samba - Feb 2004 - Samba / Networking trouble since latest windows update

This is not really a Samba problem, but it does relate to Samba, in a
fashion...

In regards to:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulleti
n/MS04-004.asp

Since the latest security patch from Microsoft (last Thursday?) was
applied to common desktop machines within our school we have been
suffering from problems with network connections.

We run several Mac OS X Xserves (10.3.2; thus Samba would be Apples' own
3.0x release) as a workgroup within the medical school which are used as
samba file servers for the windows machines. However, since the last
security update, users have serious problems accessing the systems.
Authentication is against local users and groups on the machine - we
don't use ldap or active directory for the time being.

We still use the university WINS resolution, and access to other uni
shared drives 'seems' to be largely unaffected, however access to our
own servers is largely a hit and miss affair - users connect and then
will pause for a minute or more... access will then appear to be fine -
directory browsing, opening files etc.. , but then all of a sudden the
connection will hang again, taking down explorer and the desktop, thus
requiring a manual re-launch of explorer. While the system is connected
and not hung, all normal use is fine, but the hanging connection is, for
all intents and purposes, completely random - there are no errors in any
system or samba logs.

This occurs on every users machine that is on common desktop and thus
has had the update installed, and on non common desktop machines that
users have manually installed the security update (these users started
to see problems last Friday after applying the update). Those without
the update installed are completely unaffected.

Non-windows clients accessing our servers are unaffected (solaris,
mac-os, mac-os x), as is non-smb traffic (http/ftp, mysql, rsync, ssh
etc.). Servers have been running pretty much continuously without
problem since they were installed months ago. Bandwidth and cpu use at
our servers are all within normal levels and are not even close to 50% -
we routinely rsync several gigabytes of data from these servers to our
main Solaris box every day and this also seems to be unaffected.

Has anyone heard any other reports of network problems with this update?
I appreciate it's a bit of a difficult siutation to fully understand to
people outside of Newcastle University, but it would really help if
anyone had heard of anything related to this security update, or
problems it has caused.

I'm under the impression that this windows update has changed some
settings in or the registry on all client machines... as to what it
is... I'm at a loss.

 John Snowdon - IT Support Specialist
-==========================================-
 Faculty of Medical Sciences Computing Dept
 School of Medical Education Development
 University of Newcastle

For additional info the patch only seems to be affecting Mac OS X
versions of Samba:

Mac OS X 10.3.2 Server Details (Apple Samba 3.0.0rc2)
Local user/group authentication
Workgroup
No WINS support
Server <-> Patched XP Client = random network hanging and dropouts while
browsing.
Server <-> Unpatched XP Client = Ok
Server <-> Patched 2K Client = Ok
Server <-> Unpatched 2K Client = Ok
Server <-> Non-Windows Client = Ok

Solaris 9 Server Details (Samba 2.2.x) 
Local user/group authentication
Workgroup
No WINS support
Server <-> Patched XP Client = Ok
Server <-> Unpatched XP Client = Ok
Server <-> Patched 2K Client = Ok
Server <-> Unpatched 2K Client = Ok

Linux Server Details (Samba 2.2.x & 3)
ldap authentication
Server <-> Patched XP Client = Ok
Server <-> Unpatched XP Client = Ok
Server <-> Patched 2K Client = Ok
Server <-> Unpatched 2K Client = Ok

I've upped the log level to 10 and the output is exactly the same from
working and non-working clients; the log doesn't hang half way through
the operation either - it seems as if it completes everything ok, ie the
output of the log stops at the same place it does when the operation
completes successfully on a non-patched XP or 2K client. Network load is
pretty average; I've even turned off all WINS resolution (the resolve
list in smb.conf is simply lmhost and host now) to see if that was
causing problems; nope.

smbstatus shows everyone connected ok, files open etc. smbclient queries
the server and brings back the shares fine.

Do we have any idea as to what was in that Microsoft IE cumulative
update (MS04-004, KB832894) that could have caused this problem on XP?
It's bizarre; sometimes it will work fine and then only hang when
changing back up a directory, others it will hang for minutes when you
just first try to open a drive.

The problem has got to be client side, I'm almost certain of it.

-John
>-----Original Message-----
>From: John Snowdon [mailto:J.P.Snowdon@newcastle.ac.uk] 
>Sent: 10 February 2004 16:08
>To: samba@lists.samba.org
>Subject: [Samba] Samba / Networking trouble since latest windows update
>
>
>This is not really a Samba problem, but it does relate to Samba, in a
>fashion...
>
>In regards to:
>
>http://www.microsoft.com/technet/treeview/?url=/technet/securit
>y/bulleti
>n/MS04-004.asp
>
>Since the latest security patch from Microsoft (last Thursday?) was
>applied to common desktop machines within our school we have been
>suffering from problems with network connections.
>
>We run several Mac OS X Xserves (10.3.2; thus Samba would be 
>Apples' own
>3.0x release) as a workgroup within the medical school which 
>are used as
>samba file servers for the windows machines. However, since the last
>security update, users have serious problems accessing the systems.
>Authentication is against local users and groups on the machine - we
>don't use ldap or active directory for the time being.
>
>We still use the university WINS resolution, and access to other uni
>shared drives 'seems' to be largely unaffected, however access to
our
>own servers is largely a hit and miss affair - users connect and then
>will pause for a minute or more... access will then appear to be fine -
>directory browsing, opening files etc.. , but then all of a sudden the
>connection will hang again, taking down explorer and the desktop, thus
>requiring a manual re-launch of explorer. While the system is connected
>and not hung, all normal use is fine, but the hanging 
>connection is, for
>all intents and purposes, completely random - there are no 
>errors in any
>system or samba logs.
>
>This occurs on every users machine that is on common desktop and thus
>has had the update installed, and on non common desktop machines that
>users have manually installed the security update (these users started
>to see problems last Friday after applying the update). Those without
>the update installed are completely unaffected.
>
>Non-windows clients accessing our servers are unaffected (solaris,
>mac-os, mac-os x), as is non-smb traffic (http/ftp, mysql, rsync, ssh
>etc.). Servers have been running pretty much continuously without
>problem since they were installed months ago. Bandwidth and cpu use at
>our servers are all within normal levels and are not even 
>close to 50% -
>we routinely rsync several gigabytes of data from these servers to our
>main Solaris box every day and this also seems to be unaffected.
>
>Has anyone heard any other reports of network problems with 
>this update?
>I appreciate it's a bit of a difficult siutation to fully understand to
>people outside of Newcastle University, but it would really help if
>anyone had heard of anything related to this security update, or
>problems it has caused.
>
>I'm under the impression that this windows update has changed some
>settings in or the registry on all client machines... as to what it
>is... I'm at a loss.