thr3ads.net - samba - [Samba] RequireSecuritySignature=1 and public share with guest not working [Mar 2015]

If this information is useful, please help other people find it:
Share via:

L.P.H. van Belle

2015-Mar-13 10:21 UTC

[Samba] RequireSecuritySignature=1 and public share with guest not working

strange i did not change anything in my windows 7 64bit. 
This is my full setup pretty basic.
Ubuntu 14.04.2 LTS, Trusty Tahr, with sernet samba 4.1.17-9

I do have 1 user for samba.

pdbedit -L
xbmc:5000:MediaUser

[global]

   workgroup = PRIVE
   server string = %h server
   dns proxy = yes
;   name resolve order = lmhosts host wins bcast

#### Networking ####
#   interfaces = 127.0.0.0/8 eth0
#   bind interfaces only = yes

#### Debugging/Accounting ####
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

####### Authentication #######
## stand alone everything open.
   security = user
   guest ok = yes
   map to guest = bad password
####
   encrypt passwords = true
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:*
%n\n *password\supdated\ssuccessfully* .
   pam password change = yes


########## Printing ##########
    #---- disable printing completely
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes

#======================= Share Definitions ======================
[homes]
    comment = Home Directorie
    browseable = no
    read only = yes
    valid users = %S

[backups]
    comment = Backups Share
    path = /media/diverse/backups
    force user = xbmc
    read only = no
    guest ok = yes
 

>-----Oorspronkelijk bericht-----
>Van: r.olszewski at ssc-services.de 
>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>Verzonden: vrijdag 13 maart 2015 10:42
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public 
>share with guest not working
>
>Hi
>I tried exactly your type of config.
>
>With "RequireSecuritySignature=0" the anon access is working 
>like expected.
>As soon, as I set "RequireSecuritySignature=1" it is not 
>working anymore.
>
>So it seem to be not the problem to configure the 
>guest-access. But seems the problem with requiring the signing.
>Thought it can be fixed with the right config, but did not 
>find a working combination.
>
>Do i have to setup certificates for the signing? 
>Or how the messages will be signed?
>My guess is, that the signing isn't working like expected ...
>
>Gru? Raphael
>___________________________________________
>-----Urspr?ngliche Nachricht-----
>Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
>Gesendet: Freitag, 13. M?rz 2015 09:08
>
>Hai,
>
>Try these settings in global settings.
>
>####### Authentication #######
>## stand alone everything open.
>?? security = user
>?? guest ok = yes
>?? map to guest = bad password
>
>add these to the share.
>guest ok = yes
>
>Sets samba open without pasword prompt.
>I use it at home for my kodi server.
>
>Greetz,
>
>Louis
>
>
>>-----Oorspronkelijk bericht-----
>>Van: r.olszewski at ssc-services.de
>>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>>Verzonden: donderdag 12 maart 2015 18:17
>>
>>Hello
>>I have an samba server with a public share. It was configured with
>>security=share.
>>Now I have to tight security with setting those flags in the windows
>>client:
>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>>kstation\Parameters]
>>EnablePlainTextPassword=0
>>EnableSecuritySignature=1
>>RequireSecuritySignature=1
>>
>..
>>
>>The Client shows ReasonCode: 0x80004005 When I change registry to
>>RequireSecuritySignature=0, I can access
>>
>>How I have to configure the smb-server to have a real public share for
>>windows7-clients not being configured especially (domain,
>>computer-account, user, ...) Do I understand Security-signature wrong?
>>Is this scenario possible without being the samba server joined to the
>>domain? (What I wanted)
>>
>>Raphael
>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:? https://lists.samba.org/mailman/options/samba
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

Olszewski, Raphael

2015-Mar-13 14:57 UTC

head link

[Samba] RequireSecuritySignature=1 and public share with guest not working

Hi Louis
I explicitly have to change on win7-client the parameter
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]
from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
and then I have the problem.
Before everything is working.
All solutions in the wide web just tell me to set RequireSecuritySignature=0,
but this is NOT the solution for me since I have to activate
RequireSecuritySignature=1
My question originally is: Why it is failing then? Or what I have to do, that
this is working with RequireSecuritySignature=1?

Raphael



___________________________________________
-----Urspr?ngliche Nachricht-----
Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
Gesendet: Freitag, 13. M?rz 2015 11:22
An: samba at lists.samba.org
Betreff: Re: [Samba] RequireSecuritySignature=1 and public share with guest not
working

strange i did not change anything in my windows 7 64bit.
This is my full setup pretty basic.
Ubuntu 14.04.2 LTS, Trusty Tahr, with sernet samba 4.1.17-9

I do have 1 user for samba.

pdbedit -L
xbmc:5000:MediaUser

[global]

   workgroup = PRIVE
   server string = %h server
   dns proxy = yes
;   name resolve order = lmhosts host wins bcast

#### Networking ####
#   interfaces = 127.0.0.0/8 eth0
#   bind interfaces only = yes

#### Debugging/Accounting ####
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

####### Authentication #######
## stand alone everything open.
   security = user
   guest ok = yes
   map to guest = bad password
####
   encrypt passwords = true
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:*
%n\n *password\supdated\ssuccessfully* .
   pam password change = yes


########## Printing ##########
    #---- disable printing completely
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes

#======================= Share Definitions ======================
[homes]
    comment = Home Directorie
    browseable = no
    read only = yes
    valid users = %S

[backups]
    comment = Backups Share
    path = /media/diverse/backups
    force user = xbmc
    read only = no
    guest ok = yes


>-----Oorspronkelijk bericht-----
>Van: r.olszewski at ssc-services.de
>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>Verzonden: vrijdag 13 maart 2015 10:42
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public share with
>guest not working
>
>Hi
>I tried exactly your type of config.
>
>With "RequireSecuritySignature=0" the anon access is working like
>expected.
>As soon, as I set "RequireSecuritySignature=1" it is not working
>anymore.
>
>So it seem to be not the problem to configure the guest-access. But
>seems the problem with requiring the signing.
>Thought it can be fixed with the right config, but did not find a
>working combination.
>
>Do i have to setup certificates for the signing?
>Or how the messages will be signed?
>My guess is, that the signing isn't working like expected ...
>
>Gru? Raphael
>___________________________________________
>-----Urspr?ngliche Nachricht-----
>Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
>Gesendet: Freitag, 13. M?rz 2015 09:08
>
>Hai,
>
>Try these settings in global settings.
>
>####### Authentication #######
>## stand alone everything open.
>   security = user
>   guest ok = yes
>   map to guest = bad password
>
>add these to the share.
>guest ok = yes
>
>Sets samba open without pasword prompt.
>I use it at home for my kodi server.
>
>Greetz,
>
>Louis
>
>
>>-----Oorspronkelijk bericht-----
>>Van: r.olszewski at ssc-services.de
>>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>>Verzonden: donderdag 12 maart 2015 18:17
>>
>>Hello
>>I have an samba server with a public share. It was configured with
>>security=share.
>>Now I have to tight security with setting those flags in the windows
>>client:
>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>>kstation\Parameters]
>>EnablePlainTextPassword=0
>>EnableSecuritySignature=1
>>RequireSecuritySignature=1
>>
>..
>>
>>The Client shows ReasonCode: 0x80004005 When I change registry to
>>RequireSecuritySignature=0, I can access
>>
>>How I have to configure the smb-server to have a real public share for
>>windows7-clients not being configured especially (domain,
>>computer-account, user, ...) Do I understand Security-signature wrong?
>>Is this scenario possible without being the samba server joined to the
>>domain? (What I wanted)
>>
>>Raphael
>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

L.P.H. van Belle

2015-Mar-13 15:20 UTC

head link

[Samba] RequireSecuritySignature=1 and public share with guest not working

check the output of : 

echo "\n" | testparm -vv | grep signing
and 
echo "\n" | testparm -vv | grep protocol 

for my the default is :  
client max protocol = NT1 

but i dont use signing. 

but i "think" you need to set the client signing = manadatory 
and 
client max protocol = SMB2 

( from man smb.conf ) 

but if anyone know this better on the list, please correct me. 
Im not sure in this one, never used it.. 


Greetz, 

Louis

>-----Oorspronkelijk bericht-----
>Van: r.olszewski at ssc-services.de 
>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>Verzonden: vrijdag 13 maart 2015 15:57
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public 
>share with guest not working
>
>Hi Louis
>I explicitly have to change on win7-client the parameter 
>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>kstation\Parameters]
>from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
>and then I have the problem.
>Before everything is working.
>All solutions in the wide web just tell me to set 
>RequireSecuritySignature=0, but this is NOT the solution for 
>me since I have to activate RequireSecuritySignature=1
>My question originally is: Why it is failing then? Or what I 
>have to do, that this is working with RequireSecuritySignature=1?
>
>Raphael
>
>
>
>___________________________________________
>-----Urspr?ngliche Nachricht-----
>Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
>Gesendet: Freitag, 13. M?rz 2015 11:22
>An: samba at lists.samba.org
>Betreff: Re: [Samba] RequireSecuritySignature=1 and public 
>share with guest not working
>
>strange i did not change anything in my windows 7 64bit.
>This is my full setup pretty basic.
>Ubuntu 14.04.2 LTS, Trusty Tahr, with sernet samba 4.1.17-9
>
>I do have 1 user for samba.
>
>pdbedit -L
>xbmc:5000:MediaUser
>
>[global]
>
>   workgroup = PRIVE
>   server string = %h server
>   dns proxy = yes
>;   name resolve order = lmhosts host wins bcast
>
>#### Networking ####
>#   interfaces = 127.0.0.0/8 eth0
>#   bind interfaces only = yes
>
>#### Debugging/Accounting ####
>   log file = /var/log/samba/log.%m
>   max log size = 1000
>   syslog = 0
>   panic action = /usr/share/samba/panic-action %d
>
>####### Authentication #######
>## stand alone everything open.
>   security = user
>   guest ok = yes
>   map to guest = bad password
>####
>   encrypt passwords = true
>   passdb backend = tdbsam
>   obey pam restrictions = yes
>   unix password sync = yes
>   passwd program = /usr/bin/passwd %u
>   passwd chat = *Enter\snew\s*\spassword:* %n\n 
>*Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
>   pam password change = yes
>
>
>########## Printing ##########
>    #---- disable printing completely
>    load printers = no
>    printing = bsd
>    printcap name = /dev/null
>    disable spoolss = yes
>
>#======================= Share Definitions ======================>
>[homes]
>    comment = Home Directorie
>    browseable = no
>    read only = yes
>    valid users = %S
>
>[backups]
>    comment = Backups Share
>    path = /media/diverse/backups
>    force user = xbmc
>    read only = no
>    guest ok = yes
>
>
>
>>-----Oorspronkelijk bericht-----
>>Van: r.olszewski at ssc-services.de
>>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>>Verzonden: vrijdag 13 maart 2015 10:42
>>Aan: samba at lists.samba.org
>>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public 
>share with
>>guest not working
>>
>>Hi
>>I tried exactly your type of config.
>>
>>With "RequireSecuritySignature=0" the anon access is working
like
>>expected.
>>As soon, as I set "RequireSecuritySignature=1" it is not
working
>>anymore.
>>
>>So it seem to be not the problem to configure the guest-access. But
>>seems the problem with requiring the signing.
>>Thought it can be fixed with the right config, but did not find a
>>working combination.
>>
>>Do i have to setup certificates for the signing?
>>Or how the messages will be signed?
>>My guess is, that the signing isn't working like expected ...
>>
>>Gru? Raphael
>>___________________________________________
>>-----Urspr?ngliche Nachricht-----
>>Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
>>Gesendet: Freitag, 13. M?rz 2015 09:08
>>
>>Hai,
>>
>>Try these settings in global settings.
>>
>>####### Authentication #######
>>## stand alone everything open.
>>   security = user
>>   guest ok = yes
>>   map to guest = bad password
>>
>>add these to the share.
>>guest ok = yes
>>
>>Sets samba open without pasword prompt.
>>I use it at home for my kodi server.
>>
>>Greetz,
>>
>>Louis
>>
>>
>>>-----Oorspronkelijk bericht-----
>>>Van: r.olszewski at ssc-services.de
>>>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>>>Verzonden: donderdag 12 maart 2015 18:17
>>>
>>>Hello
>>>I have an samba server with a public share. It was configured with
>>>security=share.
>>>Now I have to tight security with setting those flags in the windows
>>>client:
>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>>>kstation\Parameters]
>>>EnablePlainTextPassword=0
>>>EnableSecuritySignature=1
>>>RequireSecuritySignature=1
>>>
>>..
>>>
>>>The Client shows ReasonCode: 0x80004005 When I change registry to
>>>RequireSecuritySignature=0, I can access
>>>
>>>How I have to configure the smb-server to have a real public 
>share for
>>>windows7-clients not being configured especially (domain,
>>>computer-account, user, ...) Do I understand 
>Security-signature wrong?
>>>Is this scenario possible without being the samba server 
>joined to the
>>>domain? (What I wanted)
>>>
>>>Raphael
>>
>>
>>--
>>To unsubscribe from this list go to the following URL and read the
>>instructions:  https://lists.samba.org/mailman/options/samba
>>--
>>To unsubscribe from this list go to the following URL and read the
>>instructions:  https://lists.samba.org/mailman/options/samba
>>
>>
>
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

Olszewski, Raphael

2015-Mar-16 07:56 UTC

head link

[Samba] RequireSecuritySignature=1 and public share with guest not working

Hi Louis

Thank you!
As i wrote in my first post, i tried even with these settings:
        client max protocol = SMB3
        client min protocol = SMB2
        client signing = required
        server signing = required
But it was not working - as soon I use RequireSecuritySignature=1 on the client.

It seems for that the client is stopping communication since the Win7-client
expects something from samba.
net use t: \\samba\pub<file:///\\samba\pub>
               systemerror 1240

MS knowledgebase article speek about enable plain text passwords. But this is
wrong since I do not change this password-setting, just require signing.

Is somebody out there, who knows, how to setup samba for using
RequireSecuritySignature=1 on Windows Clients?

Greetz  Raphael
___________________________________________
-----Urspr?ngliche Nachricht-----
Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
Gesendet: Freitag, 13. M?rz 2015 16:21
An: samba at lists.samba.org
Cc: Olszewski, Raphael
Betreff: RE: [Samba] RequireSecuritySignature=1 and public share with guest not
working

check the output of :

echo "\n" | testparm -vv | grep signing
and
echo "\n" | testparm -vv | grep protocol

for my the default is :
client max protocol = NT1

but i dont use signing.

but i "think" you need to set the client signing = manadatory and
client max protocol = SMB2

( from man smb.conf )

but if anyone know this better on the list, please correct me.
Im not sure in this one, never used it..


Greetz,

Louis

>-----Oorspronkelijk bericht-----
>Van: r.olszewski at ssc-services.de
>[mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>Verzonden: vrijdag 13 maart 2015 15:57
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public share with
>guest not working
>
>Hi Louis
>I explicitly have to change on win7-client the parameter
>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>kstation\Parameters]
>from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
>and then I have the problem.
>Before everything is working.
>All solutions in the wide web just tell me to set
>RequireSecuritySignature=0, but this is NOT the solution for me since I
>have to activate RequireSecuritySignature=1 My question originally is:
>Why it is failing then? Or what I have to do, that this is working with
>RequireSecuritySignature=1?
>
>Raphael

Seemingly Similar Threads

Search for more maybe matching threads

samba - Mar 2015 - RequireSecuritySignature=1 and public share with guest not working

[Samba] RequireSecuritySignature=1 and public share with guest not working

[Samba] RequireSecuritySignature=1 and public share with guest not working

[Samba] RequireSecuritySignature=1 and public share with guest not working

[Samba] RequireSecuritySignature=1 and public share with guest not working

Seemingly Similar Threads