.11.6+dfsg-0ubuntu1 libwbclient0=2:4.11.6+dfsg-0ubuntu1 samba-libs=2:4.11.6+dfsg-0ubuntu1 python3-samba=2:4.11.6+dfsg-0ubuntu1 samba-dsdb-modules=2:4.11.6+dfsg-0ubuntu1 samba-vfs-modules=2:4.11.6+dfsg-0ubuntu1 libldb2=2:2.0.8-2 python3-ldb=2:2.0.8-2 smbclient=2:4.11.6+dfsg-0ubuntu1 winbind=2:4.11.6+dfsg-0ubuntu1 libsmbclient=2:4.11.6+dfsg-0ubuntu1 libnss-winbind=2:4.11.6+dfsg-0ubuntu1 libpam-winbind=2:4.11.6+dfsg-0ubuntu1

[Marc Deslauriers (mdeslaur)]

Do you have any logs of the failures you were seeing?

[r0mulux (r-marie)]

Yes, in attached file "smb_fail.txt", logs from /var/log/samba/log.samba when authentication fails (samba 2:4.13.17~dfsg-0ubuntu1.20.04.4), "log level = 3" in "[global]" in /etc/samba/smb.conf

[r0mulux (r-marie)]

Same logs when authentication succeeds with samba 2:4.13.17~dfsg-0ubuntu1.20.04.2

[r0mulux (r-marie)]

When authentication fails, I can see errors in Security section of Windows Event Viewer related to "Negotiate"

[Mirco Vivaldi (mirco-vivaldi)]

With my Samba 4, I get the same issue.
Is there a quick fix to eliminate the problem? or is downgrading the packages the only option?

Thank you

[Marc Deslauriers (mdeslaur)]

I will be releasing an update later today with the security fixes reverted until we track down the regression.

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 2:4.13.17~dfsg-0ubuntu1.20.04.5

---------------
samba (2:4.13.17~dfsg-0ubuntu1.20.04.5) focal-security; urgency=medium

  * SECURITY UPDATE: Multiple regressions (LP: #2003867) (LP: #2003891)
    - debian/patches/series: disable all security fixes from the previous
      update pending further investigation. This reverts the following
      CVEs: CVE-2022-3437, CVE-2022-42898, CVE-2022-45141, CVE-2022-38023,
      CVE-2022-37966, CVE-2022-37967.

 -- Marc Deslauriers <email address hidden> Thu, 26 Jan 2023 09:03:40 -0500

[Marc Deslauriers (mdeslaur)]

I have reverted the update for now, but am reopening this bug so we can fix the regression and publish a new update soon.

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 2:4.13.17~dfsg-0ubuntu1.20.04.5

---------------
samba (2:4.13.17~dfsg-0ubuntu1.20.04.5) focal-security; urgency=medium

  * SECURITY UPDATE: Multiple regressions (LP: #2003867) (LP: #2003891)
    - debian/patches/series: disable all security fixes from the previous
      update pending further investigation. This reverts the following
      CVEs: CVE-2022-3437, CVE-2022-42898, CVE-2022-45141, CVE-2022-38023,
      CVE-2022-37966, CVE-2022-37967.

 -- Marc Deslauriers <email address hidden> Thu, 26 Jan 2023 09:03:40 -0500

[r0mulux (r-marie)]

I have updated to 2:4.13.17~dfsg-0ubuntu1.20.04.5 and I confirm it fixes the bug.

[Marc Deslauriers (mdeslaur)]

Reopening this bug to track the progress in locating the regression.

[Marc Deslauriers (mdeslaur)]

The following update that was published today should fix the security issues without reintroducing this bug:

https://ubuntu.com/security/notices/USN-5936-1

I am closing this bug, if the issue persists with the new version, please don't hesitate to reopen it again.