Bug 16013 - Samba "'sync machine password to to keytab" uses wrong domain for spn_prefixes-principals
Summary: Samba "'sync machine password to to keytab" uses wrong domain for spn_prefixe...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.23.5
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-26 10:02 UTC by Peter Eriksson
Modified: 2026-02-26 10:16 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Eriksson 2026-02-26 10:02:23 UTC 
Just noticed another problem with the new way to handle key tabs... 

# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 NOBUR01$@AD.LIU.SE
   1 RestrictedKrbHost/nobur01.it.liu.se@AD.LIU.SE
   1 RestrictedKrbHost/NOBUR01@AD.LIU.SE
   1 HOST/NOBUR01@AD.LIU.SE
   1 nfs/nobur01.ad.liu.se@AD.LIU.SE
   1 nfs/NOBUR01@AD.LIU.SE
   1 host/nobur01.it.liu.se@AD.LIU.SE

Notice how it uses .ad.liu.se for dns principal instead of .it.liu.se for the 
nfs principal... This breaks the NFS server.

(This is with my patch for host/ principals, otherwise that one would have been with an uppercase HOST/)


smb.conf:

sync machine password to keytab = /etc/krb5.keytab:account_name:spn_prefixes=nfs:sync_spns:sync_kvno:sync_etypes:machine_password

# uname -a
FreeBSD nobur01 15.0-RELEASE-p2 FreeBSD 15.0-RELEASE-p2 GENERIC amd64

# egrep nobur01 /etc/hosts
130.236.8.52		nobur01.it.liu.se	nobur01
2001:6b0:17:2400::8:52	nobur01.it.liu.se	nobur01
172.28.128.11		nobur01.console.it.liu.se

# host 130.236.8.52
52.8.236.130.in-addr.arpa domain name pointer nobur01.it.liu.se.

# host nobur01.ad.liu.se
Host nobur01.ad.liu.se not found: 3(NXDOMAIN)

# host nobur01.it.liu.se
nobur01.it.liu.se has address 130.236.8.52
nobur01.it.liu.se has IPv6 address 2001:6b0:17:2400::8:52

The AD realm/domain is AD.LIU.SE though...
Comment 1 Peter Eriksson 2026-02-26 10:16:23 UTC 
Found a workaround:

net ads setspn nfs/nobur01.it.liu.se
net ads keytab create

But I still see that incorrect nfs/nobur01.ad.liu.se entry.