[14842] in Kerberos
RE: XP Client Trying to use Kerberos instead of SMB to Samba Serv
daemon@ATHENA.MIT.EDU (Mayers, Philip J)
Tue Jul 31 10:51:57 2001
Message-ID: <A0F836836670D41183A800508BAF190B35E8C2@icex1.cc.ic.ac.uk>
From: "Mayers, Philip J" <p.mayers@ic.ac.uk>
To: "'Don Hiscock'" <dhiscock@ssbux1.env.gov.bc.ca>, kerberos@mit.edu
Cc: "'samba-technical@samba.org'" <samba-technical@samba.org>
Date: Tue, 31 Jul 2001 15:46:59 +0100
MIME-Version: 1.0
Content-Type: text/plain
Interesting - check the security policy on the machine. Windows *should* be
able to detect that you're talking to a non-Kerberised SMB server and
downgrade. Have you tried it against an NT4 server, for example? The same
thing *should* happen.
Very interesting - I'd be curious to know what security policy settings
you're using (I hope not the defaults).
Regards,
Phil
+----------------------------------+
| Phil Mayers, Network Support |
| Centre for Computing Services |
| Imperial College |
+----------------------------------+
-----Original Message-----
From: Don Hiscock [mailto:dhiscock@ssbux1.env.gov.bc.ca]
Sent: 30 July 2001 18:50
To: kerberos@MIT.EDU
Subject: XP Client Trying to use Kerberos instead of SMB to Samba Server
Our XP clients were having problems getting a Samba share. The error message
was "The account is not authorized to log on from this station". This
problem started when we added the samba server to the active directory
(host/hostname principal). It looks like the XP client checks the active
directory for the hostname and since it is there thinks it's a w2k server
and then tries to use Kerberos to authenticate.
Has anyone else experienced this or found a way to get around it? One thing
that does work is to use the IP address or a DNS alias for the samba server
on the XP client.
