samba - Nov 2016 - problem connecting to shares from Win7 clients - invalid NTLMSSP_MIC

Domain users using Windows 7 systems lose the ability to connect to
Samba shares. Some users can connect one day but then lose the ability
the next.

When the problem starts to occur the log.smbd displays:
==============================================  check_ntlm_password: 
authentication for user [user1] -> [user1] ->
[MYDOMAIN\user1] succeeded
  ntlmssp_server_postauth: invalid NTLMSSP_MIC for user=[user1]
domain=[MYDOMAIN] workstation=[MACHINE]
==============================================
The file server in question is running Version 4.5.2-GIT-0d08df6
The PDC (a different server) is running Version 3.6.24-SerNet-Debian

Connecting using smbclient from two other Samba installations, one
running 3.6.22 and one running 3.6.19 work fine.
The log.smbd just displays the first line from the two above for
smbclient connections as well as the currently working users from
their Win7 boxes.
==============================================  check_ntlm_password: 
authentication for user [user1] -> [user1] ->
[MYDOMAIN\user1] succeeded
==============================================There is no foillow-up postauth
error in these cases.

Assistance is appreciated.

Thank you,

Chris

There is bug for this:

https://bugzilla.samba.org/show_bug.cgi?id=12303

I am testing this option to resolve this:

client ipc signing = No

But I am not yet sure if it works.

Regards

Christian


Am Mittwoch, den 16.11.2016, 15:41 -0500 schrieb Sonic via
samba:
> Domain users using Windows 7 systems lose the ability to connect to
> Samba shares. Some users can connect one day but then lose the ability
> the next.
> 
> When the problem starts to occur the log.smbd displays:
> ==============================================>  
check_ntlm_password:  authentication for user [user1] -> [user1] ->
> [MYDOMAIN\user1] succeeded
>   ntlmssp_server_postauth: invalid NTLMSSP_MIC for user=[user1]
> domain=[MYDOMAIN] workstation=[MACHINE]
> ==============================================> 
> The file server in question is running Version 4.5.2-GIT-0d08df6
> The PDC (a different server) is running Version 3.6.24-SerNet-Debian
> 
> Connecting using smbclient from two other Samba installations, one
> running 3.6.22 and one running 3.6.19 work fine.
> The log.smbd just displays the first line from the two above for
> smbclient connections as well as the currently working users from
> their Win7 boxes.
> ==============================================>  
check_ntlm_password:  authentication for user [user1] -> [user1] ->
> [MYDOMAIN\user1] succeeded
> ==============================================> There is no foillow-up
postauth error in these cases.
> 
> Assistance is appreciated.
> 
> Thank you,
> 
> Chris
> 
-- 
Dr. Christian Naumer

B.R.A.I.N Aktiengesellschaft
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.de, homepage www.brain-biotech.de
fon +49-6251-9331-30  /   fax +49-6251-9331-11


Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Dr. Juergen Eck (Vorsitzender), Frank Goebel, Dr. Georg Kellinghusen
Aufsichtsrat: Dr. Ludger Mueller (Vorsitzender), Dr. Holger Zinke (Stellv.
Vorsitzender)

On Thu, Nov 17, 2016 at 3:00 AM, Christian Naumer via samba
<samba at lists.samba.org> wrote:
> https://bugzilla.samba.org/show_bug.cgi?id=12303
>
> client ipc signing = No
I saw that bug but it's a bit different then what I see, as smbclient
connections from 'nix systems always work.

I'm already running "client ipc signing = No" as that was
necessary to
join the domain.

Oddly enough once a user starts having the problem any user from that
system has the problem. IOW logging onto the problem users system as a
domain admin will still not connect to the 4.5.x server, although can
still connect to all other samba and windows systems.

Also after restarting the services (nmbd winbind smbd) the problem
goes away, but eventually does return (not tied to any particular
Windows system).

Thanks,

Chris