hierynomus / smbj

Server Message Block (SMB2, SMB3) implementation in Java
Other
694 stars 178 forks source link

STATUS_SERVER_UNAVAILABLE - STATUS_OTHER(0xc0000466) #830

Closed sgonchigar closed 5 days ago

sgonchigar commented 1 month ago

Hello,

Thank you for making this utility available. Have been using it for 1+year. 2 months back some changes were made on the networking side, vlan switch etc. What used to be 95% successful calls are now 50-60%. The error is 466. It's like pass,pass......fail, fail...pass,pass and so on. While researching, came across this similar issue here https://github.com/jborean93/smbprotocol/issues/61. looking to see if you have any suggestions that I can try.

[main] INFO com.hierynomus.smbj.connection.PacketEncryptor - Initialized PacketEncryptor with Cipher << AES_128_GCM >> [main] INFO com.hierynomus.smbj.connection.Connection - Successfully connected to: server Exception in thread "main" com.hierynomus.mssmb2.SMBApiException: STATUS_OTHER (0xc0000466): Authentication failed for 'AD profile' using com.hierynomus.smbj.auth.NtlmSealer@1003cfeb at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:154) at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152) at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119) at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202) at CIFS_List_Dir_v2.main(CIFS_List_Dir_v2.java:175)

Thank you for your any input. Was using 0.13 version.

sgonchigar commented 2 weeks ago

compared the debug logs between working and non-working share, What I am seeing is in non-working is "Signing with NTLM Extended Session Security"

[main] DEBUG com.hierynomus.protocol.commons.socket.ProxySocketFactory - Connecting to server1.test.net [main] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpPacketReader - Starting PacketReader on thread: Packet Reader for server1.test.net [main] DEBUG com.hierynomus.smbj.connection.SMBProtocolNegotiator - Negotiating dialects [SMB_2_0_2, SMB_2_1, SMB_3_0, SMB_3_0_2, SMB_3_1_1] [main] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpTransport - Writing packet SMB_COM_NEGOTIATE [main] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Awaiting << 0 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpPacketReader - Received packet SMB2_NEGOTIATE with message id << 0 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.connection.packet.SMB2CreditGrantingPacketHandler - Server granted us 1 credits for SMB2_NEGOTIATE with message id << 0 >>, now available: 1 credits [Packet Reader for server1.test.net] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Setting << 0 >> to SMB2_NEGOTIATE with message id << 0 >> [main] DEBUG com.hierynomus.smbj.connection.Connection - Granted 1 (out of 1) credits to SMB2_NEGOTIATE with message id << 1 >> [main] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpTransport - Writing packet SMB2_NEGOTIATE with message id << 1 >> [main] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Awaiting << 1 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpPacketReader - Received packet SMB2_NEGOTIATE with message id << 1 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.connection.packet.SMB2CreditGrantingPacketHandler - Server granted us 1 credits for SMB2_NEGOTIATE with message id << 1 >>, now available: 1 credits [Packet Reader for server1.test.net] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Setting << 1 >> to SMB2_NEGOTIATE with message id << 1 >> [main] DEBUG com.hierynomus.smbj.connection.SMBProtocolNegotiator - Negotiated the following connection settings: ConnectionContext{ serverGuid=0111111-6246-4234-a290-c11111bfaed9, serverName='server1.test.net', negotiatedProtocol=NegotiatedProtocol{dialect=SMB_3_1_1, maxTransactSize=65536, maxReadSize=1048576, maxWriteSize=1048576}, clientGuid=1111111ae-111a3-4ae6-a41d-cedca2f7cdaa, clientCapabilities=[SMB2_GLOBAL_CAP_DFS, SMB2_GLOBAL_CAP_LARGE_MTU], serverCapabilities=[SMB2_GLOBAL_CAP_DFS, SMB2_GLOBAL_CAP_LEASING, SMB2_GLOBAL_CAP_LARGE_MTU, SMB2_GLOBAL_CAP_PERSISTENT_HANDLES], clientSecurityMode=1, serverSecurityMode=3, server='com.hierynomus.smbj.server.Server@c8ac4009' } [main] INFO com.hierynomus.smbj.connection.PacketEncryptor - Initialized PacketEncryptor with Cipher << null >> [main] INFO com.hierynomus.smbj.connection.Connection - Successfully connected to: server1.test.net [main] DEBUG com.hierynomus.smbj.auth.NtlmAuthenticator - Initialized Authentication of using NTLM [main] DEBUG com.hierynomus.smbj.connection.Connection - Granted 1 (out of 1) credits to SMB2_SESSION_SETUP with message id << 2 >> [main] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpTransport - Writing packet SMB2_SESSION_SETUP with message id << 2 >> [main] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Awaiting << 2 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpPacketReader - Received packet SMB2_SESSION_SETUP with message id << 2 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.connection.packet.SMB2CreditGrantingPacketHandler - Server granted us 128 credits for SMB2_SESSION_SETUP with message id << 2 >>, now available: 128 credits [Packet Reader for server1.test.net] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Setting << 2 >> to SMB2_SESSION_SETUP with message id << 2 >> [main] DEBUG com.hierynomus.smbj.connection.SMBSessionBuilder - More processing required for authentication of using com.hierynomus.smbj.auth.NtlmSealer@7c348a50 [main] DEBUG com.hierynomus.smbj.auth.NtlmAuthenticator - Received token: a1 82 00 fd ......... [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,1],] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,0],] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,1],] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,2],] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1Sequence[[ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,0],], ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,1],], ASN1TaggedObject[ASN1Tag[CONTEXT_SPECIFIC,CONSTRUCTED,2],]]] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1Enumerated[1] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1ObjectIdentifier[1.3.6.1.4.1.311.2.2.10] [main] DEBUG com.hierynomus.asn1.ASN1InputStream - Read ASN.1 object: ASN1OctetString[[78, 84, 76, ........]] [main] DEBUG com.hierynomus.smbj.auth.NtlmAuthenticator - Received NTLM challenge from: test [main] DEBUG com.hierynomus.smbj.auth.NtlmSealer - Calculating signing and sealing keys for NTLM Extended Session Security [main] DEBUG com.hierynomus.smbj.auth.NtlmSealer - Signing with NTLM Extended Session Security [main] DEBUG com.hierynomus.smbj.connection.Connection - Granted 1 (out of 128) credits to SMB2_SESSION_SETUP with message id << 3 >> [main] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpTransport - Writing packet SMB2_SESSION_SETUP with message id << 3 >> [main] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Awaiting << 3 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.transport.tcp.direct.DirectTcpPacketReader - Received packet SMB2_SESSION_SETUP with message id << 3 >> [Packet Reader for server1.test.net] DEBUG com.hierynomus.smbj.connection.packet.SMB2CreditGrantingPacketHandler - Server granted us 1 credits for SMB2_SESSION_SETUP with message id << 3 >>, now available: 128 credits [Packet Reader for server1.test.net] DEBUG com.hierynomus.protocol.commons.concurrent.Promise - Setting << 3 >> to SMB2_SESSION_SETUP with message id << 3 >> Exception in thread "main" com.hierynomus.mssmb2.SMBApiException: STATUS_OTHER (0xc0000466): Authentication failed for 'AD profile' using com.hierynomus.smbj.auth.NtlmSealer@7c348a50 at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:154) at com.hierynomus.smbj.connection.SMBSessionBuilder.setupSession(SMBSessionBuilder.java:152) at com.hierynomus.smbj.connection.SMBSessionBuilder.establish(SMBSessionBuilder.java:119) at com.hierynomus.smbj.connection.Connection.authenticate(Connection.java:202) at CIFS_List_Dir_v2.main(CIFS_List_Dir_v2.java:147)

sgonchigar commented 5 days ago

IT team applied below patch and it resolved the issue. Root cause: SU530: [Impact Critical] NTLM authentication fails due to enforcement of Netlogon RPC sealing (Microsoft CVE-2022-38023) Problem resolution: Upgraded NetApp to ONTAP Release 9.10.1P12, a fixed version of the SU530 issue.