Closed xdarklight closed 3 years ago
I have a question and requests.
What kind of client is it? kernel cifs client? or smbclient of samba?
Can you give me tcpdump that captured the packets on problem ?
The your old smb client can connect samba server without setting any smb.conf of samba ?
Thanks! Let me check it.
Can you check your old client can connect with samba after adding raw NTLMv2 auth = yes smb.conf of samba ?
raw NTLMv2 auth = yes
I am finding the proper config parameter in samba's smb.conf.
thank you for looking into this!
I am finding the proper config parameter in samba's smb.conf.
to make sure I understand it correctly:
ksmbd
does)I'll try this as soon as I have some spare time (which may take until the weekend) and then update you in here
Right, I expect that your old client connection failed with samba when setting the parameter I suggested. ksmbd's smb.conf parameters are compatible with samba's one. I should find it in samba's smb.conf.
I'll try this as soon as I have some spare time (which may take until the weekend) and then update you in here
Thanks! If it is clear, I will add "raw NTLMv2 auth" parameter in ksmbd's configuration.
$ smbd --version
Version 4.12.6
$ cat /etc/samba/smb.conf
[global]
server min protocol = NT1
keepalive = 0
[ps2smb]
comment = PS2 SMB
path = /mnt/ps2
browseable = yes
read only = no
guest ok = yes
public = yes
available = yes
adding or removing raw NTLMv2 auth = yes
does not seem to make a difference
packet dump with above setting enabled (I removed everything after the successful "Tree Connect" response to keep things simple): https://gist.github.com/xdarklight/e18c83855bbd1aa278eeb61788eafc2c/raw/4c54fe8479ff138c9c2635e6f2dc1bfefbd90bff/samba4.pcap
Have you added/removed this parameter at global section like the following ? and should use_spnego = false in ksmbd at the same time.
[global] server min protocol = NT1 keepalive = 0 raw NTLMv2 auth = yes
Have you added/removed this parameter at global section like the following ?
yes, sorry for not being clear about that
I have added raw NTLMv2 auth = yes
right below keepalive = 0
and should use_spnego = false in ksmbd at the same time.
[global] server min protocol = NT1 keepalive = 0 raw NTLMv2 auth = yes
I added raw NTLMv2 auth = yes
to /etc/ksmbd/smb.conf
while keeping my should use_spnego = false
patch.
it does not seem to change anything
in the meantime I have found this inside the samba source-code: https://github.com/samba-team/samba/blob/0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0/source4/smb_server/smb/negprot.c#L299 it seems like spnego is not config dependent and instead should be enabled based on the "extended security" flag in "flags2". please see #438 and let me know what you think. it works fine for my use-case
fixed with 365d38027b3e9df5abaa86b7c8c815e723c6fca2
Hello,
I have an old SMB client which unfortunately cannot connect to
ksmbd
my server config:
I found the following TODO in
smb1pdu.c:875
:setting
conn->use_spnego = false;
make this odd client work for me.Are there any plans to make it configurable through
smb.conf
as the comment says? If not: do you have any reference that I can follow for implementing it myself?Thank you! Martin