Bug 16146 - AD DC join fails with Lexmark MX410de — SMB Session Setup stuck on request-mic
Summary: AD DC join fails with Lexmark MX410de — SMB Session Setup stuck on request-mic
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.24.3
Hardware: All Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-06-21 16:59 UTC by farfade
Modified: 2026-06-21 16:59 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description farfade 2026-06-21 16:59:55 UTC
Hello,

First of all, thank you for samba <3 and sorry if I'm not clear - I'll do my best providing everything requested !

=== DESCRIPTION ===

A Lexmark MX410de printer (firmware LW90.SB4.P231) fails to join the AD domain
hosted by Samba 4.22.8. The join is triggered via the printer embedded web
server: Settings > "Join an Active Directory Domain" (Domain, User, Password).

The printer reports a generic failure. Packet capture shows the join sequence
stops at the SMB Session Setup phase.

=== ENVIRONMENT ===

- Samba 4.24.3+dfsg-1~bpo13+1 backport on Debian 13 (trixie)
- Two AD DCs: dc1 (10.0.0.1, PDC) and dc2 (10.0.0.2)
- Domain: AD.HOME, functional level 2016 (migrated from 2008)
- Client: Lexmark MX410de firmware LW90.SB4.P231 (latest available as of June 2026)
- No prior GSSAPI/Kerberos configuration on the printer

=== OBSERVED JOIN SEQUENCE (packet capture, tshark) ===

1. CLDAP UDP ping × 3 → success (flags=0x00000005)

2. SMB Negotiate Protocol Request (SMB1)
   → SMB2 Negotiate Protocol Response

3. TGS-REQ for cifs/dc1.ad.home (AES256)
   → TGS-REP: ticket obtained OK

4. SMB2 Session Setup Request (1860 bytes):
     SPNEGO negTokenInit:
       mechTypes: [Kerberos5, NTLMSSP]
       mechToken: Kerberos AP-REQ

   SMB2 Session Setup Response (165 bytes):
     Status: STATUS_MORE_PROCESSING_REQUIRED
     SPNEGO negTokenResp:
       negState: request-mic (3)
       Blob length: 23 bytes
     Session Flags: Encrypt=False

5. [No further Session Setup from client — join fails]

=== ROOT CAUSE ===

Samba returns negState=request-mic(3) in the SPNEGO Session Setup response
because the client proposes both Kerberos and NTLMSSP in its negTokenInit
(RFC 4178 section 3.2 — Samba requests a MIC to protect against mechType
downgrade attacks).

The Lexmark firmware does not implement the MIC response and abandons the
SMB handshake after receiving request-mic.

Note: with ntlm auth = disabled in smb.conf, Samba still advertises NTLMSSP
in the SMB2 Negotiate response SecurityBlob and still requests MIC when the
client proposes multiple mechanisms.

=== CLDAP FLAGS (secondary issue) ===

CLDAP UDP response returns flags=0x00000005:
  DS_SERVER_DS   (0x001) set
  DS_SERVER_LDAP (0x004) set
  DS_SERVER_PDC        NOT set
  DS_SERVER_GC         NOT set
  DS_SERVER_KDC        NOT set
  DS_SERVER_TIMESERV   NOT set
  DS_SERVER_WRITABLE   NOT set

This DC is not an RODC (UAC=532480, primaryGroupID=516).
These incomplete flags may also contribute to the join failure
(client may reject the DC as unsuitable before or after the SMB phase).

=== SMB.CONF (relevant parameters) ===

[global]
  ad dc functional level = 2016
  realm = AD.HOME
  workgroup = AD
  server role = active directory domain controller
  ldap server require strong auth = yes
  restrict anonymous = 2
  ntlm auth = disabled
  nt hash store = never
  reject md5 servers = true
  disable netbios = yes
  smb ports = 445
  client min protocol = SMB3
  smb encrypt = if_required
  server services = -dns
  tls enabled = yes
  tls verify peer = as_strict_as_possible
  idmap_ldb:use rfc2307 = yes