search for: smb2_sign

Hi! I'm seeing quite some messages in log.smbd like this: [2024/03/01 15:59:00.612141, 0, pid=1778617] libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu) Bad SMB2 (sign_algo_id=1) signature for message [2024/03/01 15:59:00.612146, 0, pid=1778616] lib/util/util.c:578(dump_data) [0000] 7E 8D E3 FE A9 44 E8 E3 A6 76 22 6A B2 A4 27 CF ~....D.. .v"j..'. [2024/03/01 15:59:00.612166, 0, pid=1778617] lib...

3rd one in one day. [2024/01/10 16:42:03.713034, 0, pid=2049252] ../../libcli/smb/smb2_signing.c:722(smb2_signing_check_pdu) Bad SMB2 (sign_algo_id=1) signature for message [2024/01/10 16:42:03.713044, 0, pid=2049252] ../../lib/util/util.c:571(dump_data) [0000] 73 ED 8B E2 56 72 79 4E 53 7E BE 48 DF EC 07 6E s...VryN S~.H...n [2024/01/10 16:42:03.713057, 0, pid=2049252] ../../...

...ck_order_lock: check lock order 1 for /tmp/samba/smbXsrv_session_global.tdb [2019/09/25 15:01:46.695371, 5] ../lib/dbwrap/dbwrap.c:159(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 1 for /tmp/samba/smbXsrv_session_global.tdb [2019/09/25 15:01:46.695622, 5] ../libcli/smb/smb2_signing.c:93(smb2_signing_sign_pdu) signed SMB2 message [2019/09/25 15:01:47.845994, 0] ../libcli/smb/smb2_signing.c:171(smb2_signing_check_pdu) Bad SMB2 signature for message [2019/09/25 15:01:47.846405, 0] ../lib/util/util.c:514(dump_data) [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00...

...mbd/dosmode.c:196(unix_mode) > unix_mode(digicam pictures/events/PHD Defences) returning 0770 > [2017/01/31 10:08:32.322337, 3] ../source3/smbd/dosmode.c:196(unix_mode) > unix_mode(digicam pictures/events/PHD Defences) returning 0760 > [2017/01/31 10:08:32.322387, 5] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) > signed SMB2 message > [2017/01/31 10:08:32.322903, 4] ../source3/smbd/uid.c:384(change_to_user) > Skipping user change - already user > [2017/01/31 10:08:32.322941, 5] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) > check lock order 1 fo...

...gth: 26 [2020/05/20 16:42:23.869296, 3] ../../source3/smbd/smb2_server.c:3274(smbd_smb2_request_error_ex) smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_INVALID_PARAMETER] || at ../../source3/smbd/smb2_ioctl.c:312 [2020/05/20 16:42:23.869317, 5] ../../libcli/smb/smb2_signing.c:174(smb2_signing_sign_pdu) signed SMB2 message [2020/05/20 16:42:23.869547, 5] ../../source3/smbd/uid.c:326(change_to_user_impersonate) change_to_user_impersonate: Skipping user change - already user [2020/05/20 16:42:23.869573, 5] ../../source3/smbd/uid.c:298(print_impersonation_info)...

...elf. I managed to increase the debug level to 10 and to save the logs (and two coredumps), one of the samba logs and the syslogs is quoted below. Google showed me some bugs which could be related to this [1], but none of them is related to the current 4.1.x release and I'm not sure if open.c or smb2_signing.c is to blame. To be able to work again, I forced a downgrade to 4.0.14. Can anyone give me a hint how to deal with this error? Can I give any more information? Thank you very much in advance! Regards Philipp [1] https://bugzilla.samba.org/show_bug.cgi?id=9853 https://bugzilla.samba.org/show_...

Thanks for the suggestions! > The latter is easiest to deal with, replace it with a CNAME in the AD dns. I did the CNAME, but when I remove the netbios alias I can see the shares list when accessing \\aliasname, but then I'm not allowed into any of them. I tried rebooting the client but same result, and I also don't see anything in the logs :( > The first will require a bit more

...IX perms in order to do the access checks. Then it checks the open request using the current process token against the NT ACL to decide whether to allow access. > Also, the line: > > [2016/11/14 12:49:21.964411, 5, pid=28398, effective(2310, 2049), > real(2310, 0)] > ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) > > How is the real different from the effective on a simple unix file? These come from the current uid/gid of the process - constructed here: ", effective(%u, %u), real(%u, %u)", (unsigned int)geteuid...

...ATA/install/samba-4.11.6/bin/default/source4/libcli/composite/composite.c.4.o'] In file included from ../../source4/../libcli/smb/smb_common.h:30, from ../../source4/libcli/raw/libcliraw.h:25, from ../../source4/libcli/composite/composite.c:26: ../../libcli/smb/smb2_signing.h:30: error: expected specifier-qualifier-list before 'gnutls_hmac_hd_t' Waf: Leaving directory `/lfs/EDA/DATA/install/samba-4.11.6/bin/default' Build failed -> task in 'cli_composite' failed with exit status 1: {task 39922456: c composite.c -> composite.c.4.o}...

I am running several Solaris 11 file servers with samba 4.7.6. This is an AD domain but the domain controllers are Win 2008 R2 and Windows 2012 R2. All users and groups in AD have unix uidNumbers and gidNumbers assigned. On one file server, I am having problems where some users can not access files , via windows, to which they should have access as the group member. For example,

Hi Andrew, If I give register user as vignesh/guest, its working fine. While selecting the Guest radio button, guest user is not working. Guest user is working fine without AD connection. Kindly do the needful. Thanks, Vignesh. On Wed, Sep 25, 2019 at 4:28 PM Andrew Bartlett <abartlet at samba.org> wrote: > On Wed, 2019-09-25 at 16:24 +0530, VigneshDhanraj G via samba wrote: > >

.../05/04 13:09:54.028912, 5] ../source3/libsmb/namequery.c:210(saf_fetch) saf_fetch: failed to find server for "B" domain [2017/05/04 13:09:54.029028, 5] ../source3/rpc_client/cli_pipe.c:826(rpc_api_pipe_send) rpc_api_pipe: host dc1.a.com [2017/05/04 13:09:54.029070, 5] ../libcli/smb/smb2_signing.c:93(smb2_signing_sign_pdu) signed SMB2 message [2017/05/04 13:09:54.029782, 5] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 456 [2017/05/04 13:09:54.029841, 6] ../librpc/rpc/dcerpc_util.c:173(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:173: a...

On Mon, Nov 14, 2016 at 11:38:52AM -0500, Josh Malone via samba wrote: > All, > > Apologies for basically bumping my own thread, but I'm absolutely at > my wits' end trying to figure out this access problem. I've > replicated the issue with and without NFS being involved. On our old > 4.0.25 server, users can write to files that they have group-based > write

...ump_data) Aug 1 08:07:50 dc2 smbd[2601]: [0000] 97 0E 60 D4 29 8C C3 39 D1 19 5C 44 2F 11 BC 41 ..`.)..9 ..\D/..A Aug 1 08:17:01 dc2 CRON[2652]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Aug 1 08:43:15 dc2 smbd[2716]: [2017/08/01 08:43:15.604096, 0] ../libcli/smb/smb2_signing.c:171(smb2_signing_check_pdu) Aug 1 08:43:15 dc2 smbd[2716]: Bad SMB2 signature for message Aug 1 08:43:15 dc2 smbd[2716]: [2017/08/01 08:43:15.604184, 0] ../lib/util/util.c:555(dump_data) Aug 1 08:43:15 dc2 smbd[2716]: [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...........

...dbwrap_check_lock_order) check lock order 1 for /var/samba/lock/smbXsrv_tcon_global.tdb [2018/01/04 11:42:32.080907, 5] ../lib/dbwrap/dbwrap.c:145(dbwrap_lock_order_state_destructor) release lock order 1 for /var/samba/lock/smbXsrv_tcon_global.tdb [2018/01/04 11:42:32.080960, 5] ../libcli/smb/smb2_signing.c:93(smb2_signing_sign_pdu) signed SMB2 message [2018/01/04 11:42:39.182065, 4] ../source3/smbd/sec_ctx.c:320(set_sec_ctx_internal) <snip> >From log file for unsuccessful user: <snip> [2018/01/02 07:59:32.253188, 3] ../source3/smbd/service.c:536(make_connection_snum) Connec...

...t at all what the file permissions are though. Am I mis-reading this or is Samba getting permissions some other way. This is a purely Unix filesystem - there should be no NTFS ACLs. Also, the line: [2016/11/14 12:49:21.964411, 5, pid=28398, effective(2310, 2049), real(2310, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) How is the real different from the effective on a simple unix file? Thanks again, -Josh -- -------------------------------------------------------- Joshua Malone Systems Administrator (jmalone at nrao.edu) NRAO Charlottesville 434...

...s checks. Then it checks the open request using the > current process token against the NT ACL to decide whether to > allow access. > >> Also, the line: >> >> [2016/11/14 12:49:21.964411, 5, pid=28398, effective(2310, 2049), >> real(2310, 0)] >> ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) >> >> How is the real different from the effective on a simple unix file? > > These come from the current uid/gid of the process - constructed > here: > > ", effective(%u, %u), real(%u, %u)", >...

...working fine without AD connection. Andrew said: server signing as mandatory makes no sense with a guest connection, where there is no password with which to secure the session. Which is okay as far as it goes. Your client seems to be using SMBv2: [2019/09/25 15:01:46.695622, 5]../libcli/smb/smb2_signing.c:93(smb2_signing_sign_pdu)? signed SMB2 message And 'man smb.conf' has this to say about 'server signing': This controls whether the client is allowed or required to use SMB1 and SMB2 signing. Possible values are default, auto, mandatory and disabled. By default, and when s...

...said: > > server signing as mandatory makes no sense with a guest connection, > where there is no password with which to secure the session. > > Which is okay as far as it goes. > > Your client seems to be using SMBv2: > > [2019/09/25 15:01:46.695622, > 5]../libcli/smb/smb2_signing.c:93(smb2_signing_sign_pdu) signed SMB2 > message > > And 'man smb.conf' has this to say about 'server signing': > > This controls whether the client is allowed or required to use SMB1 and > SMB2 signing. Possible values are default, auto, mandatory and disable...

...e_connection_snum) > >> > >> 192.168.3.225 (ipv4:192.168.3.225:60275) connect to service > >> users initially as user MYDOMAIN\someuser (uid=xxxx, gid=xxx) (pid > >> 6264) > >> > >> [2018/07/24 22:34:19.868642, 0] > >> ../libcli/smb/smb2_signing.c:171(smb2_signing_check_pdu) > >> > >> Bad SMB2 signature for message > >> > >> [2018/07/24 22:34:19.868723, 0] ../lib/util/util.c:515(dump_data) > >> > >> [0000] F7 44 6E EC BE 8F A2 B3 5F 45 D0 82 44 7E 3C D1 > >> -Dn-.--...