Bug 188014

âÙÌ ÒÅÌÉÚ 9.1!
ïÂÎÏ×ÉÌÓÑ ÞÅÒÅÚ freebsd-update ÄÏ 9.2 - ÐÏÌÅÔ ÎÏÒÍÁÌØÎÙÊ!
ðÏÓÌÅ ÏÂÎÏ×ÉÌÓÑ ÄÏ 10 ÒÅÌÉÚÁ! 
ðÏÓÌÅ ÏÂÎÏ×ÌÅÎÉÑ ÐÅÒÅÓÂÏÒËÁ ÍÉÒÁ ÑÄÒÁ É ×ÓÅÈ ÐÁËÅÔÏ×!
íÅÒÖÅÍÁÓÔÅÒ É ÔÁË ÄÁÌÅÅ! úÁÍÅÎÁ BIND ÎÁ  UNBOUND! 
÷ÓÅ ÓÅÒ×ÉÓÙ ÒÁÂÏÔÁÀÔ! ïÛÉÂÏË ÎÅÔ! ëÒÏÍÅ ÔÏÇÏ ÞÔÏ ÐÅÒÅÓÔÁÌÁ ÒÁÂÏÔÁÔØ Ó×ÑÚØ Ó ÄÏÍÅÎÏÍ Windows 2008 ! ëÏÎÆÉÇ ÓÁÍÂÙ ÎÅ ÍÅÎÑÌÓÑ, ËÅÒÂÅÒÏÓÁ ÔÏÖÅ! 
÷ ÌÏÇÉ ÏÛÉÂËÉ 
Mar 27 10:35:00 proxy winbindd[66318]: [2014/03/27 10:35:00.112260,  0] libads/kerberos_util.c:101(ads_kinit_password)
Mar 27 10:35:00 proxy winbindd[66318]:   kerberos_kinit_password PROXY$@DOMAIN.LOCAL failed: Looping detected inside krb5_get_in_tkt

╼ wbinfo -p
Ping to winbindd succeeded

kinit É klist ÐÏÒÑÄÏË! ÂÉÌÅÔÙ ×ÙÄÁÀÔÓÑ!

╼ net ads info
LDAP server: 10.11.12.8
LDAP server name: DCO.domain.local
Realm: DOMAIN.LOCAL
Bind Path: dc=DOMAIN,dc=LOCAL
LDAP port: 389
Server time: ÞÔ, 27 ÍÁÒ 2014 10:43:44 EET
KDC server: 10.11.12.8
Server time offset: -19

 net ads lookup
Information for Domain Controller: 172.16.16.2

Response Type: LOGON_SAM_LOGON_RESPONSE_EX
GUID: 79c2a975-f915-4845-88ce-36f0994aff2e
Flags:
        Is a PDC:                                   yes
        Is a GC of the forest:                      yes
        Is an LDAP server:                          yes
        Supports DS:                                yes
        Is running a KDC:                           yes
        Is running time services:                   yes
        Is the closest DC:                          yes
        Is writable:                                yes
        Has a hardware clock:                       yes
        Is a non-domain NC serviced by LDAP server: no
        Is NT6 DC that has some secrets:            no
        Is NT6 DC that has all secrets:             yes
Forest:                 domain.local
Domain:                 domain.local
Domain Controller:      pdc.domain.local
Pre-Win2k Domain:       DOMAIN
Pre-Win2k Hostname:     PDC
Server Site Name :              Default-First-Site-Name
Client Site Name :              Default-First-Site-Name
NT Version: 5
LMNT Token: ffff
LM20 Token: ffff

á ÄÁÌÅÅ ÍÉÓÔÉËÁ

wbinfo -u -g - ÐÕÓÔÏ

╼ net ads testjoin
kerberos_kinit_password PROXY$@JSP.LOCAL failed: Looping detected inside krb5_get_in_tkt
kerberos_kinit_password PROXY$@JSP.LOCAL failed: Looping detected inside krb5_get_in_tkt
Join to domain is not valid: Undetermined error

╼ net ads join -U kobzar
Enter kobzar's password:
kerberos_kinit_password kobzar@DOMAIN.LOCAL failed: Looping detected inside krb5_get_in_tkt
Failed to join domain: failed to connect to AD: Looping detected inside krb5_get_in_tkt
[✗][proxy][/usr/ports/security/krb5]
╼ net ads join -U kobzar@DOMAIN.LOCAL
Enter kobzar@JSP.LOCAL's password:
kerberos_kinit_password kobzar@DOMAIN.LOCAL failed: Looping detected inside krb5_get_in_tkt
Failed to join domain: failed to connect to AD: Looping detected inside krb5_get_in_tkt

╼ pkg version|grep samba
samba36-3.6.23                     

╼ cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = DOMAIN.LOCAL
 dns_lookup_realm = no
 dns_lookup_kdc = no
 ticket_lifetime = 24h
 default_keytab_name = /usr/local/etc/squid/squid.keytab
 default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
 default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
 permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

[realms]
 JSP.LOCAL = {
  kdc = dco.domain.local
  admin_server = dco.domain.local
  default_domain = dco.domain.local
  }

[domain_realm]
        .domain.local = JSP.LOCAL
        domain.local = JSP.LOCAL

╼ cat /usr/local/etc/smb.conf
#======================= Global Settings =====================================
[global]
    workgroup = DOMAIN
    netbios name = proxy
    server string = Proxy Server
    security = ADS
    auth methods = winbind
    password server = domain.local
    realm = DOMAIN.LOCAL
    local master = no
    domain master = no
    preferred master = no
    dns proxy = yes
    map to guest = Bad User
    wins support = no
    client NTLMv2 auth = Yes
    log file = /var/log/samba/log.%m
    max log size = 50
    client signing = Yes
    disable spoolss = Yes
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    winbind use default domain = Yes
    inherit acls = Yes
    hosts allow = 10.11.12., 172.16.16., 127.
    map acl inherit = Yes
    case sensitive = No
    nt acl support = yes
    os level = 10
    socket options = TCP_NODELAY
    load printers = no
# Charset settings
    display charset = utf-8
    unix charset = utf-8
    dos charset = cp866
    encrypt passwords = yes
    winbind separator = /
    load printers = no

[Work]
   comment = Work
   path = /home/Work
   admin users = "@DOMAIN+áÄÍÉÎÉÓÔÒÁÔÏÒÙ\ ÄÏÍÅÎÁ", "@DOMAIN\kobzar"
   browseable = yes
   writable = yes
   create mask = 0660
   directory mask = 0770
   inherit acls = yes
   inherit owner = yes
   inherit permissions = yes
   map acl inherit = yes
   locking = no

Fix: 

òÅÛÅÎÉÑ ÎÅÔ! ÷ ÉÎÔÅÒÎÅÔÅ ÌÉÛØ ÐÏÈÏÖÉÅ ÓÏÏÂÝÅÎÉÑ - ÎÅÔ ÒÅÛÅÎÉÑ
How-To-Repeat: ïÛÉÂËÁ ÐÏÓÔÏÑÎÎÁ