Forum archive
Trust relationship failed
Hello, *
we have a server (Debian) running Samba version 3.6.6 serving about twenty workstations running Windows 7.
All of a sudden, all users are unable to log in, with the message "The trust relationship between this workstation and the primary domain failed."
Some googling shows that the problem is not unknown, and the usual solution seems to be to remove it from the domain, set it to a workgroup (then restarting the client), then reinstating the domain membership (then restarting the client; it remains windows, after all...), then again trying to log in. Unfortunately, the message does not go away.
I tried a few other things, e.g. removing the machine entry from the server (by deleting it from /etc/passwd and the samba database, then reinstating it), also to no avail. And of course entering a new user and trying if he would be able to log in, nope.
I have also found that at some time, the local DNS (which is maintained by the ISP) gave a wrong IP address back when I pinged the Linux server. That might explain the problem (if the login server is not found, it would be hard to establish any relation whatsoever :-) ); however, after this problem was corrected, the login problem still existed.
Now we seem to be stuck. Any suggestion is welcome...
Replies (5)
The blind leading the blind! :)
Reply 1Sorry I have no idea...
Reply 2Probably not much help, but I guess worst case scenario you could try to update to a newer version and/or recreate the server? FWIW Samba4 (as included in Debian Jessie/TurnKey v14.x) can be configured the same as Samba3 essentially; or can instead be configured as an AD domain controller. It can also be configured as a AD domain member but we don't have a pre-baked option for that.
FYI Our fileserver appliance uses Samba3 type config to act as network storage server whereas our Domain Controller is configured as a Samba4 AD DC.
Is this TurnKey? Or even Debian?
Reply 3I know that there have been some recent security updates to Samba (at least in Debian/TurnKey but probably others too). Perhaps that has resulted in tougher requirements? Perhaps your network was (inadvertently) relying on the security bug?
Thanks for your input Dan
Reply 4As I just posted above I know that Samba security patches have recently rolled out. There was a bug initially but it was resolved. The bug actually appeared to totally break Samba though so I'm not sure if you have the same issue.
FWIW the manual intervention for the Samba issue was:
apt-get update apt-get install -f
Hmm, seems really weird...
Reply 5TBH none of us TKL folks are Samba experts and as we're all Linux users we don't have easy access to the means to test or fiddle (i.e. Windows). Perhaps you could find someone to help you out on Upwork? We've posted jobs there before and had some great successes (although it can sometimes be something of a hit-and-miss). There are other freelancer type sites about too which might be worth a look?
Is this server running on hardware or is it a VM? If it's a VM (or you have facility to host one somewhere) perhaps you could do some tests with a new server (look to replace the old one)?
And yes in a AD domain, DNS is REALLY important. In Windows AD networks I have set up (using Windows Server) I have always used the DC as the DNS is provider. My understanding is that it should be that way... The DNS can then forward requests elsewhere but it needs the right entries for AD to work properly. So all domain members should be getting DNS from the DC. Obviously that requirement isn't so strict for Samba, but AFAIK the theory remains. As I said Samba4 DC should work OOTB...