samba - Oct 2015 - [Samba-it] samba 4.x: centos 7: Bad SMB2 signature for message

Il giorno ven, 25/09/2015 alle 11.39 +0200, Dario Lesca ha scritto:
> Yesterday, after some day the problem It reappeared
> 
> Now I try "server signing = mandatory", wait some day and let you
> know.
The problem still alive.

Today Win8* cannot access to server, into log I see this message:
> Oct 22 09:27:11 s-backup smbd[32645]: STATUS=daemon 'smbd' finished
starting up and ready to serve connectionssmb_signing_good: BAD SIG: seq 2
> Oct 22 09:27:11 s-backup smbd[32645]: [2015/10/22 09:27:11.575613,  0]
../source3/smbd/process.c:505(receive_smb_talloc)
> Oct 22 09:27:11 s-backup smbd[32645]: receive_smb: SMB Signature
verification failed on incoming packet!
seem a winbind problem, if I restart it, all work fine

Someone have some other suggest?

This is my smb.conf:

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[backup]"
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
[global]
	workgroup = STUDIO
	realm = s-backup.studio.it
	server string = Samba Server Version %v
	security = DOMAIN
	passdb backend = tdbsam:/etc/samba/account.tdb
	log file = /var/log/samba/log.%m
	max log size = 50
	server signing = required
	load printers = No
	printcap name = /dev/null
	local master = No
	domain master = No
	wins server = 192.168.50.1
	winbind enum users = Yes
	winbind enum groups = Yes
	winbind use default domain = Yes
	idmap config * : range = 1000000-9999999
	idmap config * : backend = rid
	printing = bsd
	cups options = raw
	print command = lpr -r -P'%p' %s
	lpq command = lpq -P'%p'
	lprm command = lprm -P'%p' %j
	store dos attributes = Yes

[homes]
	comment = Home Directories
	read only = No
	browseable = No

[backup]
	comment = Cartella con Backup
	path = /backup2t/rsnapshot
	valid users = @STUDIO\grpbackup
	force user = root
	force group = root
	guest ok = Yes

Many thanks

-- 
Dario Lesca
(inviato dal mio Linux Fedora 22 con Gnome 3.16)

On 22/10/15 10:03, Dario Lesca wrote:
> Il giorno ven, 25/09/2015 alle 11.39 +0200, Dario Lesca ha scritto:
>
>> Yesterday, after some day the problem It reappeared
>>
>> Now I try "server signing = mandatory", wait some day and let
you
>> know.
> The problem still alive.
>
> Today Win8* cannot access to server, into log I see this message:
>
>> Oct 22 09:27:11 s-backup smbd[32645]: STATUS=daemon 'smbd'
finished starting up and ready to serve connectionssmb_signing_good: BAD SIG:
seq 2
>> Oct 22 09:27:11 s-backup smbd[32645]: [2015/10/22 09:27:11.575613,  0]
../source3/smbd/process.c:505(receive_smb_talloc)
>> Oct 22 09:27:11 s-backup smbd[32645]: receive_smb: SMB Signature
verification failed on incoming packet!
> seem a winbind problem, if I restart it, all work fine
>
> Someone have some other suggest?
>
> This is my smb.conf:
>
> Load smb config files from /etc/samba/smb.conf
> rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
> Processing section "[homes]"
> Processing section "[backup]"
> Loaded services file OK.
> Server role: ROLE_DOMAIN_MEMBER
> [global]
> 	workgroup = STUDIO
> 	realm = s-backup.studio.it
> 	server string = Samba Server Version %v
> 	security = DOMAIN
> 	passdb backend = tdbsam:/etc/samba/account.tdb
> 	log file = /var/log/samba/log.%m
> 	max log size = 50
> 	server signing = required
> 	load printers = No
> 	printcap name = /dev/null
> 	local master = No
> 	domain master = No
> 	wins server = 192.168.50.1
> 	winbind enum users = Yes
> 	winbind enum groups = Yes
> 	winbind use default domain = Yes
> 	idmap config * : range = 1000000-9999999
> 	idmap config * : backend = rid
> 	printing = bsd
> 	cups options = raw
> 	print command = lpr -r -P'%p' %s
> 	lpq command = lpq -P'%p'
> 	lprm command = lprm -P'%p' %j
> 	store dos attributes = Yes
>
> [homes]
> 	comment = Home Directories
> 	read only = No
> 	browseable = No
>
> [backup]
> 	comment = Cartella con Backup
> 	path = /backup2t/rsnapshot
> 	valid users = @STUDIO\grpbackup
> 	force user = root
> 	force group = root
> 	guest ok = Yes
>
> Many thanks
>
Hi, the one thing I would change is these two lines:

     idmap config * : range = 1000000-9999999
     idmap config * : backend = rid

You seem to be ignoring your users :-)

I would have expected to see something like this:

     idmap config * : range = 2000-9999
     idmap config * : backend = tdb
     idmap config STUDIO : range = 1000000-9999999
     idmap config STUDIO : backend = rid

Rowland

Il giorno gio, 22/10/2015 alle 10.21 +0100, Rowland Penny ha scritto:
> Hi, the one thing I would change is these two lines:
> 
>      idmap config * : range = 1000000-9999999
>      idmap config * : backend = rid
> 
> You seem to be ignoring your users :-)
> 
> I would have expected to see something like this:
> 
>      idmap config * : range = 2000-9999
>      idmap config * : backend = tdb
>      idmap config STUDIO : range = 1000000-9999999
>      idmap config STUDIO : backend = rid
> 
> Rowland
Ok, this is a error.

Now I have set smb.conf like your suggest and restart.

I 'll see if from some days the block for Win8 users happens again

Thanks

-- 
Dario Lesca
(inviato dal mio Linux Fedora 22 con Gnome 3.16)