LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Slackware (https://www.linuxquestions.org/questions/slackware-14/)
-   -   Had to revert Samba to 4.4.16-i586-3 from 4.6.16-i586-1 (https://www.linuxquestions.org/questions/slackware-14/had-to-revert-samba-to-4-4-16-i586-3-from-4-6-16-i586-1-a-4175636990/)

ljb643 08-23-2018 06:32 PM

Had to revert Samba to 4.4.16-i586-3 from 4.6.16-i586-1
 
Slackware 14.2, 32 bit. I installed the update patch to samba-4.6.16, restarted Samba services, and found that I was unable to connect from a Windows PC. No error on the Windows side, just keeps popping up the login box. No error logged on the server side. Wireshark tells me the server is sending STATUS_LOGON_FAILURE after credentials are supplied from the Windows PC.

This is a very simple setup: Samba on Linux configured as a stand-alone server and is also the master browser, a single share, local authentication. I am NOT trying to connect with guest user (as in another thread here). I've been using the same setup for a long time without changing anything.

Linux systems can connect to 4.6.16 using either smbclient or mount -t cifs, but no go from Windows. I reverted to the previous Slackware patch samba-4.4.16-i583-3 and connection from Windows works now.

Eventually I'm going to have to wade into this, increase logging levels, read through the change history for Samba, etc. But if anyone has any tips on something relevant that broke or changed from 4.4.x to 4.6.x that would probably help a lot

ferrari 08-23-2018 07:04 PM

Can you share your working smb.conf?

Just in case the following is helpful here...
https://askubuntu.com/questions/1095...to-windows-box

ljb643 08-23-2018 09:00 PM

Thanks, but the askubuntu thread is about trying to connect the other way: Linux client to Windows server, and doesn't seem to apply.

Before I post my smb.conf - which I've been using without change for many years - I should try re-installing 4.6.16 and running it with a higher log level to see if it has anything useful to say.

But I'm still very interested if anyone knows of a change from 4.4 to 4.6 that might cause login failures from Windows XP. (Sorry, forgot to mention it was XP, in case that is relevant.)

upnort 08-23-2018 09:25 PM

Quote:

But I'm still very interested if anyone knows of a change from 4.4 to 4.6 that might cause login failures from Windows XP.
A guess. XP is using SMB 1 and Samba 4.6 defaults to disabling SMB 1?

ferrari 08-23-2018 10:21 PM

Quote:

Thanks, but the askubuntu thread is about trying to connect the other way: Linux client to Windows server, and doesn't seem to apply.
Sorry, missed that. :D As unport speculated, recent samba versions have disabled SMBv1 (NT1) by default. It can be enabled via smb.conf, but there are security issues with doing so.

ljb643 08-25-2018 12:52 PM

Close but not quite. It isn't the protocol level, but the authentication level default change that broke my setup. Starting with Samba-4.5, the defaults were changed so that NTLM authentication is disabled, requiring NTLMv2. The fix for me (yes it has security issues) was to add in smb.conf:
Code:

ntlm auth = yes

ljb643 08-26-2018 07:40 PM

Followup and correction: If you have Windows XP systems that need to connect to the updated Samba 4.6.x in Slackware, you have 2 choices. (1) Enable the Samba server to accept NTLM (v1) authentication, as in my previous post, or (2) Enable NTLMv2 on each Windows XP system. Although (2) is better security, this is XP and security probably means keeping it off the network... To enable XP to do NTLMv2 authentication there are 2 registry keys to change as described here.

allend 09-19-2018 10:32 AM

Just ran into this myself.
As noted by @ljb643 in post #6 and #7, and confirmed by 'man smb.conf'
Quote:

ntlm auth (G)
This parameter determines whether or not smbd(8) will attempt to authenticate users using the NTLM encrypted password response. If disabled, either the lanman password hash or an NTLMv2 response will need to be sent by the client.
If this option, and lanman auth are both disabled, then only NTLMv2 logins will be permitted. Not all clients supportNTLMv2, and most will require special configuration to use it.
The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
The default changed from "yes" to "no" with Samba 4.5.
Slackware 14.2 had
Quote:

Tue Mar 13 21:12:51 UTC 2018
...
patches/packages/samba-4.4.16-x86_64-3_slack14.2.txz: Rebuilt.
then
Quote:

Fri Aug 17 16:52:04 UTC 2018
...
patches/packages/samba-4.6.16-x86_64-1_slack14.2.txz: Upgraded.
For me, the fix has been to edit the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel to value 3 on the affected Windows XP machines. https://support.microsoft.com/en-au/...-a-network-att

PROBLEMCHYLD 10-03-2018 02:53 PM

Quote:

Originally Posted by allend (Post 5905333)
For me, the fix has been to edit the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel to value 3 on the affected Windows XP machines. https://support.microsoft.com/en-au/...-a-network-att

Thanks, this worked for me too.

cesarsj 05-21-2020 04:55 PM

I am looking to update Samba to 4.4.16 to version 4.6.16. I saw that the reported problem occurred on Windows XP machines. Does it also occur on Windows 7 and Windows 10?

bassmadrigal 05-21-2020 06:23 PM

Quote:

Originally Posted by cesarsj (Post 6125854)
I am looking to update Samba to 4.4.16 to version 4.6.16. I saw that the reported problem occurred on Windows XP machines. Does it also occur on Windows 7 and Windows 10?

It shouldn't. It was just the default authentication used in XP was insecure, so it was changed in Windows Vista and beyond. Samba finally defaulted to a more secure version of authentication, which isn't supported out of the box with XP and causes this problem, but it should only occur on XP based machines.

Quote:

In Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, the default is Send NTLMv2 response only.

SOURCE:https://docs.microsoft.com/en-us/pre...852207(v=ws.11)


All times are GMT -5. The time now is 09:34 AM.