samba - Apr 2013 - Untrusted domains with security=ads

Hello everyone,

Samba 3.6.9 on CentOS 6.4. With "security = ads", winbind doesn't 
authenticate requests that prepend a not-existent domain to the 
username. Users that have logged into the domain authenticate 
transparently to squid with NTLM (format is domain\username), but not 
users that are logged in locally or into another domain with the same 
username and password (format is something_else\username). This wasn't 
the case with "security = domain" and a Samba 3 DC:

with security = ads:

# wbinfo -a uni-ruse\\dstoykov%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

# wbinfo -a fgdgdgd\\dstoykov%password
plaintext password authentication failed
Could not authenticate user fgdgdgd\dstoykov with plaintext password
challenge/response password authentication failed
error code was NT_STATUS_NO_SUCH_USER (0xc0000064)
error message was: No such user
Could not authenticate user fgdgdgd\dstoykov with challenge/response

with security = domain:

# wbinfo -a uni-ruse\\dstoykov%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

# wbinfo -a fgdgdgd\\dstoykov%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

"map untrusted to domain" solves the same problem for smbd, but
doesn't
seem to affect ntlm_auth.

[global]
         workgroup = UNI-RUSE
         realm = UNI-RUSE.BG
         server string          security = ADS
         load printers = No
         printcap name = /dev/null
         disable spoolss = Yes
         wins server = 172.16.0.6, 172.16.0.10
         template homedir = /dev/null
         template shell = /sbin/nologin
         idmap config * : range = 1000000-1999999
         idmap config * : backend = tdb

Is this a bug or working as designed?
Thanks,
Deyan

-- 
Deyan Stoykov, dstoykov at uni-ruse.bg
System administrator
Computing and Information Services Center
University of Ruse

On Tue, 2013-04-02 at 16:28 +0300, Deyan Stoykov wrote:
> Hello everyone,
> 
> Samba 3.6.9 on CentOS 6.4. With "security = ads", winbind
doesn't
> authenticate requests that prepend a not-existent domain to the 
> username. Users that have logged into the domain authenticate 
> transparently to squid with NTLM (format is domain\username), but not 
> users that are logged in locally or into another domain with the same 
> username and password (format is something_else\username). This wasn't 
> the case with "security = domain" and a Samba 3 DC:
> 
> with security = ads:
See "map untrusted to domain" it defaults to no. The behaviour changed
in 3.4

JAB.

-- 
Jonathan A. Buzzard                 Email: jonathan (at) buzzard.me.uk
Fife, United Kingdom.