Bug 7873 - ntlmssp & spnego sign & seal fails against samba member in AD running winbindd
Summary: ntlmssp & spnego sign & seal fails against samba member in AD running winbindd
Status: CLOSED FIXED
Alias: None
Product: Samba 3.5
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 3.5.4
Hardware: Other Linux
: P3 critical
Target Milestone: ---
Assignee: Michael Adam
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-12-16 21:15 UTC by Zhou Weikuan
Modified: 2014-07-25 09:14 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Zhou Weikuan 2010-12-16 21:15:36 UTC
+++ This bug was initially created as a clone of Bug #7568 +++

to reproduce: simply run RPC-BIND smbtorture test against a 3.5.4 member server in w2k8r2 domain with winbindd.
Comment 1 Zhou Weikuan 2010-12-16 21:16:51 UTC
The original bug is marked resolved fixed, I can't re-open it, so clone a new bug here:
===========================
hi samba,

we have re-tested the NTLM signing patch recently, it seems that the bug is not
fully fixed.

the repro steps are as follows:

1) net ads join
2) from a unix workstation run smbclient and logon as an AD user xyz
3) From a Windows XP run smbclient and logon as the same user
* it has to be an NTLM authentication, so we use the IP address instead of the
server name

In the log we see the following message:
[2010/11/09 10:06:17.748568,  5] libsmb/smb_signing.c:90(smb_signing_good)
  smb_signing_good: signing negotiated but not required and peer
  isn't sending correct signatures. Turning off.

Windows XP does not like this so it breaks the connection and tries again
(several times).
Eventually either Samba gets on track or it does not and the XP machine gives
up.

All.zip includes:
  log_samba.zip is an example showing the smbclient succeeding and XP failing
  logfile-windows.zip it the network trace corresponding to this log file.

  smbserver.zip is another example of a network trace where initially the
signing is failing but eventually fixes itself.

Thanks,

Weikuan Zhou
Comment 2 Stefan Metzmacher 2011-07-12 20:43:40 UTC
Does this still happen with 3.5.9?
Comment 3 Stefan Metzmacher 2012-06-22 13:18:46 UTC
ping
Comment 4 Björn Jacke 2014-07-24 20:04:55 UTC
Weikuan: is this still an issue for you with recent samba releases?
Comment 5 Zhou Weikuan 2014-07-25 01:16:42 UTC
Hi Jacke,
      I'm not sure, I have switched into another industry and no
environment to test it now..

Thanks,
Weikuan Zhou


2014-07-25 4:04 GMT+08:00 <samba-bugs@samba.org>:

> https://bugzilla.samba.org/show_bug.cgi?id=7873
>
> --- Comment #4 from Björn Jacke <bj@sernet.de> 2014-07-24 20:04:55 UTC ---
> Weikuan: is this still an issue for you with recent samba releases?
>
> --
> Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You reported the bug.
>
Comment 6 Björn Jacke 2014-07-25 09:14:31 UTC
okay, I assume this is working with the fixes that went upstream in the meantime. Thanks for your feedback!