Red Hat Bugzilla – Bug 1413484
Unable to connect windows server 2012 servers to samba-3.6.23-36 with out disabling SMB signing
Last modified: 2018-06-19 01:10:08 EDT
Description of problem: Unable to connect windows server 2012 servers to samba with out disabling SMB signing. Registry : HKLM\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature Samba is not authenticating against AD. The user coming from Windows to samba is NOT configured and user nobody as guest should be the used at the end to write or read on the filesystem With "RequireSecuritySignature=0" the anon access is working like expected. As soon, as I set "RequireSecuritySignature=1" it is not working any more. Version-Release number of selected component (if applicable): Rhel 6.8 windows server 2012 samba-3.6.23-36 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: Customers current configuration : grep -v ^# etc/samba/smb.conf [global] workgroup = MYGROUP server string = Samba Server Version %v map to guest = bad User guest account = nobody netbios name = rchsat01 log level = 9 max log size = 0 log file = /var/log/samba/log.%m security = user passdb backend = tdbsam #server signing = auto load printers = yes cups options = raw [homes] comment = Home Directories browseable = no writable = yes [printers] comment = All Printers path = /var/spool/samba browseable = no guest ok = no writable = no printable = yes [Builds_sat01] path = /Builds browseable = yes guest ok = yes writable = yes public = yes create mask = 0777 force create mode = 0777 directory mask = 0777 However this is still failing with the error attached. I tried to reproduce the issue in-house but I could not. It continued to work with and without security signing on windows server 2012. I will upload the debug logs and the screensshots we received from the customer.
Created attachment 1241114 [details] Error
*** Bug 1495448 has been marked as a duplicate of this bug. ***
= Reproducer = == smb.conf == [global] map to guest = Bad user [testshare] path = /foo guest ok = yes == smbclient == smbclient //SERVER/testshare -U% --signing=required
Looking at the log from comment #16, smbd failed to start or update correctly. Or smbd was alredy running and the customer tried to start another instance.
Hello ASN, Got update from customer after running test-packs: Freshly installed rhel6.4 [rhel-6.4-Have-test-pack-installed] Windows-7-Client RequireSecuritySignature = 0 <--------Access share------------ Can access[ok] RequireSecuritySignature = 1 <--------Access share------------ Cannot access[FAIL] The account is not authorized to log in from this station Thanks Amit
Hello ASN, More testing on Client setup => [rhel-6.4-Have-test-pack-installed] Windows-2012-Client RequireSecuritySignature = 0 <--------Access share------------ Can access[ok] RequireSecuritySignature = 1 <--------Access share------------ Can access[ok] [rhel-6.4-Have-test-pack-installed] smbclient # smbclient //<ip>/share -U% --signing=required smb> Can access[ok] # smbclient //<ip>/share -U% --signing=auto smb> Can access[ok] Same behavior on samba4. Thanks Amit
Please Ignore Comment#19: This is correct one: [rhel-6.4-Have-test-pack-installed] Windows-2012-Client RequireSecuritySignature = 0 <--------Access share------------ Can access[ok] RequireSecuritySignature = 1 ....Cannot Not test.... [rhel-6.4-Have-test-pack-installed] smbclient # smbclient //<ip>/share -U% --signing=required smb> Can access[ok] # smbclient //<ip>/share -U% --signing=auto smb> Can access[ok] [rhel-6.4-Have-test-pack-installed] Windows-7-Client RequireSecuritySignature = 0 <--------Access share------------ Can access[ok] RequireSecuritySignature = 1 <--------Access share------------ Cannot access[FAIL] The account is not authorized to log in from this station Thanks Amit
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:1860