SAMBA: Failed to verify incoming ticket

Solved an obscure error for some Windows 2003 R2 servers that were unable to map a drive to a SAMBA share. SAMBA is running on Oracle Enterprise Linux 4U6 with configs as defined by a wiki over at SAMBA. Error logs showed repeated "Failed to verify incoming ticket" errors.

Problem turned out to be related to Kerberos. Not so much the version or the encryption (MIT vs. Heimdal), as many sources mention, but to plain and simple time keeping! The Windows servers giving the errors were VMs running on ESX hosts. VMware Tools is supposed to do the time keeping and time sync the VMs to ESX, however that had slipped a bit too much. Kerberos accepts a maximum of 5 minutes. Ours was 9 minutes off...

No comments: