Hi,
I have two servers in Alma Linux 9. One is a freeipa server the other a samba server.
After upgrade from samba 4.23.5-11 to 4.23.5-12 on both server the samba server cannot be used anymore by end users.
On the samba server winbind systemctl logs show the following errors:
Oct 12 07:32:54 winbindd[41836]: Please check your firewall if it allows connections to port 135 and port range 49152-65535 over TCP/IP!
Oct 12 07:32:54 winbindd[41836]: [2026/10/12 07:32:54.034958, 0, traceid=292] ../../source3/winbindd/winbindd_cm.c:3349(cm_connect_netlogon)
Oct 12 07:32:54 winbindd[41836]: cm_connect_netlogon: Unable to connect to DC ipserver.intra.contoso.com of domain INTRA over TCP/IP: NT_STATUS_CONNECTION_REFUSED.
Oct 12 07:32:54 winbindd[41836]: Please check your firewall if it allows connections to port 135 and port range 49152-65535 over TCP/IP!
I tried rebooting samba server and freeipa server without success, in case the update required a reboot.
Rolling back samba only on the samba server solved the issue (after restart of smb and winbind services)
dnf downgrade samba*
Last metadata expiration check: 0:32:08 ago on Mon Oct 12 09:33:47 2026.
Dependencies resolved.Package Architecture Version Repository Size
Downgrading:
libldb x86_64 4.23.5-11.el9_8 baseos 181 k
libnetapi x86_64 4.23.5-11.el9_8 baseos 143 k
libsmbclient x86_64 4.23.5-11.el9_8 baseos 75 k
libwbclient x86_64 4.23.5-11.el9_8 baseos 43 k
python3-ldb x86_64 4.23.5-11.el9_8 baseos 55 k
python3-samba x86_64 4.23.5-11.el9_8 baseos 3.7 M
samba x86_64 4.23.5-11.el9_8 baseos 825 k
samba-client x86_64 4.23.5-11.el9_8 appstream 736 k
samba-client-libs x86_64 4.23.5-11.el9_8 baseos 5.5 M
samba-common noarch 4.23.5-11.el9_8 baseos 175 k
samba-common-libs x86_64 4.23.5-11.el9_8 baseos 104 k
samba-common-tools x86_64 4.23.5-11.el9_8 baseos 492 k
samba-dc-libs x86_64 4.23.5-11.el9_8 baseos 117 k
samba-dcerpc x86_64 4.23.5-11.el9_8 baseos 721 k
samba-ldb-ldap-modules x86_64 4.23.5-11.el9_8 baseos 35 k
samba-libs x86_64 4.23.5-11.el9_8 baseos 125 k
samba-winbind x86_64 4.23.5-11.el9_8 baseos 409 k
samba-winbind-modules x86_64 4.23.5-11.el9_8 baseos 89 kTransaction Summary
Downgrade 18 Packages
Total download size: 13 M
Is this ok [y/N]: y
Downloading Packages:
…
Downgraded:
libldb-4.23.5-11.el9_8.x86_64 libnetapi-4.23.5-11.el9_8.x86_64 libsmbclient-4.23.5-11.el9_8.x86_64
libwbclient-4.23.5-11.el9_8.x86_64 python3-ldb-4.23.5-11.el9_8.x86_64 python3-samba-4.23.5-11.el9_8.x86_64
samba-4.23.5-11.el9_8.x86_64 samba-client-4.23.5-11.el9_8.x86_64 samba-client-libs-4.23.5-11.el9_8.x86_64
samba-common-4.23.5-11.el9_8.noarch samba-common-libs-4.23.5-11.el9_8.x86_64 samba-common-tools-4.23.5-11.el9_8.x86_64
samba-dc-libs-4.23.5-11.el9_8.x86_64 samba-dcerpc-4.23.5-11.el9_8.x86_64 samba-ldb-ldap-modules-4.23.5-11.el9_8.x86_64
samba-libs-4.23.5-11.el9_8.x86_64 samba-winbind-4.23.5-11.el9_8.x86_64 samba-winbind-modules-4.23.5-11.el9_8.x86_64Complete!
Investigations
I think the error in journalctl of winbind on port 135 is a spurious error as my freeipa server do not open this port even if it is allowed by the firewall. I assume this port is open when an AD is joined to the freeipa server but this is not my case. The NT_STATUS_CONNECTION_REFUSED is more relevant I think.
For the records even with version 4.23.5-12 on the samba server:
- Kerberos authentication (kinit) works.
- SSSD works.
- getent passwd works.
- FreeIPA server was reachable.
Before doing rollback I tried to do some debugging with copilot help as I am not an expert on samba. Interrestings logs maybe this ones on the samba server.
net ads status
ads_startup_int: ads_connect_creds: No logon servers are currently available to service the logon request.
net ads testjoin
ads_connect_creds: No results returned
Join to domain is not valid
smbclient -L localhost -U user
NT_STATUS_NO_LOGON_SERVERS
wb_parent_idmap_setup_lookupname_done:
Lookup domain name ‘intra’ failed ‘NT_STATUS_NOT_FOUND’
Maybe there is also something wrong with my smb.conf but testparm commands did not show anything wrong with it. My smb.conf general params on the samba server if you see something out of place.
cat /etc/samba/smb.conf
[global]
# Limit number of forked processes to avoid SMBLoris attack max smbd processes = 1000 client min protocol = SMB2# Use dedicated Samba keytab. The key there must be synchronized
# with Samba tdb databases or nothing will work#sync machine password to keytab = /etc/samba/samba.keytab
kerberos method = dedicated keytab
dedicated keytab file = FILE:/etc/samba/samba.keytab
# Set up logging per machine and Samba process log file = /var/log/samba/log.%m log level = 1# We force ‘member server’ role to allow winbind automatically
# discover what is supported by the domain controller side security = ADS server role = member server realm = INTRA.contoso.com netbios name = TLSVSL0019 workgroup = INTRA# Local writable range for IDs not coming from IPA or trusted domains
idmap config * : range = 0 - 0
idmap config * : backend = tdbidmap config INTRA : range = 976800000 - 976999999
idmap config INTRA : backend = sss…
Thanks for your help.