Samba share not accessible from Windows 7 (on domain) via hostname

Question

I have spent several days attempting to solve this- none of the answers on this forum or any other were able to help. I tried everything. I read the entire Samba manual. Nothing worked.

Happily, I have solved it and would like to share the answer with the community.

Here was my specific issue:
I have Samba 3.6.3 running on Ubuntu Server 12.04. The server is joined to my company domain with PowerBroker Identity Services Open Edition (they purchased Likewise). I followed the manual and set up a share using AD group permissions. It was accessible from Linux and Mac using AD permissions. From Windows 7, it was accessible only on machines not joined to the domain. Once joined to the domain it was only accessible via IP- short hostname and FQDN would respond with a password error.

Answer 1

Clearly, there was an issue with group security policy on the domain- but it was not an option to change security policy for one network share. Based on my research, the issue was related to how AD created Kerberos tickets- and the domain policy was to only use Kerberos. Samba works with NTMLv2 but Samba was not responsible for authentication- AD was, and PBIS was responsible for making that happen.

The issue was stemming from Samba not accessing PBIS' keytab file. I resolved that by entering this in smb.conf under [global]:

Kerberos method = dedicated keytab
dedicated keytab file = /etc/krb5.keytab

The default for Kerberos method is secrets only which uses a tdb file for tickets- that doesn't work with PBIS. You have to tell Samba to only use the keytab file that PBIS uses. Once I did that- authentication worked correctly with IP, short hostname, and FQDN.

You can find which keytab file PBIS is using by checking the krb5.conf file (usually /etc/krb5.conf) and checking the default_keytab_name setting.

For reference, here is my smb.conf:

[global]
security = ADS
workgroup = DOMAIN
realm = DOMAIN.COM
machine password timeout = 0
server string = %h
local master = no
encrypt passwords = yes
Kerberos method = dedicated keytab
dedicated keytab file = /etc/krb5.keytab
deadtime = 20
log level = 20
debug pid = true
debug class = yes
log file = /var/log/samba-pbis.log

[test]
comment = test
path = /test
browseable = yes
read only = no
writeable = yes
valid users = @DOMAIN\user1 @DOMAIN\domain^users
admin users = @DOMAIN\domain^admins
guest ok = yes
create mask = 0774
directory mask = 0774
inherit acls = yes
inherit permissions = yes