samba - May 2016 - Regression: The 'net' command is now failing to login (UNKNOWN ENUM VALUE 1003?)

This spnego stuff makes me think about "client ldap sasl wrapping =
sign"
to be added in some cases. There are threads related to that posted
recently.

Disabling spnego is, if I'm not mistaken, disabling Kerberos. Disabling
Kerberos should not be what you really want with AD : )

2016-05-26 13:23 GMT+02:00 pisymbol . <pisymbol at gmail.com>:
> On Wed, May 25, 2016 at 2:38 PM, pisymbol . <pisymbol at gmail.com>
wrote:
> > Hello:
> >
> > Platform: CentOS 6.7 x86-64
> >
> > $ rpm -qa | grep samba
> > samba-common-3.6.23-30.el6_7.x86_64
> > samba4-libs-4.2.10-6.el6_7.x86_64
> > ie-samba-utils-3.6.13-7.x86_64
> > samba-winbind-3.6.23-30.el6_7.x86_64
> > samba-client-3.6.23-30.el6_7.x86_64
> > samba-winbind-clients-3.6.23-30.el6_7.i686
> > samba-winbind-clients-3.6.23-30.el6_7.x86_64
> >
> > Problems began after requiring SMB signing (I forgot the specifics but
> > it was related to CVE-2016-2111 and the one before it I think).
> >
> >  I had to enable support for signatures on the NetApp (I'm using
their
> > latest patched 8.2.4P3D1 firmware too however it looks like it fails
> > on older releases of OnTap as well) as per their KB. That worked for
> > now making commands like rpcclient working.
> >
> > However, this now breaks the 'net' command:
> >
> > $ sudo net -d10 -U someuser%somepass -S <netapp hostname> share
> > ....
> > ntlmssp3_handle_neg_flags: Got challenge flags[0x60898205] - possible
> > downgrade detected! missing_flags[0x00000010] -
> > NT_STATUS_RPC_SEC_PKG_ERROR
> > Got NTLMSSP neg_flags=0x00000010
> >   NTLMSSP_NEGOTIATE_SIGN
> > neg_flags[0x60088205]
> > Got NTLMSSP neg_flags=0x60088205
> >   NTLMSSP_NEGOTIATE_UNICODE
> >   NTLMSSP_REQUEST_TARGET
> >   NTLMSSP_NEGOTIATE_NTLM
> >   NTLMSSP_NEGOTIATE_ALWAYS_SIGN
> >   NTLMSSP_NEGOTIATE_NTLM2
> >   NTLMSSP_NEGOTIATE_128
> >   NTLMSSP_NEGOTIATE_KEY_EXCH
> > SPNEGO login failed: NT_STATUS_RPC_SEC_PKG_ERROR
> > lang_tdb_init: /usr/lib64/samba/en_US.UTF-8.msg: No such file or
> directory
> > session setup failed: NT_STATUS_MORE_PROCESSING_REQUIRED
> > did you forget to run kinit?
> >      NetShareEnum: struct NetShareEnum
> >         out: struct NetShareEnum
> >             buffer                   : *
> >                 buffer                   : NULL
> >             entries_read             : *
> >                 entries_read             : 0x00000000 (0)
> >             total_entries            : *
> >                 total_entries            : 0x00000000 (0)
> >             resume_handle            : *
> >                 resume_handle            : 0x00000000 (0)
> >             result                   : UNKNOWN_ENUM_VALUE (1003)
> > return code = 1003
> >
> > What is UNKNOWN ENUM VALUE (1003)?
>
>
> If I turn off spnego on the client, then the net command works but now
> rpcclient doesn't:
>
> Attempt to open gencache.tdb has failed.
> internal_resolve_name: returning 1 addresses: 192.168.17.248:0
> Running timed event "tevent_req_timedout" 0x246a968
> Connecting to 192.168.17.248 at port 445
> Socket options:
>     SO_KEEPALIVE = 0
>     SO_REUSEADDR = 0
>     SO_BROADCAST = 0
>     TCP_NODELAY = 1
>     TCP_KEEPCNT = 9
>     TCP_KEEPIDLE = 7200
>     TCP_KEEPINTVL = 75
>     IPTOS_LOWDELAY = 0
>     IPTOS_THROUGHPUT = 0
>     SO_REUSEPORT = 0
>     SO_SNDBUF = 19800
>     SO_RCVBUF = 87380
>     SO_SNDLOWAT = 1
>     SO_RCVLOWAT = 1
>     Could not test socket option SO_SNDTIMEO.
>     Could not test socket option SO_RCVTIMEO.
>     TCP_QUICKACK = 1
> Failed to load /var/lib/samba/lib/upcase.dat - No such file or directory
> Failed to load /var/lib/samba/lib/lowcase.dat - No such file or directory
> Failed to load upcase.dat, will use lame ASCII-only case sensitivity rules
> Failed to load lowcase.dat, will use lame ASCII-only case sensitivity rules
> Substituting charset 'UTF-8' for LOCALE
> cli_session_setup: NT1 session setup failed: NT_STATUS_LOGON_FAILURE
> failed session setup with NT_STATUS_LOGON_FAILURE
> Cannot connect to server.  Error was NT_STATUS_LOGON_FAILURE
>
>
> Can someone please explain to me why 'net' and 'rpcclient'
> authenticate differently?
>
> Note that I tried this on our NetApp with signing on and off.
>
> -aps
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Thu, May 26, 2016 at 7:56 AM, mathias dufresne <infractory at
gmail.com> wrote:
> This spnego stuff makes me think about "client ldap sasl wrapping =
sign" to
> be added in some cases. There are threads related to that posted recently.
>
> Disabling spnego is, if I'm not mistaken, disabling Kerberos. Disabling
> Kerberos should not be what you really want with AD : )
Yes, I see that.

But why does the 'net' command and 'rpcclient' behave so much
differently in this respect?

For example right now if I turn off smb signing on our NetApp, I can
run 'rpcclient' all day long but 'net' fails.

We are trying to just list shares and a lot of scripts use the 'net
share' command which is now barfing.

-aps

On Thu, May 26, 2016 at 1:56 PM, pisymbol . <pisymbol at gmail.com>
wrote:
> On Thu, May 26, 2016 at 7:56 AM, mathias dufresne <infractory at
gmail.com> wrote:
> We are trying to just list shares and a lot of scripts use the 'net
> share' command which is now barfing.
I believe I am running into a flavor of this:

https://bugzilla.samba.org/show_bug.cgi?id=11849

But basically the smbclient and net commands are completely broken
when connecting to a NetApp now (I am trying to dump the shares
exported).

FWIW: This worked for years before the recent set of security patches.

-aps