Bug 1475 - ntlmssp_server_auth: failed to parse NTLMSSP
ntlmssp_server_auth: failed to parse NTLMSSP
Status: RESOLVED DUPLICATE of bug 1194
Product: Samba 3.0
Classification: Unclassified
Component: ntlm_auth tool
3.0.4
x86 Linux
: P3 normal
: none
Assigned To: Andrew Bartlett
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2004-06-23 10:50 UTC by David Z. Kil
Modified: 2004-06-23 16:40 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Z. Kil 2004-06-23 10:50:54 UTC
It's unknown how to exactly reproduce this bug but I do have a dump which will
probably be helpful.  I am using Squid (squid-2.5.STABLE3) on Fedora Core 1.  I
am using the ntlm_auth for ntlm authentication in squid.  From time to time, as
users are surfing, they receive a user/password/domain dialog (if they are a
domain member they should never see this).  Within my cache.log, I see the
following logs corresponding to the exact time:

Using a Windows 98 machine:

[2004/06/21 13:30:53, 1] libsmb/ntlmssp.c:ntlmssp_server_auth(549)
  ntlmssp_server_auth: failed to parse NTLMSSP:
[2004/06/21 13:30:53, 2] lib/util.c:dump_data(1886)
  [000] 4E 54 4C 4D 53 53 50 00  03 00 00 00 18 00 18 00  NTLMSSP. ........
  [010] 50 00 00 00 00 00 00 00  68 00 00 00 0C 00 0C 00  P....... h.......
  [020] 34 00 00 00 05 00 05 00  40 00 00 00 0B 00 0B 00  4....... @.......
  [030] 45 00 00 00 53 4F 55 4E  44 54 45 43 48 49 4E 43  E...SOUN DTECHINC
  [040] 44 4F 55 47 4E 53 30 30  32 32 37 32 39 30 32 37  DOUGNS00 22729027
  [050] CD 77 E5 E8 5C 79 51 8F  0E AE 03 1B D6 5E 0B 20  .w..\yQ. .....^.
  [060] 40 A4 E1 C9 C9 00 36 26                           @.....6&
[2004/06/21 13:30:53, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615)
  Got user=[DOUGN] domain=[SOUNDTECHINC] workstation=[S0022729027] len1=24 len2=0
[2004/06/21 13:30:53, 3] utils/ntlm_auth.c:winbind_pw_check(435)
  Login for user [SOUNDTECHINC]\[DOUGN]@[S0022729027] failed due to [Logon failure]

I get very similar results when using some Windows XP Professional machines.
Comment 1 Andrew Bartlett 2004-06-23 16:40:33 UTC
This is a real bug, which I have not yet chased down.  Merging with 1194

*** This bug has been marked as a duplicate of 1194 ***