Domain admin can't access shares after update

Support
, ,
1

NethServer Version: 7.9.2009 (final)
Module: FileServer

Hi I did a pretty huge update over the weekened and since then the windows domain admin is unable to access all the shares.

All other acls and users are working perfectly so I supect it may be samba config file that’s been over written, (I vaguely remember having to do something to do with making linux root and domain admin equivalent not sure if that is connected).

Under normal circumstances I’d restore the backup but this server is in pretty much constant use so if I can do it without that that would be preferrable.

2

A bit more info if I try to connect as admin using domain admin credentials I get:

lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section “[global]”
directory_create_or_exist_strict: invalid ownership on directory /var/run/samba/msg.lock
cmdline_messaging_context: Unable to initialize messaging context.
Unable to initialize messaging context
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section “[global]”
added interface ens192 ip=192.168.0.89 bcast=192.168.1.255 netmask=255.255.254.0
Client started (version 4.9.5-Debian).
Connecting to 192.168.0.22 at port 445
got OID=1.2.840.48018.1.2.2
Enter administrator@sonifex.local’s password:
GENSEC backend ‘gssapi_spnego’ registered
GENSEC backend ‘gssapi_krb5’ registered
GENSEC backend ‘gssapi_krb5_sasl’ registered
GENSEC backend ‘spnego’ registered
GENSEC backend ‘schannel’ registered
GENSEC backend ‘naclrpc_as_system’ registered
GENSEC backend ‘sasl-EXTERNAL’ registered
GENSEC backend ‘ntlmssp’ registered
GENSEC backend ‘ntlmssp_resume_ccache’ registered
GENSEC backend ‘http_basic’ registered
GENSEC backend ‘http_ntlm’ registered
GENSEC backend ‘http_negotiate’ registered
GENSEC backend ‘krb5’ registered
GENSEC backend ‘fake_gssapi_krb5’ registered
Cannot do GSE to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
SPNEGO login failed: The token representing the data is invalid or expired.
session setup failed: NT_STATUS_INVALID_TOKEN

3

Did you enable “Grant full control on shared folders to Domain Admins group” in the file server settings?

2 Likes
4

Hi Sorry for the late reply, just checked this and no it wasn’t checked but unfortunately changing it didn’t appear to make any difference.

5

Could you share the list of involved packages and the old an new version numbers?

The yum history command should remember all those details.

If this is true, running this command could fix them

 signal-event nethserver-samba-update
6

Hi David I tried the samba update bu didn;t work unfortunately my yum history just shows:

Loaded plugins: changelog, fastestmirror, nethserver_events
ID | Command line | Date and time | Action(s) | Altered

24 |                          | 2022-09-29 20:59 | I, O, U        |  165 EE
23 | install nethserver-cront | 2022-09-27 09:48 | Install        |    1
22 | install inotify-tools    | 2021-12-14 15:23 | Install        |    1
21 | -y install clamav clamav | 2021-12-14 15:20 | I, U           |   21
20 | -y install epel-release  | 2021-12-14 15:12 | Update         |    1
19 | remove klnagent64        | 2021-12-08 09:36 | Erase          |    1 EE
18 | remove kesl.x86_64       | 2021-12-08 09:35 | Erase          |    1 EE
17 | install kesl-11.2.0-4528 | 2021-12-07 13:20 | Install        |    1 EE
16 | install klnagent64-12.0. | 2021-12-07 13:13 | Install        |    1 EE
15 | install nano             | 2021-09-16 15:44 | Install        |    1
14 | install nethserver-nfs   | 2021-09-15 09:44 | Install        |    2
13 | install http://mirror.de | 2021-09-15 09:42 | Install        |    1
12 | update -y * @nethserver- | 2021-05-21 23:07 | I, O, U        |  250 EE
11 | update -y * @nethserver- | 2021-05-21 22:53 | I, O, U        |  257 EE
10 |                          | 2021-05-21 22:51 |                |    0
 9 |                          | 2021-05-21 22:49 | O, U           |   36
 8 |                          | 2021-05-21 09:06 | Install        |    2
 7 | install zabbix-agent     | 2021-02-17 14:14 | Install        |    1  <
 6 | install open-vm-tools    | 2020-04-17 11:36 | Install        |    8 >
 5 |                          | 2020-04-06 09:36 | Update         |    1

Which is a bit surpirising because the update manager showed 154 packages to upgrade.

7

I’ve restored the data to a fresh install and then re-added all of my custom e-smith config etc and all seems good… very strange.

I did have some extra repos and applications whihc I never got around to fully confug

That said it fixes my problem so I’ll just replace the orignal VM with new one, am I right in thinking I just need to disconnect it from the domain to change the FQDN?

8

Tried it now all good do I’ll mark this as resolved ass there really doesn’t seem much point messing about with it now.