[SRU] [karmic] Authentication failure from Windows 7 when domain joined.

Bug #462626 reported by Chuck Short on 2009-10-28
16
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Release Notes for Ubuntu
Undecided
Chuck Short
samba
Fix Released
Critical
samba (Ubuntu)
Medium
Chuck Short
Karmic
Medium
Chuck Short
Lucid
Medium
Chuck Short

Bug Description

Binary package hint: samba

When authenticating to a domain joined samba server with NTLMv2 from a Windows 7 client, a valid password is being denied. The same request succeeded with NTLMv1. The key to this repro is accessing the server via a hostname so Windows 7 adds a SPN to the target information section of the NTLMv2 Response.

=================
Karmic release notes:

Windows 7 systems not authenticating to Karmic samba domain controllers

After upgrading a samba domain controller to Karmic Windows 7 domain members will not be able to authenticate to the domain controller even if they had their registry settings modified prior to joining the Samba Domain (as outlined in http://wiki.samba.org/index.php/Windows7). A fix for this issue is expected to be provided in a post-release update immediately after the Ubuntu 9.10 release (462626).

=================

Thierry Carrez (ttx) on 2009-10-28
Changed in samba (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
Chuck Short (zulcss) on 2009-10-28
Changed in samba (Ubuntu):
assignee: nobody → Chuck Short (zulcss)
Chuck Short (zulcss) on 2009-10-28
summary: - [karmic] Authentication failure from Windows 7 when domain joined.
+ [SRU] [karmic] Authentication failure from Windows 7 when domain joined.
Chuck Short (zulcss) wrote :

Statement of Impact:

Karmic shipped with a bug that prevents Windows 7 clients from authenticating against a Windows Domain. More information can be found at:

https://bugzilla.samba.org/show_bug.cgi?id=6680

How this bug has been addressed:

This bug has been fixed in samba 3.4.1 and I have back ported the fix to 3.4.0. I have attached the patch which fixes this issue.

Steps to Reproduce:

1. Install samba
2. Install Windows 7
3. Have it join a windows domain

If you have any questions please let me know.

Chuck Short (zulcss) wrote :
Chuck Short (zulcss) on 2009-10-28
Changed in ubuntu-release-notes:
assignee: nobody → Chuck Short (zulcss)
Chuck Short (zulcss) wrote :

Release note:

After upgrading samba to 3.4.0, users using Windows 7 will not be able to authenicate to a Windows domain. The work around is:

http://wiki.samba.org/index.php/Windows7

A fix for this issue is expected to be provided in a post-release update immediately after the Ubuntu 9.10 release.

Mathias Gug (mathiaz) on 2009-10-28
description: updated
Changed in ubuntu-release-notes:
status: New → Fix Committed
Martin Pitt (pitti) wrote :

I reviewed the package in -proposed, approved. Will accept right after karmic release.

(Note, I'd appreciate if you review patches after generating. This one again has an .orig file in it)

Changed in samba (Ubuntu Karmic):
status: Triaged → Fix Committed
Steve Langasek (vorlon) wrote :

Documented at <https://wiki.ubuntu.com/KarmicKoala/ReleaseNotes#Windows%207%20domain%20member%20fails%20to%20authenticate%20to%20Ubuntu%209.10%20Samba%20domain%20controller>:

After upgrading a Samba domain controller to Ubuntu 9.10, Windows 7 domain members will not be able to authenticate to it even if their registry settings were modified as outlined in [[http://wiki.samba.org/index.php/Windows7]] prior to joining the Samba domain. A fix for this issue will be provided in a post-release update immediately after the Ubuntu 9.10 release. (Bug:541411)

Changed in ubuntu-release-notes:
status: Fix Committed → Fix Released
description: updated
Martin Pitt (pitti) wrote :

Accepted samba into karmic-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: added: verification-needed
Changed in samba:
status: Unknown → Fix Released
Martin Pitt (pitti) wrote :

Can't copy karmic-proposed to lucid since lucid has a never version. Chuck, please apply the patch there as well. Thanks!

Changed in samba (Ubuntu Lucid):
milestone: none → lucid-alpha-1
Chuck Short (zulcss) wrote :

This should already be fixed for lucid.

Regards
chuck

Changed in samba (Ubuntu Lucid):
status: Fix Committed → Fix Released
Steve Langasek (vorlon) wrote :

Can someone please confirm that the package in karmic-proposed fixes this issue? I would like to also get an SRU in for bug #462169, and ideally we would publish -3ubuntu5.1 to -updates first.

Danyi Dávid (yv) wrote :

I've installed the samba packages(3.4.0-3ubuntu5.1) from karmic-proposed yesterday, and sadly it didn't improve anything at all.
I could join the domain with the client(I could do that with the version released in karmic too though), but the user login still fails with the error: "The trust relationship between this workstation and the primary domain failed."

Leaving the domain, deleting the machine account and then rejoining the domain didn't help either.

Danyi Dávid (yv) wrote :

My mistake.

I've previously edited two additional keys under the NetLogon section, that were mentioned a howto before. Seems it doesn't work that way anymore. After reseting those keys back to their original value domain logon works again as before in jaunty, so the release in karmic-proposed _did_ fix the issue.

Martin Pitt (pitti) wrote :

Thanks for testing!

tags: added: hw-specifc
tags: added: verification-done
removed: hw-specifc verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package samba - 2:3.4.0-3ubuntu5.1

---------------
samba (2:3.4.0-3ubuntu5.1) karmic-proposed; urgency=low

  * debian/patches/fix-smbclient-long-names.patch: Samba shares with more than 12 characters are not
    displayed. (LP: #449735)
  * debian/patches/fix-upstream-6680.patch: Fix Windows 7 computers joining a domain. Without
    this patch users will have to apply a registry hack to have their Windows 7 computers
    join a Windows Domain [http://wiki.samba.org/index.php/Windows7] (LP: #462626)

 -- Chuck Short <email address hidden> Tue, 27 Oct 2009 21:04:53 -0400

Changed in samba (Ubuntu Karmic):
status: Fix Committed → Fix Released
obitori (junk-taiotoshi) wrote :

I am still experiencing the problem outlined in the 8.10 release. Is it fixed? If so, could you provide more specific information on how to switch to authentication with NTLMv1 and how to add an SPN via use of a hostname?

Thanks!

obitori (junk-taiotoshi) wrote :

Sorry. I meant 9.10 release.

Changed in samba:
importance: Unknown → Critical
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.