On 25/08/2020 08:28, Piviul via samba wrote:> Rowland penny via samba ha scritto il 24/08/20 alle 17:39:
>> [...]
>> As far as I am aware, SMBv1 is still readily available on Win7, but
>> from Samba 4.11.0, it is now disabled on Samba, so if you must use
>> SMBv1, you will need to set:
>>
>> client min protocol = NT1
>>
>> server min protocol = NT1
>>
>> in smb.conf
>
> ok, the samba server I'm using as test has samba 4.5.16-Debian
> installed and these are the global parameters of the smb.conf (after
> adding the client/server min protocol):
>> # Global parameters
>> [global]
>> ????server string = %h server
>> ????workgroup = DOMINIOCSA
>> ????log file = /var/log/samba/log.%m
>> ????max log size = 1000
>> ????allow insecure wide links = Yes
>> ????panic action = /usr/share/samba/panic-action %d
>> ????printcap name = cups
>> ????client min protocol = NT1
>> ????server min protocol = NT1
>> ????unix extensions = No
>> ????allow trusted domains = No
>> ????client ipc signing = if_required
>> ????client signing = if_required
>> ????map to guest = Bad User
>> ????obey pam restrictions = Yes
>> ????pam password change = Yes
>> ????passwd chat = *Enter\snew\s*\spassword:* %n\n
>> *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
>> ????passwd program = /usr/bin/passwd %u
>> ????security = DOMAIN
>> ????server signing = if_required
>> ????unix password sync = Yes
>> ????template shell = /bin/bash
>> ????winbind cache time = 1
>> ????winbind enum groups = Yes
>> ????winbind enum users = Yes
>> ????winbind use default domain = Yes
>> ????dns proxy = No
>> ????wins server = 192.168.70.2
>> ????idmap config * : range = 25000-30000
>> ????idmap config dominiocsa : range = 10000-25000
>> ????idmap config dominiocsa : backend = rid
>> ????idmap config * : backend = tdb
>> ????map archive = No
>> ????map acl inherit = Yes
>> ????inherit acls = Yes
>> ????invalid users = root
>
> when a user of the AD domain try to access to a share of this server
> (even accessing using the IP instead of the name) the authentication
> fails even if the user has the same credentials in both domains...
>
> The win10 client has smbv1 client enabled...
>
> Piviul
>
Try adding 'nltm auth = yes' to the smb.conf, it defaulted to
'no' at 4.5.0
Rowland