search for: sign_algo_id

Hi! I'm seeing quite some messages in log.smbd like this: [2024/03/01 15:59:00.612141, 0, pid=1778617] libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu) Bad SMB2 (sign_algo_id=1) signature for message [2024/03/01 15:59:00.612146, 0, pid=1778616] lib/util/util.c:578(dump_data) [0000] 7E 8D E3 FE A9 44 E8 E3 A6 76 22 6A B2 A4 27 CF ~....D.. .v"j..'. [2024/03/01 15:59:00.612166, 0, pid=1778617] lib/util/util.c:578(dump_data) [0000] 2D 99 5B 40 BA B0 66...

3rd one in one day. [2024/01/10 16:42:03.713034, 0, pid=2049252] ../../libcli/smb/smb2_signing.c:722(smb2_signing_check_pdu) Bad SMB2 (sign_algo_id=1) signature for message [2024/01/10 16:42:03.713044, 0, pid=2049252] ../../lib/util/util.c:571(dump_data) [0000] 73 ED 8B E2 56 72 79 4E 53 7E BE 48 DF EC 07 6E s...VryN S~.H...n [2024/01/10 16:42:03.713057, 0, pid=2049252] ../../lib/util/util.c:571(dump_data) [0000] C2 81 22 44 50 2B...

01.04.2024 13:56, Jones Syue ???: >> I can't say for sure but I *think* each time the client is windows server 2012. > > Looks good :) If run this script[1] to test multiple dialects, found only > SMB3_00 and SMB3_02 has this "(sign_algo_id=1)", and per doc[2] it could > be happend with ws2012 and ws2012r2. This *is* 2012 r2. The protocol version it negotiates is shown by smbstatus on samba server, it is SMB3_02. More modern workstations negotiate SMB3_11. > Perhaps some kind of services, like antivirus scan LAN, or pri...

> 'ioctl command to query network info' requires SMB Signing been turn-on > looks like not mentioned in [MS-SMB2] spec document, though through > wireshark caputures it did force client to sign the request packet, will > ask dochelp for help later to make sure (iirc SambaXP/SDC/SNIA conference > Obaid's talk seems mentioned it)

23.04.2024 04:32, Jones Syue ??? via samba wrote: > https://lists.samba.org/archive/cifs-protocol/2024-April/004282.html > Just for reference Microsoft will update doc [MS-SMB2] later :) This does not answer how windows chooses signing key if the connection is anonymous, though -- it is what started this whole thread :) Thanks, /mjt

...line 121, in run (sid, domain_name) = s3_net.join_member(netbios_name, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Joining the domain partial log Bind RPC Pipe: host dc2.balewan.unicorn.com auth_type 0, auth_level 1 rpc_api_pipe: host dc2.balewan.unicorn.com signed SMB2 message (sign_algo_id=2) rpc_read_send: data_to_read: 52 check_bind_response: accepted! rpc_api_pipe: host dc2.balewan.unicorn.com signed SMB2 message (sign_algo_id=2) rpc_read_send: data_to_read: 32 rpc_api_pipe: host dc2.balewan.unicorn.com signed SMB2 message (sign_algo_id=2) rpc_read_send: data_to_read: 232 rpc_api_...

...with 'net ads join -U administrator' (after you have checked that they can connect to a DC) > > Joining the domain partial log > > Bind RPC Pipe: host dc2.balewan.unicorn.com auth_type 0, auth_level 1 > rpc_api_pipe: host dc2.balewan.unicorn.com > signed SMB2 message (sign_algo_id=2) > rpc_read_send: data_to_read: 52 > check_bind_response: accepted! > rpc_api_pipe: host dc2.balewan.unicorn.com > signed SMB2 message (sign_algo_id=2) > rpc_read_send: data_to_read: 32 > rpc_api_pipe: host dc2.balewan.unicorn.com > signed SMB2 message (sign_algo_id=2) > r...

...ient privileges ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line 3230, in run ??? create_directory_hier(conn, vgp_dir) ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line 383, in create_directory_hier ??? conn.mkdir(path) signed SMB2 message (sign_algo_id=2) I tried also this cmd with -UAdministrator but the same error appears. Is this normal? If yes where to configure this permissions? -- Jaros?aw K?opotek, kom. 607 893 111

...k ports version everything was fine HTH Some poor sole in the future > >> >> Joining the domain partial log >> >> Bind RPC Pipe: host dc2.balewan.unicorn.com auth_type 0, auth_level 1 >> rpc_api_pipe: host dc2.balewan.unicorn.com >> signed SMB2 message (sign_algo_id=2) >> rpc_read_send: data_to_read: 52 >> check_bind_response: accepted! >> rpc_api_pipe: host dc2.balewan.unicorn.com >> signed SMB2 message (sign_algo_id=2) >> rpc_read_send: data_to_read: 32 >> rpc_api_pipe: host dc2.balewan.unicorn.com >> signed SMB2 mes...

...po.py", line >>> 3230, in run >>> ??? create_directory_hier(conn, vgp_dir) >>> ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >>> 383, in create_directory_hier >>> ??? conn.mkdir(path) >>> signed SMB2 message (sign_algo_id=2) >> >> You've authenticated an SMB session, and your user is attempting to >> create a directory on the share, but is getting a permissions error. >> If this is happening for the Administrator, then you clearly have a >> permissions issue on your sysvol share....

...ot;/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line > 3230, in run > ??? create_directory_hier(conn, vgp_dir) > ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line 383, > in create_directory_hier > ??? conn.mkdir(path) > signed SMB2 message (sign_algo_id=2) You've authenticated an SMB session, and your user is attempting to create a directory on the share, but is getting a permissions error. If this is happening for the Administrator, then you clearly have a permissions issue on your sysvol share. Try running `samba-tool ntacl sysvolreset`...

...-packages/samba/netcmd/gpo.py", line >> 3230, in run >> ??? create_directory_hier(conn, vgp_dir) >> ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >> 383, in create_directory_hier >> ??? conn.mkdir(path) >> signed SMB2 message (sign_algo_id=2) > > You've authenticated an SMB session, and your user is attempting to > create a directory on the share, but is getting a permissions error. > If this is happening for the Administrator, then you clearly have a > permissions issue on your sysvol share. Try running `samba-...

...t;/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line > 3230, in run > ??? create_directory_hier(conn, vgp_dir) > ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line > 383, in create_directory_hier > ??? conn.mkdir(path) > signed SMB2 message (sign_algo_id=2) > > I tried also this cmd with -UAdministrator but the same error appears. > > Is this normal? > If yes where to configure this permissions? What version of Samba are you using, there have been a few updates in the area that is failing for you. Rowland

...gt;>> 3230, in run >>>> ??? create_directory_hier(conn, vgp_dir) >>>> ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >>>> 383, in create_directory_hier >>>> ??? conn.mkdir(path) >>>> signed SMB2 message (sign_algo_id=2) >>> >>> You've authenticated an SMB session, and your user is attempting to >>> create a directory on the share, but is getting a permissions error. >>> If this is happening for the Administrator, then you clearly have a >>> permissions issue o...

...run >>>>> ??? create_directory_hier(conn, vgp_dir) >>>>> ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >>>>> 383, in create_directory_hier >>>>> ??? conn.mkdir(path) >>>>> signed SMB2 message (sign_algo_id=2) >>>> >>>> You've authenticated an SMB session, and your user is attempting to >>>> create a directory on the share, but is getting a permissions >>>> error. If this is happening for the Administrator, then you clearly >>>> have a...

...kages/samba/netcmd/gpo.py", line >> 3230, in run >> ??? create_directory_hier(conn, vgp_dir) >> ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >> 383, in create_directory_hier >> ??? conn.mkdir(path) >> signed SMB2 message (sign_algo_id=2) >> >> I tried also this cmd with -UAdministrator but the same error appears. >> >> Is this normal? >> If yes where to configure this permissions? > What version of Samba are you using, there have been a few updates in > the area that is failing for you. ii? sa...

...ntly. No more > errors. Until today, I can't login to my computer, showing "Your > domain isn't available" and journalctl -xeu samba-ad-dc showing in > attachments. > > The 4 DCs are up and samba online. > > Any idea please ? > > That 'Bad SMB2 (sign_algo_id=1) signature for message' shows that something is trying to connect without using SMBv2 signing, probably 'guest' access or using SMBv1 (or both), though this usually will not have anything to do with your main problem. What are the clients and what is in the DCs smb.conf file ? Rowla...

...y", line >>> 3230, in run >>> ? ??? create_directory_hier(conn, vgp_dir) >>> ? ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line >>> 383, in create_directory_hier >>> ? ??? conn.mkdir(path) >>> signed SMB2 message (sign_algo_id=2) >>> >>> I tried also this cmd with -UAdministrator but the same error appears. >>> >>> Is this normal? >>> If yes where to configure this permissions? >> What version of Samba are you using, there have been a few updates in >> the area tha...

> > > > No, but this is the point, we'd like to have a completely anonymous > access since the share is used from multifunction printers to exchange > scanned pdfs with windows 11 clients. > > Depending on the age of the MFP, some use much older CIFS clients that rely upon SMB1. You may need to account for this on the 4.17 file server.

...e 3230, in run > >>> ? ??? create_directory_hier(conn, vgp_dir) > >>> ? ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", > >>> line 383, in create_directory_hier > >>> ? ??? conn.mkdir(path) > >>> signed SMB2 message (sign_algo_id=2) > >>> > >>> I tried also this cmd with -UAdministrator but the same error > >>> appears. > >>> > >>> Is this normal? > >>> If yes where to configure this permissions? > >> What version of Samba are you using, there...