Prev: [Samba] weekly samba kerberos failure
Next: Preserve create/modify dates and attributes in samba
From: Jeremy Allison on 21 Jun 2010 15:50
On Mon, Jun 21, 2010 at 12:39:09PM -0400, Hong K Phooey wrote:
> We have a service on our windows system that drops files onto a samba share every 10 minutes. This has worked fine, except after one week, the system will fail. We usually restart samba and winbind on the linux side, and then restart the service on the windows box to resolve the issue.
>
> This week we decieded to let it fail, and after an hour it seemed to allow connections to the samba share. Here is the log file of the failures:
>
> 172.19.6.60 (172.19.6.60) closed connection to service lorian
> [2010/06/21 09:40:03, 1] smbd/sesssetup.c:342(reply_spnego_kerberos)
> Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
>
> This repeats every minute until 10:33 am, when the service was able to reconnect to the share.
>
> Is there a reason why this would fail every week at the same time? Do these settings have anything to do with the issue?
>
> Default: idmap cache time = 604800 (one week)
> Default: machine password timeout = 604800
>
> For the machine password timeout, is it necessary for it to update this often. Can it be set to only attempt once per year, longer?

You can stop it updating the machine password by setting
"machine password timeout = 0".

This looks like an issue with the machine account
password being changed.

Jeremy
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
From: John H Terpstra on 21 Jun 2010 16:10
On 06/21/2010 02:43 PM, Jeremy Allison wrote:
> On Mon, Jun 21, 2010 at 12:39:09PM -0400, Hong K Phooey wrote:
>> We have a service on our windows system that drops files onto a samba share every 10 minutes. This has worked fine, except after one week, the system will fail. We usually restart samba and winbind on the linux side, and then restart the service on the windows box to resolve the issue.
>>
>> This week we decieded to let it fail, and after an hour it seemed to allow connections to the samba share. Here is the log file of the failures:
>>
>> 172.19.6.60 (172.19.6.60) closed connection to service lorian
>> [2010/06/21 09:40:03, 1] smbd/sesssetup.c:342(reply_spnego_kerberos)
>> Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
>>
>> This repeats every minute until 10:33 am, when the service was able to reconnect to the share.
>>
>> Is there a reason why this would fail every week at the same time? Do these settings have anything to do with the issue?
>>
>> Default: idmap cache time = 604800 (one week)
>> Default: machine password timeout = 604800
>>
>> For the machine password timeout, is it necessary for it to update this often. Can it be set to only attempt once per year, longer?
>
> You can stop it updating the machine password by setting
> "machine password timeout = 0".
>
> This looks like an issue with the machine account
> password being changed.
>
> Jeremy

What version of samba are you using? I believe that a machine password
renewal bug was fixed in 3.5.3.

- John T.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
From: Hong K Phooey on 21 Jun 2010 16:40
----- Original Message -----
From: John H Terpstra <jht(a)samba.org>
Date: Monday, June 21, 2010 16:05
Subject: Re: [Samba] weekly samba kerberos failure
To: Hong K Phooey <hkp(a)insightbb.com>
Cc: Jeremy Allison <jra(a)samba.org>, samba(a)lists.samba.org

> On 06/21/2010 02:43 PM, Jeremy Allison wrote:
> > On Mon, Jun 21, 2010 at 12:39:09PM -0400, Hong K Phooey wrote:
> >> We have a service on our windows system that drops files onto
> a samba share every 10 minutes.  This has worked fine,
> except after one week, the system will fail.  We usually
> restart samba and winbind on the linux side, and then restart
> the service on the windows box to resolve the issue.
> >>
> >> This week we decieded to let it fail, and after an hour it
> seemed to allow connections to the samba share.  Here is
> the log file of the failures:
> >>
> >>   172.19.6.60 (172.19.6.60) closed connection to
> service lorian
> >> [2010/06/21 09:40:03,  1]
> smbd/sesssetup.c:342(reply_spnego_kerberos)>>   Failed
> to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
> >>
> >> This repeats every minute until 10:33 am, when the service
> was able to reconnect to the share.
> >>
> >> Is there a reason why this would fail every week at the same
> time?  Do these settings have anything to do with the
> issue? 
> >>
> >> Default: idmap cache time = 604800 (one week)
> >> Default: machine password timeout = 604800
> >>
> >> For the machine password timeout, is it necessary for it to
> update this often.  Can it be set to only attempt once per
> year, longer?
> >
> > You can stop it updating the machine password by setting
> > "machine password timeout = 0".
> >
> > This looks like an issue with the machine account
> > password being changed.
> >
> > Jeremy
>
> What version of samba are you using?  I believe that a
> machine password
> renewal bug was fixed in 3.5.3.
>
> - John T.

John,
We are using 3.4.7, so we are affected by the bug.

Jeremy,
Thanks very much for the update, after I sent the message this morning we dug into this a little further and did narrow it down to the "machine password timeout" setting. Thanks for confirming we can disable that setting by setting it to 0.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
 | 
Pages: 1
Prev: [Samba] weekly samba kerberos failure
Next: Preserve create/modify dates and attributes in samba