samba - Jun 2017 - ntlm_auth and SMBv2/v3

Hi ,

I just need some clarification ;

We currently use ntlm_auth + winbind for AD auth on Freeradius, will
disabling SMBv1 break authentication for ntlm_auth + Freeradius ?

Many Thanks
Arnab

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Arnab Roy via samba
> Verzonden: donderdag 8 juni 2017 14:23
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] ntlm_auth and SMBv2/v3
> 
> Hi ,
> 
> I just need some clarification ;
> 
> We currently use ntlm_auth + winbind for AD auth on 
> Freeradius, will disabling SMBv1 break authentication for 
> ntlm_auth + Freeradius ?
Yes
> 
> Many Thanks
> Arnab
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

hai, 
 
Please keep it mailing to the list, this way is shows up of others also. 
A workaround for disabling SMBv1, you can make your server less secure but thats
not what i would do.

Setting these to enable NTLM v1 again.

lanman auth = yes
ntlm auth = yes
raw NTLMv2 auth = yes

I think also this is more a question for the free raduis list, but i would to
for a ldap(s) setup.
just dont mixup these to : start_tls and tls_mode to connect to port 636 on a
samba AD DC, you need :
start_tls=no and tls_mode = yes
 
My preffered auth order if the app allows it. 
kerberos
ldap(s)
ntlm as last resort. 
 
Best regards, 
 
Louis
 
 
 
Van: Arnab Roy [mailto:arniekol at gmail.com] 
Verzonden: donderdag 8 juni 2017 15:07
Aan: L.P.H. van Belle
Onderwerp: Re: [Samba] ntlm_auth and SMBv2/v3



Are their any plans finding a work around for this..as their tremendous amount
of security paranoia related to smbv1 now...

On 8 Jun 2017 13:54, "L.P.H. van Belle via samba" <samba at
lists.samba.org> wrote:
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens
> Arnab Roy via samba
> Verzonden: donderdag 8 juni 2017 14:23
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] ntlm_auth and SMBv2/v3
>
> Hi ,
>
> I just need some clarification ;
>
> We currently use ntlm_auth + winbind for AD auth on
> Freeradius, will disabling SMBv1 break authentication for
> ntlm_auth + Freeradius ?
Yes
>
> Many Thanks
> Arnab
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On Thu, 2017-06-08 at 13:23 +0100, Arnab Roy via samba
wrote:
> Hi ,
> 
> I just need some clarification ;
> 
> We currently use ntlm_auth + winbind for AD auth on Freeradius, will
> disabling SMBv1 break authentication for ntlm_auth + Freeradius ?
That should work fine, as long as you are running current Samba.  We
aim to use SMB2 for the DC connection from winbindd in any case, as it
is more secure. 

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba