Samba domain member fails with NT_STATUS_INVALID_PARAMETER_MIX against
FreeIPA IPA_DC (ipa-adtrust-install) Summary
After successfully enrolling a Samba file server as a FreeIPA client (
ipa-client-install) and running ipa-client-samba to configure it as a
domain member, winbindd fails to establish the NETLOGON secure channel with
the FreeIPA server (configured as ROLE_IPA_DC via ipa-adtrust-install). wbinfo
-t consistently fails with NT_STATUS_INVALID_PARAMETER_MIX, regardless of
Samba version (tested 4.22, 4.23, 4.24) or netlogon-crypto compatibility
settings.
Environment
- *FreeIPA server*: auth-nibelle-01, Rocky Linux 9, Samba 4.23.5 (
samba-dcerpc, samba-winbind, freeipa-server-trust-ad installed), realm
INFRA.AMANETIS.FR, server role IPA PRIMARY DOMAIN CONTROLLER (ipasam
passdb backend).
- *Samba member server*: fs-fauneharmony-01, Debian 13 (Trixie), Samba
(tested at 4.22.10-Debian, then upgraded to 4.24.5 via trixie-backports
— same result on both).
- Both machines are on the same internal network (different VLANs,
routed, no firewall blocking observed — verified with nc/ss).
- DNS SRV records for _ldap/_kerberos manually added (FreeIPA-integrated
DNS not used; internal Bind9 used instead).
Steps already performed (in order)
1. ipa-client-install on fs-fauneharmony-01 — succeeded, host enrolled,
Kerberos keytab present, getent passwd/group resolves FreeIPA identities
correctly via SSSD.
2. ipa-adtrust-install --add-sids on auth-nibelle-01 — completed
successfully ("Setup complete"), added Samba/NETLOGON support, DNS SRV
records added manually as instructed by the installer output.
3. Initial attempts with net ads join -U admin on the member server all
failed (Access Denied, then NetBIOS name >15 chars, then Error
connecting to LSA pipe: NT_STATUS_CONNECTION_REFUSED, then
NT_STATUS_OBJECT_NAME_NOT_FOUND after various RPC config changes — see
below). We since learned from FreeIPA's own documentation that net ads
join is *not supported* against ipasam and should not be used.
4. Installed freeipa-client-samba and ran *ipa-client-samba* instead
(the documented correct tool) — completed successfully after working around
one packaging issue (see "Side issues" below). It reports "Samba domain
member is already configured" on subsequent runs.
5. klist -k /etc/samba/samba.keytab shows the correct cifs/
fs-fauneharmony-01.infra.amanetis.fr(a)INFRA.AMANETIS.FR principal.
6. net getlocalsid / net getdomainsid both return valid, consistent SIDs
(machine SID and domain SID INFRA).
7. wbinfo -t still fails:
checking the trust secret for domain INFRA via RPC calls
failedwbcCheckTrustCredentials(INFRA): error code was
NT_STATUS_INVALID_PARAMETER_MIX (0xc0000030)failed to call
wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR
Relevant log excerpt (client, log.wb-INFRA, debug level 5)
ldb: Unable to open tdb '/var/lib/samba/private/secrets.ldb': No such
file or directory
ldb: Failed to connect to '/var/lib/samba/private/secrets.ldb' with
backend 'tdb': ...
source3/winbindd/winbindd_cm.c:3256(cm_connect_netlogon_transport)
rpccli_create_netlogon_creds failed for INFRA, unable to create
NETLOGON credentials: NT_STATUS_INVALID_PARAMETER_MIX
The secrets.ldb failure appears to be a benign fallback attempt (file
genuinely doesn't exist on a source3-only member; secrets.tdb exists and
has valid content). The actual failure is in rpccli_create_netlogon_creds.
What we've already tried, with no change in the error
- Full reboot of both auth-nibelle-01 and fs-fauneharmony-01.
- Upgrading client Samba from 4.22.10 (Debian stable) to 4.24.5 (
trixie-backports) — ruled out a simple version-skew hypothesis (server
is 4.23.5).
- Setting reject md5 servers = no, require strong key = no, client
schannel = yes / server schannel = yes on both sides (via net conf
setparm in the Samba registry on the FreeIPA server, and directly in
smb.conf on the Debian member, since the member's smb.conf does not
use include
= registry).
- Switching rpc_server:epmapper/lsarpc/lsass/samr/netlogon and
rpc_daemon:epmd from external to embedded on the FreeIPA server (this
was needed separately to get past an earlier Cannot start in standalone
mode error from samba-dcerpcd, since no systemd unit ships to run it as
an external/on-demand-activated daemon on this Rocky packaging).
- Verified no firewall (neither Proxmox virtual firewall nor nftables/
firewalld on either host) is blocking traffic; TCP 445/139 reachable,
CLDAP (net ads lookup) succeeds and returns full, correct DC information.
Side issues encountered along the way (may or may not be relevant, noted
for completeness)
- samba-dcerpcd (RHEL/Rocky package) has no systemd unit and refuses to
run standalone if rpc start on demand helpers = true (the implicit
default) — worked around via net conf setparm global "rpc start on
demand helpers" no plus switching relevant rpc_server:*/rpc_daemon:*
parameters to embedded.
- ipa-client-samba failed on first run with Cannot map BUILTIN\Guests to
a group "nobody" because Debian's equivalent group is nogroup, not nobody
— worked around with groupadd -o -g 65534 nobody before re-running.
- NetBIOS name had to be manually shortened (netbios name =
FS-FAUNEHARMONY — 15 chars) since the FQDN-derived name exceeded the
15-character NetBIOS limit.
Question
What could cause rpccli_create_netlogon_creds to fail with
NT_STATUS_INVALID_PARAMETER_MIX specifically when establishing the NETLOGON
secure channel between a classic Samba (source3) domain member and a
FreeIPA server configured as ROLE_IPA_DC via ipa-adtrust-install? Is there
a known incompatibility, a required additional parameter, or a documented
working configuration for this specific combination (FreeIPA ipasam-backed
DC + separate Samba file server as domain member) that we might be missing?
Happy to provide any additional logs (higher debug levels, wireshark/tcpdump
capture of the RPC exchange, net conf list output from both sides, etc.) on
request.
