I'm working with the Solaris bundled version of samba 3.5.5 and having a
problem with server signing. samba is configured into an active directory
domain with security = ads.
With signing enabled, connections from clients in the domain work fine.
However, connections from clients not in the domain fail:
----->net use /user:WIN\henson \\ike.unx.csupomona.edu\henson
Enter the password for 'WIN\henson' to connect to
'ike.unx.csupomona.edu':
System error 64 has occurred.
The specified network name is no longer available.
-----
Similarly, with smbclient, signed kerberos authentication works, but
signed non-kerberos authentication fails:
-----
$ smbclient --signing=required -U 'WIN\henson'
'\\ike.unx.csupomona.edu\henson'
Enter WIN\henson's password:
signing_good: BAD SIG: seq 1
session setup failed: NT_STATUS_OK
-----
If I enable debugging for smbclient it spits out:
-----
Mandatory SMB signing enabled!
SMB signing enabled!
cli_simple_set_signing: user_session_key
cli_simple_set_signing: NULL response_data
simple_packet_signature: sequence number 0
client_sign_outgoing_message: sent SMB signature of
[0000] 1E F5 1B 99 6C D0 80 5A ....l..Z
store_sequence_for_reply: stored seq = 1 mid = 3
get_sequence_for_reply: found seq = 1 mid = 3
simple_packet_signature: sequence number 1
client_check_incoming_message: BAD SIG: wanted SMB signature of
[0000] DF 9D 91 B0 77 C5 E5 CD ....w...
client_check_incoming_message: BAD SIG: got SMB signature of
[0000] 4E 74 FD EE B2 55 62 54 Nt...UbT
simple_packet_signature: sequence number 4294967292
simple_packet_signature: sequence number 4294967293
simple_packet_signature: sequence number 4294967294
simple_packet_signature: sequence number 4294967295
simple_packet_signature: sequence number 0
simple_packet_signature: sequence number 1
simple_packet_signature: sequence number 2
simple_packet_signature: sequence number 3
simple_packet_signature: sequence number 4
simple_packet_signature: sequence number 5
signing_good: BAD SIG: seq 1
SPNEGO login failed: Access denied
-----
It seems the server is sending bad signatures.
Any thoughts on this?
Thanks...
--
Paul B. Henson | (909) 979-6361 | http://www.csupomona.edu/~henson/
Operating Systems and Network Analyst | henson at csupomona.edu
California State Polytechnic University | Pomona CA 91768
