samba - Jul 2019 - Problem after upgrading to Debian 10

Excuse me if I bother you, but I badly need help. 

Let me describe the situation. In my network there is a group of
Windows boxes in a Windows domain (THE_DOMAIN), three computers with
Debian 9.x not linked to the domain (in a workgroup named TECHNOLOGY,
and the parameter security=user) one of which I use, and other three
computers with Debian 7.x in another workgroup (and security=share, so
no problem accessing these).

When using Debian 9.x I was able to access (by way of Nautilus) the
shared resources in all boxes in the domain THE_DOMAIN identifying me
as the user administrator of the Samba 4 domain in the dialog window.
After upgrading to Debian 10, this is no longer possible.

What I am doing wrong? Is it necessary to join the domain, after this
upgrade?

This is what I have in /etc/samba/smbusers:

# Unix_name = SMB_name1 SMB_name2 ...
root = administrator, admin
nobody = guest, pcguest, smbguest


I include my smb.conf file:
************************
[global]

# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
workgroup = TECHNOLOGY

# server string is the equivalent of the NT Description field
server string = Desarrollo

# Security mode. Defines in which mode Samba will operate. Possible
# values are share, user, server, domain and ads. Most people will want
# user level security. See the Samba-HOWTO-Collection for details.
security = user

# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
;   hosts allow = 192.168.1. 192.168.2. 127.
hosts allow = 192.168.0. 127.

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
load printers = yes

# This option tells cups that the data has already been rasterized
cups options = raw

username map = /etc/samba/smbusers
;guest account = smbguest

log file = /var/log/samba/%m.log

# Put a capping on the size of the log files (in Kb).
max log size = 50

local master = no

dns proxy = yes

[homes]
	comment = Home Directories
	browseable = no
	writeable = yes

[printers]
	comment = All Printers
	path = /usr/spool/samba
	browseable = yes
	public= yes
	guest ok =yes
# Set public = yes to allow user 'guest account' to print
;	guest ok = no
;	writeable = no
	printable = yes


[compartido]
comment = Lo que comparte Desarrollo
path = /Compartido
writeable = no
browseable = yes
guest ok = yes


-- 
M.Sc. Alberto Garc?a Fumero
Usuario Linux 97 138, registrado 10/12/1998
http://interese.cubava.cu
No son las horas que pones en tu trabajo lo que cuenta, sino el trabajo
que pones en esas horas.

On 12/07/2019 20:23, Alberto Jos? Garc?a Fumero via samba
wrote:
> Excuse me if I bother you, but I badly need help.
>
> Let me describe the situation. In my network there is a group of
> Windows boxes in a Windows domain (THE_DOMAIN),
What is the Windows DC ?
>   three computers with
> Debian 9.x not linked to the domain (in a workgroup named TECHNOLOGY,
> and the parameter security=user) one of which I use, and other three
> computers with Debian 7.x in another workgroup (and security=share, so
> no problem accessing these).
You will have a problem when you upgrade the EOL Debian Wheezy, 
'security = share' no longer exists.
>
> When using Debian 9.x I was able to access (by way of Nautilus) the
> shared resources in all boxes in the domain THE_DOMAIN identifying me
> as the user administrator of the Samba 4 domain in the dialog window.
> After upgrading to Debian 10, this is no longer possible.
>
> What I am doing wrong? Is it necessary to join the domain, after this
> upgrade?
This is probably down to the value for 'ntlm auth' being changed from 
'yes' to 'ntlmv2-only' at 4.7.0

Rowland

El vie, 12-07-2019 a las 21:05 +0100, Rowland penny via samba
escribi?:
> On 12/07/2019 20:23, Alberto Jos? Garc?a Fumero via samba wrote:
> > Excuse me if I bother you, but I badly need help.
> > 
> > Let me describe the situation. In my network there is a group of
> > Windows boxes in a Windows domain (THE_DOMAIN),
> What is the Windows DC ?
> >   three computers with
> > Debian 9.x not linked to the domain (in a workgroup named
> > TECHNOLOGY,
> > and the parameter security=user) one of which I use, and other
> > three
> > computers with Debian 7.x in another workgroup (and security=share,
> > so
> > no problem accessing these).
> You will have a problem when you upgrade the EOL Debian Wheezy, 
> 'security = share' no longer exists.
> > When using Debian 9.x I was able to access (by way of Nautilus) the
> > shared resources in all boxes in the domain THE_DOMAIN identifying
> > me
> > as the user administrator of the Samba 4 domain in the dialog
> > window.
> > After upgrading to Debian 10, this is no longer possible.
> > 
> > What I am doing wrong? Is it necessary to join the domain, after
> > this
> > upgrade?
> This is probably down to the value for 'ntlm auth' being changed
> from 
> 'yes' to 'ntlmv2-only' at 4.7.0
> 
> Rowland
> 
> 
The domain controller is a Samba 4.

So what could I do? Is it possible to modify that parameter?

-- 
M.Sc. Alberto Garc?a Fumero
Usuario Linux 97 138, registrado 10/12/1998
http://interese.cubava.cu
No son las horas que pones en tu trabajo lo que cuenta, sino el trabajo
que pones en esas horas.