samba - Jul 2023 - Test-ComputerSecureChannel -Verbose False since windows 10/11 update 07/2023

Hello,

since we install the most recent windows updates from 07/2023
Test-ComputerSecureChannel -Verbose
show False [4].

Moved the machine to local workgroup, deleted machine account on the
ad controller
and rejoined it (which works), but Test-ComputerSecureChannel -Verbose
show again False.

I'm not sure this is an issue on the samba or on the windows side.

Affected samba versions so far:
4.17.8+dfsg-2 (Debian 12) [1]
4.18.x (mjt packages) [2]
4.15.13+dfsg-0 (ubuntu) [3]

Any ideas what we can do/test?

Thank you.

Samuel

[1] https://lists.samba.org/archive/samba/2023-July/245749.html
[2] https://lists.samba.org/archive/samba/2023-July/245763.html
[3] https://lists.samba.org/archive/samba/2023-July/245761.html

[4]
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

On 12/07/2023 14:03, Samuel Wolf via samba wrote:
> Hello,
> 
> since we install the most recent windows updates from 07/2023
> Test-ComputerSecureChannel -Verbose
> show False [4].
> 
> Moved the machine to local workgroup, deleted machine account on the
> ad controller
> and rejoined it (which works), but Test-ComputerSecureChannel -Verbose
> show again False.
> 
> I'm not sure this is an issue on the samba or on the windows side.
> 
> Affected samba versions so far:
> 4.17.8+dfsg-2 (Debian 12) [1]
> 4.18.x (mjt packages) [2]
> 4.15.13+dfsg-0 (ubuntu) [3]
> 
> Any ideas what we can do/test?
> 
> Thank you.
> 
> Samuel
> 
> [1] https://lists.samba.org/archive/samba/2023-July/245749.html
> [2] https://lists.samba.org/archive/samba/2023-July/245763.html
> [3] https://lists.samba.org/archive/samba/2023-July/245761.html
> 
> [4]
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1
> 

I am not convinced this is a Samba problem. It could be that Samba isn't 
providing something that Windows now expects, or Samba is providing 
something that Windows doesn't expect, but I think it is more likely 
that it has something to do with the 130 CVE's that Microsoft shipped 
yesterday:

https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul

It wouldn't be the first time Microsoft broke something while fixing 
something else.

By all means open a bug report, Samba may need to change something to 
get things working again, but it will probably require level 10 logs and 
network traces to workout just what is going on.

Rowland

Hi all,

just fyi:

https://lists.samba.org/archive/cifs-protocol/2023-July/004004.html

Cheers!
-slow

-- 
Ralph Boehme, Samba Team                      https://samba.org/
SerNet Samba Team Lead                     https://sernet.de/en/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20230713/6c043303/OpenPGP_signature.sig>

Hi everyone!

On 7/12/23 15:03, Samuel Wolf via samba wrote:
> Any ideas what we can do/test?
thanks to Stefan Metzmacher we have a working fix, it's available at the 
bugreport

https://bugzilla.samba.org/show_bug.cgi?id=15418

We're just about to release updated SAMBA+ packages, hopefully 
distributions and other packagers pick up the fix quickly and ship updates.

-slow

-- 
Ralph Boehme, Samba Team                      https://samba.org/
SerNet Samba Team Lead                     https://sernet.de/en/
SAMBA+ Samba packages                        https://samba.plus/
SAMBA+ AIX Webinar             https://samba.plus/samba-webinars

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20230713/4f671a05/OpenPGP_signature.sig>