0

After update USN-2950-1: Samba vulnerabilities the samba server ubuntu cannot anymore get the domain controller

/var/log/apt/history.log
Start-Date: 2016-04-19  06:37:17
Upgrade: libpam-winbind:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), smbclient:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), libwbclient0:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), libpa
End-Date: 2016-04-19  06:37:29

/var/log/samb/log.mizar
  domain_client_validate: Domain password server not available.
[2016/04/19 06:41:00.442169,  0] auth/auth_domain.c:292(domain_client_validate)

and more of these...

How do I resolve this?

jokerdino
  • 41,732
Gianni Bassini
  • 1

2 Answers2

0

We have the same problem. The only workaround is matener we thought the old samba packages where our DOMAIN worked properly. To do reinstall the following packages that were updated:

These are the packages that were automatically updated.

Start-Date: 2016-04-19  06:42:23
Upgrade: smbclient:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), libwbclient0:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), samba-common:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), samba-doc:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), samba:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2), samba-common-bin:amd64 (3.6.3-2ubuntu2.17, 3.6.25-0ubuntu0.12.04.2)
End-Date: 2016-04-19  06:42:38

Reinstalling previous packages.

sudo apt-get install samba=2:3.6.3-2ubuntu2 samba-common=2:3.6.3-2ubuntu2 smbclient=2:3.6.3-2ubuntu2 samba-common-bin=2:3.6.3-2ubuntu2 samba-doc=2:3.6.3-2ubuntu2 libwbclient0=2:3.6.3-2ubuntu2

Also I disable automatic updates of ubuntu server.

sudo dpkg-reconfigure -plow unattended-upgrades

Thus leaving the following configuration file:

cat /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "0";
APT::Periodic::Unattended-Upgrade "0";

Another way to avoid updating samba is blocking packages when upgrading other packages on the server.

Paolo Dávila

Videonauth
  • 33,815
Paolo Dávila
  • 1
0

I had to enable, activate, run winbind.service to reactivate domain/ads login

Alex
  • 1