thr3ads.net - samba - [Samba] Samba 4 empty password [Aug 2013]

If this information is useful, please help other people find it:
Share via:

Fink Oliver

2013-Aug-07 13:56 UTC

[Samba] Samba 4 empty password

Hello,

We are trying to setup a SAMBA-Server with users that have empty passwords.

We are using:
Samba 4.0.8
Kernel 3.10.5
Slackware 14.0 x64

When we set a password the login successes!

That's what we get when trying to login:

[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ media1 at BC from ipv4:10.0.99.100:62078 for krbtgt/BC at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/smbd/service_stream.c:63(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2013/08/07 13:31:46,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ media1 at BC from ipv4:10.0.99.100:62079 for krbtgt/BC at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to decrypt PA-DATA -- media1 at BC (enctype
aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type
hmac-sha1-96-aes256, key type aes256-cts-hmac-sha1-96
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to decrypt PA-DATA -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/smbd/service_stream.c:63(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2013/08/07 13:31:46,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ media1 at BC from ipv4:10.0.99.100:62080 for krbtgt/BC at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to decrypt PA-DATA -- media1 at BC (enctype
aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type
hmac-sha1-96-aes256, key type aes256-cts-hmac-sha1-96
[2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to decrypt PA-DATA -- media1 at BC
[2013/08/07 13:31:46,  3]
../source4/smbd/service_stream.c:63(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2013/08/07 13:31:46,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]

Does somebody know what we can do???

Thanks a lot in advance

Oliver

Andrew Bartlett

2013-Aug-08 05:30 UTC

head link

[Samba] Samba 4 empty password

On Wed, 2013-08-07 at 13:56 +0000, Fink Oliver wrote:> Hello,
> 
> We are trying to setup a SAMBA-Server with users that have empty passwords.
> 
> We are using:
> Samba 4.0.8
> Kernel 3.10.5
> Slackware 14.0 x64
> 
> When we set a password the login successes!
> 
> That's what we get when trying to login:
>  Kerberos: Looking for ENC-TS pa-data -- media1 at BC
> [2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>   Kerberos: Failed to decrypt PA-DATA -- media1 at BC (enctype
aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type
hmac-sha1-96-aes256, key type aes256-cts-hmac-sha1-96
> [2013/08/07 13:31:46,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>   Kerberos: Failed to decrypt PA-DATA -- media1 at BC
This means the KDC had a different hash to the one the user encrypted the time
with.

Aside from the flag 'ACB_NOPWREQ' (which does *not* mean no password
required, it actually means no password requirements, ie no minimum
length), the KDC doesn't know the length (even zero length) of the
password, it just performs calculations based on the stored hash. 

How did you set the 'empty' password in Samba?

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Catalyst IT                   http://catalyst.net.nz

Fink Oliver

2013-Aug-08 11:32 UTC

head link

[Samba] Samba 4 empty password

Hello Andrew,



Thanks for your reply.



We did try with following settings:

        smb.conf

               null passwords = Yes



        minimum password lenght set to 0





We set the password over a Windows 7 client.





Thanks a lot

Oliver






>>  Kerberos: Looking for ENC-TS pa-data -- media1 at BC
>> [2013/08/07 13:31:46,  3]
>> ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>   Kerberos: Failed to decrypt PA-DATA -- media1 at BC (enctype
>> aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for
checksum
>> type hmac-sha1-96-aes256, key type aes256-cts-hmac-sha1-96
>> [2013/08/07 13:31:46,  3]
>> ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
>>   Kerberos: Failed to decrypt PA-DATA -- media1 at BC

>This means the KDC had a different hash to the one the user encrypted the
time
>with.

>Aside from the flag 'ACB_NOPWREQ' (which does *not* mean no password
>required, it actually means no password requirements, ie no minimum
>length), the KDC doesn't know the length (even zero length) of the
>password, it just performs calculations based on the stored hash.

>How did you set the 'empty' password in Samba?

>Andrew Bartlett


--

Andrew Bartlett

http://samba.org/~abartlet/<http://samba.org/%7Eabartlet/>

Authentication Developer, Samba Team           http://samba.org

Samba Developer, Catalyst IT                   http://catalyst.net.nz





--

To unsubscribe from this list go to the following URL and read the

instructions:  https://lists.samba.org/mailman/options/samba

Possibly Parallel Threads

Search for more maybe matching threads

samba - Aug 2013 - Samba 4 empty password

[Samba] Samba 4 empty password

[Samba] Samba 4 empty password

[Samba] Samba 4 empty password

Possibly Parallel Threads