samba - Oct 2020 - Upgrade to Samba 4.12 question

Hello, guys. 

I?d like to upgrade our Samba 4.11 AD to 4.12. In release notes,
REMOVED FEATURES, I see this:
?Retiring DES encryption types in Kerberos.
------------------------------------------
With this release, support for DES encryption types has been removed
from
Samba, and setting DES_ONLY flag for an account will cause Kerberos
authentication to fail for that account (see RFC-6649).?

In our network, we have some really ancient machines, which are SMB one
only. These are CNC machines with some embedded Windows like 95, so
upgrade of OS is impossible.
While that machines communicate with fileserver, I can see this message
in log.samba on DC:
? Auth: [NETLOGON,ServerAuthenticate] user [SVMETAL]\[TCL3030$] at
[Mon, 05 Oct 2020 10:31:40.762795 CEST] with [DES] status
[NT_STATUS_DOWNGRADE_DETECTED] workstation [(null)] remote host
[ipv4:192.168.1.28:1076] mapped to [(null)]\[(null)]. local host
[ipv4:192.168.1.1:139]  NETLOGON computer [TCL3030] trust account
[(null)]?.

Does it mean, when I upgrade to Samba 4.12, that machine communications
will be refused? 
So we have to stay (stuck) on Samba 4.11?
Or is there possibility to go around this?

Thank you for answer.


Best regards
 
Ji?? ?ern?
System administrator
 
+420 775 860 300
cerny at svmetal.cz
helpdesk at svmetal.cz
 
SV metal spol. s r.o.
Divec 99
500 03 Hradec Kr?lov?
Czech republic
 
www.svmetal.cz

On 05/10/2020 09:49, Ji?? ?ern? via samba wrote:
> Hello, guys.
>
> I?d like to upgrade our Samba 4.11 AD to 4.12. In release notes,
> REMOVED FEATURES, I see this:
> ?Retiring DES encryption types in Kerberos.
> ------------------------------------------
> With this release, support for DES encryption types has been removed
> from
> Samba, and setting DES_ONLY flag for an account will cause Kerberos
> authentication to fail for that account (see RFC-6649).?
>
> In our network, we have some really ancient machines, which are SMB one
> only. These are CNC machines with some embedded Windows like 95, so
> upgrade of OS is impossible.
> While that machines communicate with fileserver, I can see this message
> in log.samba on DC:
> ? Auth: [NETLOGON,ServerAuthenticate] user [SVMETAL]\[TCL3030$] at
> [Mon, 05 Oct 2020 10:31:40.762795 CEST] with [DES] status
> [NT_STATUS_DOWNGRADE_DETECTED] workstation [(null)] remote host
> [ipv4:192.168.1.28:1076] mapped to [(null)]\[(null)]. local host
> [ipv4:192.168.1.1:139]  NETLOGON computer [TCL3030] trust account
> [(null)]?.
>
> Does it mean, when I upgrade to Samba 4.12, that machine communications
> will be refused?
> So we have to stay (stuck) on Samba 4.11?
> Or is there possibility to go around this?
>
Stop me if I am wrong, but, from memory (long time since I saw a win95 
machine), win9x never used kerberos, it only used lanman auth, so 
changes to kerberos shouldn't affect you. If it worked on 4.11.x, it 
should work on 4.12.x

Rowland

On 05.10.20 11:26, Rowland penny via samba wrote:
> Stop me if I am wrong, but, from memory (long time since I saw a win95
> machine), win9x never used kerberos, it only used lanman auth, so
> changes to kerberos shouldn't affect you. If it worked on 4.11.x, it
> should work on 4.12.x
You can install an optional Active Directory Service Client for win9x,
but that only replaces lanman with NTLMv2, Kerberos is explicitly not
supported.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20201005/789f9498/signature.sig>

On Mon, 2020-10-05 at 10:49 +0200, Ji?? ?ern? via samba
wrote:
> Hello, guys. 
> 
> I?d like to upgrade our Samba 4.11 AD to 4.12. In release notes,
> REMOVED FEATURES, I see this:
> ?Retiring DES encryption types in Kerberos.
> ------------------------------------------
> With this release, support for DES encryption types has been removed
> from
> Samba, and setting DES_ONLY flag for an account will cause Kerberos
> authentication to fail for that account (see RFC-6649).?
> 
> In our network, we have some really ancient machines, which are SMB
> one
> only. These are CNC machines with some embedded Windows like 95, so
> upgrade of OS is impossible.
> While that machines communicate with fileserver, I can see this
> message
> in log.samba on DC:
> ? Auth: [NETLOGON,ServerAuthenticate] user [SVMETAL]\[TCL3030$] at
> [Mon, 05 Oct 2020 10:31:40.762795 CEST] with [DES] status
> [NT_STATUS_DOWNGRADE_DETECTED] workstation [(null)] remote host
> [ipv4:192.168.1.28:1076] mapped to [(null)]\[(null)]. local host
> [ipv4:192.168.1.1:139]  NETLOGON computer [TCL3030] trust account
> [(null)]?.
> 
> Does it mean, when I upgrade to Samba 4.12, that machine
> communications
> will be refused? 
> So we have to stay (stuck) on Samba 4.11?
> Or is there possibility to go around this?
This isn't Kerberos, but NETLOGON.  There are parameters which allow
DES authentication in NETLOGON, the one you want would be "allow nt4
crypto".  However the default for that hasn't changed in years, so that
won't be it.

Andrew Bartlett

-- 
Andrew Bartlett                       https://samba.org/~abartlet/
Authentication Developer, Samba Team  https://samba.org
Samba Developer, Catalyst IT          
https://catalyst.net.nz/services/samba