I have recently come across a problem I have been unable to resolve. I have been running Samba with Winbind ADS authentication for the last couple of years with good success until recently. About 2 weeks ago, I restarted the Samba and Winbind services on a Fedora Core 3 machine runing Samba 3.0.10-1 (installed from FC3 RPMs) and the active directory authentication has started failing.
The environment is two domains sitting in separate forests: cit.univ.edu and dept.univ.edu. (These are separate active directory forests because that is the environment dictated by the university central IT. Cit.univ.edu is also a disjoined domain where all the computers for the domain sit in the univ.edu DNS zone.) There is a one way trust so the dept domain can use the cit domain for user authentication to computer resources in the dept domain. (The domain controllers for DEPT.UNIV.EDU are DCA.DEPT.UNIV.EDU and DCB.DEPT.UNIV.EDU. The domain controllers for UNIV.EDU are DC1.UNIV.EDU, DC2.UNIV.EDU, DC3.UNIV.EDU, and DC4.UNIV.EDU. The Samba server in the domain DEPT.UNIV.EDU is SAMBA.DEPT.UNIV.EDU.)
The last time I can verify everything was working correctly was about two months ago when the Samba server was last rebooted. The krb5.conf that was working at the time is
[logging]And Samba/Winbind was configured with the following:
security = adsAs of a couple of weeks ago, my Samba servers are still able to connect to the dept.univ.edu domain but unable to connect to the cit.univ.edu domain. The command "wbinfo -g --domain UNIV" now results in a "Error looking up domain groups" error and
[2006/10/12 15:07:58, 1] libsmb/clikrb5.c:ads_krb5_mk_req(390)in the winbind.log file.
So far, my searches for a resolution to the problem have suggested a problem in correctly resolving the host name for the domain controllers. On the host involved, the gethostbyname function correctly returns the appropriate IP address for dc1.univ.edu and the reverse lookup, with gethostbyaddr, of that IP address returns dc1.univ.edu. (I don't manage dc1.univ.edu but those who do tell me the machine itself believes its name is also dc1.univ.edu. Unfortunately I can't check dc1.univ.edu to make sure it is correctly resolving dca.dept.univ.edu or samba.dept.univ.edu.)
The authentication for Windows XP and Windows 2003 machines still works correctly. I have also been having this same problem with a new server on which I installed CentOS 4.4 (with all the updates) using either Samba 3.0.10-1 from the CentOS repository or 3.0.23c installed from source downloaded from samba.org.
I have also tried the following krb5.conf with no luck:
[logging]The Fedora Core 3 (existing) machine is running kernel version 2.6.11-1.27_FC3smp, krb5-libs version 1.3.6-5, and Samba version 3.0.10-1 installed. (All installed from FC3 RPMs.)
The CentOS 4.4 (new) machine is running kernel version 2.6.9-42EL, krb5-libs version 1.3.4-33, and Samba 3.0.10-1.4E9 installed. (Again, all installed from CentOS RPMs. However, as mentioned above, I am also seeing this problem with Samba 3.0.23c installed from source on this machine.)
Any suggestions that would point me in the right direction to resolve this problem would be greatly appreciated.