samba - Mar 2015 - RequireSecuritySignature=1 and public share with guest not working

Hi Louis

Thank you!
As i wrote in my first post, i tried even with these settings:
        client max protocol = SMB3
        client min protocol = SMB2
        client signing = required
        server signing = required
But it was not working - as soon I use RequireSecuritySignature=1 on the client.

It seems for that the client is stopping communication since the Win7-client
expects something from samba.
net use t: \\samba\pub<file:///\\samba\pub>
               systemerror 1240

MS knowledgebase article speek about enable plain text passwords. But this is
wrong since I do not change this password-setting, just require signing.

Is somebody out there, who knows, how to setup samba for using
RequireSecuritySignature=1 on Windows Clients?

Greetz  Raphael
___________________________________________
-----Urspr?ngliche Nachricht-----
Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
Gesendet: Freitag, 13. M?rz 2015 16:21
An: samba at lists.samba.org
Cc: Olszewski, Raphael
Betreff: RE: [Samba] RequireSecuritySignature=1 and public share with guest not
working

check the output of :

echo "\n" | testparm -vv | grep signing
and
echo "\n" | testparm -vv | grep protocol

for my the default is :
client max protocol = NT1

but i dont use signing.

but i "think" you need to set the client signing = manadatory and
client max protocol = SMB2

( from man smb.conf )

but if anyone know this better on the list, please correct me.
Im not sure in this one, never used it..


Greetz,

Louis

>-----Oorspronkelijk bericht-----
>Van: r.olszewski at ssc-services.de
>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>Verzonden: vrijdag 13 maart 2015 15:57
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public share with
>guest not working
>
>Hi Louis
>I explicitly have to change on win7-client the parameter
>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>kstation\Parameters]
>from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
>and then I have the problem.
>Before everything is working.
>All solutions in the wide web just tell me to set
>RequireSecuritySignature=0, but this is NOT the solution for me since I
>have to activate RequireSecuritySignature=1 My question originally is:
>Why it is failing then? Or what I have to do, that this is working with
>RequireSecuritySignature=1?
>
>Raphael

On 16/03/15 07:56, Olszewski, Raphael wrote:
> Hi Louis
>
> Thank you!
> As i wrote in my first post, i tried even with these settings:
>          client max protocol = SMB3
>          client min protocol = SMB2
>          client signing = required
>          server signing = required
> But it was not working - as soon I use RequireSecuritySignature=1 on the
client.
>
> It seems for that the client is stopping communication since the
Win7-client expects something from samba.
> net use t: \\samba\pub<file:///\\samba\pub>
>                 systemerror 1240
>
> MS knowledgebase article speek about enable plain text passwords. But this
is wrong since I do not change this password-setting, just require signing.
>
> Is somebody out there, who knows, how to setup samba for using
RequireSecuritySignature=1 on Windows Clients?
>
> Greetz  Raphael
> ___________________________________________
> -----Urspr?ngliche Nachricht-----
> Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
> Gesendet: Freitag, 13. M?rz 2015 16:21
> An: samba at lists.samba.org
> Cc: Olszewski, Raphael
> Betreff: RE: [Samba] RequireSecuritySignature=1 and public share with guest
not working
>
> check the output of :
>
> echo "\n" | testparm -vv | grep signing
> and
> echo "\n" | testparm -vv | grep protocol
>
> for my the default is :
> client max protocol = NT1
>
> but i dont use signing.
>
> but i "think" you need to set the client signing = manadatory and
client max protocol = SMB2
>
> ( from man smb.conf )
>
> but if anyone know this better on the list, please correct me.
> Im not sure in this one, never used it..
>
>
> Greetz,
>
> Louis
>
>
>> -----Oorspronkelijk bericht-----
>> Van: r.olszewski at ssc-services.de
>> [mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>> Verzonden: vrijdag 13 maart 2015 15:57
>> Aan: samba at lists.samba.org
>> Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public share with
>> guest not working
>>
>> Hi Louis
>> I explicitly have to change on win7-client the parameter
>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>> kstation\Parameters]
> >from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
>> and then I have the problem.
>> Before everything is working.
>> All solutions in the wide web just tell me to set
>> RequireSecuritySignature=0, but this is NOT the solution for me since I
>> have to activate RequireSecuritySignature=1 My question originally is:
>> Why it is failing then? Or what I have to do, that this is working with
>> RequireSecuritySignature=1?
>>
>> Raphael
Hi, what I am struggling to understand here is, whilst you are allowing 
anybody the machine doesn't know to connect, you want to allow only 
users from some machines to connect, is this correct ?

If so, have you investigated the 'hosts allow' parameter ?

Rowland

Hi Rowland
In former time there was "security=share", now i have to use
"RequireSecuritySignature=1" on client side.
Documentation for SMB signing says, this is only possible with
"security=user", not with share.
So I switched to security=user, configured guest-access to the public share and
activated this RequireSecuritySignature=1
And then - with RequireSecuritySignature=1 - the client cannot access this share
anymore. Just changing to RequireSecuritySignature=0 the share is working.
The client says: error 1240
The Server sees only "connection reset"
All I need is a public share together with smb signing and
RequireSecuritySignature=1

Gru? Raphael
___________________________________________
-----Urspr?ngliche Nachricht-----
Von: Rowland Penny [mailto:rowlandpenny at googlemail.com]
Gesendet: Montag, 16. M?rz 2015 10:05
Betreff: Re: [Samba] RequireSecuritySignature=1 and public share with guest not
working



Hi, what I am struggling to understand here is, whilst you are allowing anybody
the machine doesn't know to connect, you want to allow only users from some
machines to connect, is this correct ?

If so, have you investigated the 'hosts allow' parameter ?

Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba