On Linux VDA 7.18, after using MCS to create Linux VMs on XenServer or Azure, user logs on with domain user and finds that invalid login window pops up. The following appears in the /var/log/messages:

Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.498170,  0] ../lib/util/fault.c:78(fault_report)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  ===============================================================
Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.514450,  0] ../lib/util/fault.c:79(fault_report)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  INTERNAL ERROR: Signal 11 in pid 24880 (4.7.1)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  Please read the Trouble-Shooting section of the Samba HOWTO
Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.514642,  0] ../lib/util/fault.c:81(fault_report)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  ===============================================================
Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.514740,  0] ../source3/lib/util.c:804(smb_panic_s3)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  PANIC (pid 24880): internal error
Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.515657,  0] ../source3/lib/util.c:915(log_stack_trace)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  BACKTRACE: 25 stack frames:
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #0 /lib64/libsmbconf.so.0(log_stack_trace+0x1a) [0x7f42f5a43a3a]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #1 /lib64/libsmbconf.so.0(smb_panic_s3+0x20) [0x7f42f5a43b10]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #2 /lib64/libsamba-util.so.0(smb_panic+0x2f) [0x7f42f8755eaf]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #3 /lib64/libsamba-util.so.0(+0x250c6) [0x7f42f87560c6]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #4 /lib64/libpthread.so.0(+0xf5e0) [0x7f42fa5fb5e0]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #5 /usr/lib64/samba/libgse-samba4.so(+0x9530) [0x7f42f4366530]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #6 /usr/lib64/samba/libgse-samba4.so(gse_krb5_get_server_keytab+0xa5) [0x7f42f4366f25]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #7 /usr/lib64/samba/libgse-samba4.so(+0xc1d8) [0x7f42f43691d8]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #8 /usr/lib64/samba/libgensec-samba4.so(+0x19eba) [0x7f42f4dadeba]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #9 /usr/lib64/samba/libgensec-samba4.so(gensec_start_mech_by_oid+0x26) [0x7f42f4daee96]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #10 /usr/sbin/winbindd(kerberos_return_pac+0x3e0) [0x56122f3992c0]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #11 /usr/sbin/winbindd(winbindd_dual_pam_auth+0xf71) [0x56122f3ad071]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #12 /usr/sbin/winbindd(+0x511dc) [0x56122f3c31dc]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #13 /lib64/libtevent.so.0(+0xaedb) [0x7f42f27bbedb]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #14 /lib64/libtevent.so.0(+0x92a7) [0x7f42f27ba2a7]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #15 /lib64/libtevent.so.0(_tevent_loop_once+0x9d) [0x7f42f27b60cd]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #16 /usr/sbin/winbindd(+0x535a8) [0x56122f3c55a8]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #17 /usr/sbin/winbindd(+0x53c75) [0x56122f3c5c75]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #18 /lib64/libtevent.so.0(tevent_common_loop_immediate+0xda) [0x7f42f27b6aba]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #19 /lib64/libtevent.so.0(+0xac9d) [0x7f42f27bbc9d]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #20 /lib64/libtevent.so.0(+0x92a7) [0x7f42f27ba2a7]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #21 /lib64/libtevent.so.0(_tevent_loop_once+0x9d) [0x7f42f27b60cd]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #22 /usr/sbin/winbindd(main+0xbbc) [0x56122f39850c]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #23 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f42f21bbc05]
Jun  7 10:57:17 r74s-test1 winbindd[24880]:   #24 /usr/sbin/winbindd(+0x26c91) [0x56122f398c91]
Jun  7 10:57:17 r74s-test1 winbindd[24880]: [2018/06/07 10:57:17.516138,  0] ../source3/lib/dumpcore.c:318(dump_core)
Jun  7 10:57:17 r74s-test1 winbindd[24880]:  coredump is handled by helper binary specified at /proc/sys/kernel/core_patter

This is an issue on newer versions of samba. This issue happens on RHEL 7.4 and SUSE 12.3 with latest version of samba.

To fix this issue on SUSE 12.3, you downgrade the version of samba on your template machine using the following command:

sudo zypper in -f samba-4.6.7+git.51.327af8d0a11-3.12.1

After this, update your machine catalog using the new master image.

On RHEL 7.4, you need to create a new template machine, then use the following command to restrict the package version:

echo ‘7.4’ >/etc/yum/vars/releasever

If your system is not registered or using other repos, you can install specific version of samba and lock it with yum version lock.

yum install yum-plugin-versionlock
yum install samba-winbind-clients-4.6.2-12.el7_4.x86_64
yum versionlock samba*

If there are other packages fail to install due to this version of samba, you need to install their lower versions accordingly.

Update on RHEL 7 Platform

RHEL team has fixed this issue in their latest samba package: 4.7.1-9.el7_5. However, after upgrading to this samba version, you will still get invalid login error. To solve this issue, in the template machine, you need to add a line in /var/xdl/mcs/mcs_util.sh, in function join_domain(), find the line：

tdbtool ${SAMBA_SECRETS} store SECRETS/MACHINE_PASSWORD/${WORKGROUP} "${PASSWORD}\0" 2>&1 >> "$logFile"

add a line below:

tdbtool ${SAMBA_SECRETS} store "SECRETS/MACHINE_SEC_CHANNEL_TYPE/${WORKGROUP}" "\02\00\00\00"

After this, create a new snapshot of the template machine and update machine catalog using this snapshot.