CIFS connection to W2003 server

[Fred Ruffet]

Hi all,

I actually have trouble to connect an HP-UX server to w windows 2003 server through CIFS.

HP-UX is already conected to a 2000 server without any problem. When trying to connect to the 2003 it gives :
servhp:/opt/cifsclient/bin>cifsmount //serv2003/share /mountpoint -U remoteuser
Remote user remoteuser's password:
Connecting Share: DOS: Access denied

note : 2000 and 2003 servers are respectively PDC and SDC for the same domain, so user is identical on both servers.

Regards,

Fred

[RAC_1]

Do you have access to that share as the remote user??

[Steven E. Protter]

Windows 2003 requires a patch to use Kerberos versions below 5.

HP-UX Kerberos client version may need to be upgraded to version 5.

SEP

[Fred Ruffet]

RAC,

:-)

SEP,

your answer implies a question : where can I find such a windows patch ? (I already have HP-UX one installed on my server)

Regards,

Fred

[RAC_1]

at microsoft.com

[Arunvijai_4 · Accepted solution]

http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en
(Windows Server 2003 Resource Kit Tools)

-Arun

[Fred Ruffet]

RAC,

:-)
microsoft.com is a bit less intuitive than hp.com for me. I never managed to find my way on their site (and on their OS :)

Arunvijai,

Thanks, downloading...

Regards,

Fred

[Fred Ruffet]

I have installed resource kit, and I can't help to find my way in all this stuff.

Is there something to configure for kerberos 5 ?

This problem is going on the windows side and I feel a bit off-topic here. Sorry for that.

Regards,

Fred

[Yogeeraj_1]

hi,

so strange! worked for me with default configurations

hp-ux 11.11 <-> windows 2003 with latest service packs!

#swlist -l product |grep -i cifs
CIFS-Client A.01.07 HP CIFS/9000 Client
CIFS-Development A.01.08 CIFS/9000 server source code files
CIFS-Server A.01.08 CIFS/9000 (Samba) File and Print Services

hope this helps!
kind regards
yogeeraj

[Fred Ruffet]

versions are a bit different :
hp-ux is 11.00
and
#swlist -l product |grep -i cifs
CIFS-Client A.01.09.01 CIFS Client
CIFS-Development A.01.11.03 HP CIFS Server Source Code Files
CIFS-Server A.01.11.03 HP CIFS Server (Samba) File and Print Services

I'm looking at HP's administrator's guide, and it seems kerberos needs to be set-up in client global configuration file. It may be difficult for me as long as I use NTLM to authenticate on 2000 server from the same HP.

Regards,

Fred

[Simeon Harwood]

Not a solution, but the same type of problem.

I've had some problems with this set up too.
We have 3 HP-UX 11i servers, slightly different hardware, but all built the same,(patches etc), but one machine will not communicate at the kerberos level.
B8724AA A.01.09.03 CIFS Client B8725AA A.02.01.01 HP CIFS Server
and WIN2003 SP1
We have tried so many things to try and get the one machine that didn't work to get into the WIN domain, but it just wont play ball.
I;ve raised a call with support, but even they couldn't solve it.
The server hardware that didn't work is 9000/800/L3000-7x

Anything like the same as your problem?

Sime.

[Fred Ruffet]

These are L2000 servers but it's quite the same stuff.

For me it's not one but four HP-UX servers that can't connect, so I think it's more related to old HPUX / new Win relations.

As far as I understand, with a basic configuration, authentication is based on NTLM. I've been told that kerberos would help, but I can't play with productions servers and I don't have a 2003 server to play with for tests.

Regards,

Fred

[Simeon Harwood]

Funny how we are both having problems with the L classes.
For info, the servers that do work are and "N" class and an "RP4440".
I have tried cifs out on our "D" class test machines / cluster, and this works fine.

Hum!!!!!! "L" classes!!!!!!! is there a problem here.

I might be stating the obvious here, but have you tried the following: -
# vi /etc/krb5.conf
[libdefaults]
default_realm = YOUR.DOMAIN
default_tkt_enctypes = DES-CBC-CRC
default_tgs_enctypes = DES-CBC-CRC
ccache_type = 2
[realms]
DIRECTYOUR.DOMAIN = {
kdc = server.your.domain:88
admin_server = server.your.domain
}
[domain_realm]
.internal = YOUR.DOMAIN
[logging]
kdc = FILE:/var/adm/log/krb5kdc.log
admin_server = FILE:/var/adm/log/kadmin.log
default = FILE:/var/adm/log/krb5lib.log


then
# kinit Administrator@your.domain
This will tell you if kerberos is working or not.

if this works, then try: -
# net ads join -U Administrator%password

Please forgive me if I'm teaching you how to suck eggs.

Sime.

[Fred Ruffet]

...
Still doesn't work. Your help was great, but I'm facing the following problem :

$>kinit administrator@my.domain
Password for administrator@my.domain:
kinit: KDC reply did not match expectations while getting initial credentials

I found in the docs that this error occurs when AD domain password is still installation one. This is not the case on my servers...

Fred