Active Directory Authentication Breaks After Installing SAMBA 4.2.10-6.el7_2

This Issue Has Been Resolved! See Post – https://www.catracing.org/hendrb/post-update-active-directory-authentication-fixed-samba-update-4-2-10-6-2-el7_2/ For additional information!

This is not going to be a very long technical post, but I did want to get the word out that the latest update to the SAMBA client broke Active Directory authentication on my web server, and how to fix the issue.

While applying Windows Update fixes to my Windows servers, I also checked for updates on my CENT-OS box, and lo and behold there were quite a bit of updates, one being another SAMBA update. I can not remember a time where a package update broke something on my production box, the only other times I have had serious issue is after installing kernel updates.  So needless to say I was quite shocked after rebooting the server (Runs as a virtual machine on top of the Windows box that had rebootable updates installed).  I could no longer login with my AD account.  NOT GOOD!  Fortunately checking to make sure I can login as root and my local account is part of my pre-update checks.

After the updates and a reboot of the server you can see it is not allowing me to login with my domain account.

Here are the error message logged in /var/log/secure
(Server hostname has been replaced with ****)

Apr 14 13:50:53 **** polkitd[804]: Registered Authentication Agent for unix-session:c1 (system bus name :1.28 [gnome-shell –mode=gdm], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)

Apr 14 13:51:33 **** gdm-password]: pam_unix(gdm-password:auth): check pass; user unknown

Apr 14 13:51:33 **** gdm-password]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=

I promptly removed the updated version of SAMBA and reinstalled the previous version. I always take a screen capture of the what yum is going to update before answering yes.  This makes an easy reference in case I need to go back and remove anything.  In this case I need to remove the following packages.

 samba                                 x86_64   4.2.10-6.el7_2                               updates   614 k
 samba-client                       x86_64   4.2.10-6.el7_2                               updates   496k
 samba-client-libs                 x86_64   4.2.10-6.el7_2                               updates   4.3 M    
 samba-common                  noarch   4.2.10-6.el7_2                                updates   272 k
 samba-common-libs            x86_64   4.2.10-6.el7_2                              updates   156 k
 samba-common-tools          x86_64   4.2.10-6.el7_2                              updates   444 k
 samba-libs                           x86_64   4.2.10-6.el7_2                               updates   260 k
 samba-winbind                    x86_64   4.2.10-6.el7_2                               updates   465 k
 samba-winbind-modules      x86_64  4.2.10-6.el7_2                               updates   105 k

$ yum remove samba samba-client samb-client-libs samba-common samba-common-libs samba-common-tools samba-libs samba-winbind samba-winbind-modules

Once samba, and samba-winbind have been uninstalled, we need to install the previous version, again the listing I keep of all updates installed on the server come in handy, as I know SAMBA was updated back in January.

samba-client             x86_64     4.2.3-11.el7_2          updates     496 k
samba-client-libs       x86_64     4.2.3-11.el7_2          updates     4.3 M
samba-common        noarch     4.2.3-11.el7_2           updates     269 k
samba-common-libs  x86_64     4.2.3-11.el7_2          updates     156 k
samba-common-tools x86_64    4.2.3-11.el7_2          updates     443 k
samba-libs                  x86_64     4.2.3-11.el7_2          updates     259 k
samba-winbind           x86_64     4.2.3-11.el7_2          updates     463 k
samba-winbind-modules x86_64 4.2.3-11.el7_2         updates     104 k

First let’s get the package names for all available versions of samba

$ yum –showduplicates list samba

The update we want 4.2.3-11.el7-2 is available. So let’s go ahead and install them.

$ yum install samba-0:4.2.3-11.el7_2.x86_64

Once the samba client is installed we need to install samba-winbind

$ yum install samba_winbind-0:4.2.3-11.el7_2.x86_64

Once this was complete, I rebooted the server, but was still unable to connect to the domain controller. Comparing files on my development server, I noticed that the /etc/samba/smb.conf file was modified on the server during the removal of the samba package.  Not to worry yum made a backup first.

So let’s remove the new smb.conf

$ rm smb.conf

Now let’s rename the smb.conf.rpmsave to smb.conf

$ mv smb.conf.rpmsave smb.conf

Now let’s go ahead and reboot (You don’t need to, you can just shutdown your networking and samba service.), but a reboot never hurts.

$ reboot

Test logging in with a domain account, if the login still fails, log back in as your local account and troubleshoot the AD connection.

1. Is the time on the LINUX box within 5 minutes of the time on the Active Directory server? If no this will cause the Kerberos ticket issuance to fail
2. Can you issue wbinfo commands.IE wbinfo -g or wbinfo -u. If not, you may have to rejoin the domain.

These instructions should repair your domain authentication until the issue with the new version of SAMBA is resolved. I will keep working on a fix, unless another update fixes the problem.

NOTE: If you know the fix for this issue with SAMBA update, please either shoot me an email, or post it to our forums or as a comment.  You will get full credit for providing the fix.

CENTos 7 – Using Systemctl

For this months technical blog thought I would share another difference between previous versions of the operating system.  Which is very different and can be very confusing for those of us used to the older ‘unix’ way of doing things.  RHEL 7, and therefor CENTos 7 have done away with the init.d method of boot scripts and starting and stopping services.  The OS now uses systemd (Similar to Apple’s launchd in OSX).  I will not be delving into the nuts and bolts of what systemd is, and how it works.  This is a simple run down of the commands you need to know to start, stop, and restart services using systemctl.  Additionally I will also cover systemd’s equivalent to runlevels, and how to change and set your systems default environment during boot.

Starting, Stopping, and Restarting Services.

In this article I assume that you are following best practices by logging in with a standard user account and evelating your privileges using sudo. If you are not, simply ignore the sudo command.

Starting a service.

Using init.d unix and Linux system, to start a service we would use the service command, which would execute it’s specific startup script. Whereas in CENTos 7 you would use systemctl.

Previous verions of CENTos –

               sudo service <service name> start

CENTos 7 –

               sudo systemctl start <service name>

Stopping a service.

Previous versions of CENTos –

               sudo service <service name> stop

CENTos 7 –

               sudo systemctl stop <service name>

Restarting a service.

Previous versions of CENTos –

               sudo service <service name> restart

CENTos 7 –

              sudo systemctl restart <service name>

This should all look pretty straight forward, you mostly just have to remember the new systemctl command, and the fact that you now place the action before service name.

Configuring boot services,

So how do we go about configuring which services are started at boot? With init.d you could either modify your init scripts for a specific runlevel, in the rc.d directory, or use a command called chkconfig which would handle it for you.

Previous versions of CENTos –

                sudo chkconfig –list sshd

    sshd                      0:off      1:off      2:on       3:on       4:on       5:on       6:off

 This shows us that the ssd service is either on or off in each corresponding runlevel. For instance runlevel 1 (Single User Mode), sshd is off at boot, however with run level (consoleonly, with networking services), sshd is on at boot.  I do find it interesting that sshd is configured to be on in runlevel 2 (Console only, no networking.)

You could easily toggle a specific service either on or off for each service with the following command.

                sudo chkconfig <service> –level <runlevels>

Full example given below.

                sudo chkconfig sshd –level 35

This would in effect, toggle the sshd service to be started at boot in both run revel 3 (Multi-User, with networking, in console mode.), and runlevel 5 (Multi-User, with networking, in Graphical Environment Mode (XWindows).

CENTos 7 –

In CENTos 7, You no longer have runlevels, so you only need to worry about a service being on or off (Or enabled or disabled), again using the systemctl command.

To configure a service to be started at boot.

                systemctl enable <service name>

Full example given below. Using the secure shell daemon.

               sudo systemctl enable sshd

To no longer have a service started at boot.

                systemctl disble <service name>

Full example given below, Using the secure shell daemon.

                sudo systectl disable sshd

Displaying a list of running services.

You can get the status of the running services or a single service by the following 2 methods.                 

                  systemctl status

Will return the status of every running service, and its dependents.

                  systemctl status <service>

Will display the status of an individual service (such as winbind shown here).

├─winbind.service
             │ ├─17859 /usr/sbin/winbindd
             │ ├─17998 /usr/sbin/winbindd
             │ ├─19090 /usr/sbin/winbindd
             │ ├─19398 /usr/sbin/winbindd
             │ └─19854 /usr/sbin/winbindd

The last bit I will demonstrate with system control is how to switch between a console (Command Line) environment, and how to set the default runrevel.
First let’s find out what runlevel we are current using.

                   sudo systemctl get-default

The system will return the current target mode

multi-user.target

This is the old runrevel 3, (command line, multi user with networking).
So let’s say we wanted to switch to the old runlevel 5 “Multiuser, Networking, with Xwindows”

We can have centOS return a list of available “TARGETS” (runlevels), You do not need to run this command as root, so no sudo is necessary.

systemctl list-units –t target -a

UNIT LOAD      ACTIVE   SUB    DESCRIPTION
target           loaded    active   active Basic System
target      loaded    active   active Encrypted Volumes
target       loaded    inactive dead   Emergency Mode
target           loaded    inactive dead   Final Step
target           loaded    active   active Login Prompt
target       loaded    inactive dead   Graphical Interface
local-fs-pre.target    loaded    active   active Local File Systems (Pre)
local-fs.target        loaded    active   active Local File Systems
multi-user.target      loaded    active   active Multi-User System
network-online.target  loaded    active   active Network is Online
network-pre.target     loaded    inactive dead   Network (Pre)
target         loaded    active   active Network
nss-lookup.target      loaded  inactive dead   Host and Network Name Lookups
nss-user-lookup.target loaded    inactive dead   User and Group Name Lookups
target           loaded    active   active Paths
remote-fs-pre.target   loaded    inactive dead   Remote File Systems (Pre)
remote-fs.target       loaded    active   active Remote File System
target          loaded    inactive dead   Rescue Mode
target        loaded    inactive dead   Shutdown
target          loaded    active   active Slices
target         loaded    active   active Sockets
target           loaded    active   active Sound Card

For the old runlevel 5, (Xwindows, Multi-User, With Networking) we would issue the following command. As this will manipulate services, we must run this as root.
                   sudo systemctl isolate graphical.target

To switch back to runlevel 3  ‘multi-user target’
sudo systemctl isolate multiuser.target

Now that we can switch between targets “Runlevels” let’s set one as a default.

Remember we mentioned in the beginning of the blog that CentOS 7 now uses systemd and not init.d to control the boot process. Systemd uses a symbolic link to determine the systems default target”  If you do an ls-l or ll on /etc/systemd/system, you can determine the systems default target.
                  ll /etc/systemd/system

• 1 root root 41 Jan  4 04:20 default.target -> /usr/lib/systemd/system/multi-user.target

First we must remove the symbolic link

                  sudo rm/etc/systemd/system/default.target

Now we create a new symbolic link to the ‘graphical.tartarget’

sudo ln-sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target

Before we reboot the system, let’s make sure the default target symbolic link was correctly set.

                 ll /etc/systemd/system/

We should now see this

lrwxrwxrwx 1 root root   36 Jan 23 11:13 default.target – /lib/systemd/system/graphical.target

Let’s go ahead and reboot the system, and it should now boot into the GUI (XWindows                  

                 sudo reboot

To return the system to boot into a multi-user console with networking, repeat the steps above, substituting ‘multi-user.target’ in place of graphical.target.  Like this.

sudo ln-sf /lib/systemd/system/multi-user/target /etc/systemd/system/default.target

You should now have a better grasp on how to control services, and your default run level using CentOS 7.

I hope you enjoyed this month’s technical blog, and will continue to return for more exciting and informative articles. All comments are welcome.

DISCLAIMER: While we strive to bring you the most accurate information, use these commands at your own risk.  Neither the authors nor Brent’s World are responsible for any damage, or loss of data, nor loss of revenue resulting in downtime, either expected or unexpected that may occur by using the commands outlined in this blog.  It is recommended that these commands or scripts be executed in a test environment (Preferably on a virtual machine, not connected to an active network), until you fully understand the actions being performed by the commands or scripts.

What your Metadata says about you?
Using Metadata To Analyze Your Lens Usage.

Contrary to the title, this is not going to be another scare piece about how your camera’s metadata is a tool created by the some evil government organization out to track your every move through social media, or how .xif files can be used by Joe Hacker or Pete the Pedophile for nefarious purposes.  There are plenty of articles out there already in the blog sphere, and mainstream media.   I am going to show you one example on how metadata, can be a very useful tool for planning your next shoot.  Whether it be your next assignment or vacation.   If you are like me who has been bitten by lens addiction, you have found your camera bag growing heavier by the month.  Is there a way to find out which lens I use the most, so I can make an educated assumption of which equipment to take with me or leave at home?

Yes there is!! if you  use Adobe Photoshop Lightroom to organize your photos you can use the filter bar in the Library module to sort  by a multitude of categories, such as camera, lens, focal length etc.  You can then just look at the breakdown and make a quick guess of the gear you use the most or take it one step further and plug that data into a spreadsheet and come up with some pretty nifty graphs.

Let’s go ahead and go into Lightroom. Once  our library has loaded, go to the Library Module  and select Filter by Metadata > Enable Metadata Filter.  You will see the following screen come up with the default filters selected.

By Default, Lightroom will filter by Date, Camera, Lens, and Label.  I have set my filters to add Aperture, and removed labels.  As you can see in 2010, I supposedly had 2 cameras (I think when I converted my library from Apple’s Aperture to Lightroom some of the metadata became corrupted.) I am pretty sure 6 of the 7 pictures were shot with the Canon30D and the 70-200 F4.0L.

I took 506 pictures in 2010 (This does seem a bit low, but we won’t argue).
I owned 2 lenses, and surprisingly enough took an equal amount of photos with either lens. F4.0 seemed to be my most frequent used aperture with 109 pictures.
Let’s jump to 2015, where the data is much different.

Ignore the Canon 7D, as this is the camera Mi Jung uses, and I imported her photos from our river cruise. We are only interested in the pictures that I have taken.

This year I have taken 8089 photos, it looks like the EF 70-200mm f/4L IS USM lens is the clear winner, with the EF50mm f/1.2L USM being the runner up. The EF16-35mm f/2.8L has gotten a surprising amount of use, as I bought this lens late in 2014.  I am surprised that I have used the Tameron 150-600mm/f5-6.3 as much as I have been, because it is pretty much a specialty lens, and pretty heavy to boot.  It looks like f4 has won out again this year as being my most used aperture, which I think has something to do with it being my most used lens (70-200mm f4L) wide open aperture.

Now that we have a way to get the numbers, let’s go ahead and put them into Excel so we can actually start analyzing the data.

Here I have entered the data obtained by Lightroom into an Excel spreadsheet sorted by year, I have highlighted the year the lenses were purchased in blue.

If I highlight the spreadsheet, then go to Insert > Insert Collum Or Bar Chart, or Instert Pie or Doughnut Chart.  I can get good graphical representations of my lens usage

Here is bar chart displaying the number of pictures taken each year sorted by lens.

We can change the sorting to display number of pictures by lens sorted by year by clicking on the chart and selecting the chart filters icon.

Then click Select Data

Click Switch Row/Colum

Click Ok

You will now see the chart is displaying the amont of pictures taken each year sorted by lens.

Conclusion –

If I was planning a trip and packing light, The lenses that I would take would most likely be the EF 70-200mm f/4L, EF-50mm/f1.2.  It would then be a judgment call if I would take either the EF 35mm/f1.4 or the EF 16-35mm/f2.8.   Most likely I would take the 16-35mm, unless I knew I would be doing a lot of shooting in area’s that were not well lit.

You now have a pretty good idea how useful your camera’s meta data can be, and a way that can make itself useful to you.  You can break these numbers down even further if you keyword your photos in your library.  For instance, if I populated the category field, I could further break these numbers down by what lens’s I use most often at “The Beach”, or on “Cruises”, or at a “Wedding”  How you sort your photos is a personal preference, how you use Lightroom is up to the you.  Keep active, and keep shooting!